{ "Event": { "published": true, "date": "2026-10-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-10-06", "timestamp": 1791331382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c2f9eb09-3d35-4284-8a8e-a09ce5fa6c91", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8747a00a-c17e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791288460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288460, "uuid": "f10b02e5-3080-4faa-9ed0-5b51f11601bc", "comment": "Malware payload", "value": "d029edb2de34a1cf91453ca0e26010e1", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288460, "uuid": "e608bf78-a103-4bf4-8e82-cc37f4bc6ce1", "comment": "Malware payload", "value": "00560eaec8e7b1700da1e1747c09cf35222ed881df33864338a3da6efaddeafa", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288460, "uuid": "aceff971-e6f2-4440-a1e8-e3df3a79fd14", "comment": "Malware payload", "value": "5abb0ac07b3255ca1501af4b36f84fe1cfeafe7b", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288460, "uuid": "9aca781a-ca3e-4271-b8d4-d49677d66637", "comment": "Malware payload", "value": "e96168c7d163dc565597b0f1a5c9c5fa5c8cc13eb2c452adf25689210e364ae989d6f6f6a41499e5e4da5a8107e415d2", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288460, "uuid": "d8f5d9d9-a232-4015-ac4a-b4deae453a54", "value": "T1A74502128F2690A6F58CCE34362F8EFB5F216270844E11DB67925A489C267D3F45B36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288460, "uuid": "f34d4d60-fcb5-4263-976d-5256cb54a28c", "value": "24576:LqJMg0drKCOfnpaXgLfJju0cZI2djY0defL3a3EDN:+YwfnpawLfJK0cPjIfL3a0DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288460, "uuid": "5f31150b-cca1-4669-9656-7352dc817d22", "value": 1232048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288460, "uuid": "dfe74f9b-d123-495d-815f-23ef95cdf779", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288460, "uuid": "5bc32b1d-46dc-48e7-9b5a-bf9aa9ddd6a0", "value": "00560eaec8e7b1700da1e1747c09cf35222ed881df33864338a3da6efaddeafa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a2bda2-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273019, "uuid": "ac605835-9b24-4809-9ca1-b8f117ea04b9", "comment": "Malware payload", "value": "90d3633c4721337fb970fc0c64e0bc8e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273019, "uuid": "b1ad59d1-7060-4e75-8897-64c8d6aebfd2", "comment": "Malware payload", "value": "0056441e90ee0d2b3121f0a761660b52644bae557196a4599f5480d48e853d8d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273019, "uuid": "fbff5423-c0ed-4e56-b5f1-8580f354a994", "comment": "Malware payload", "value": "c9eaf73a112565e82a30e6b33c319554b631ea18", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273019, "uuid": "414a91bb-ecf7-47bc-8f5c-0d3317108855", "comment": "Malware payload", "value": "cf4b6d058477d3eddacba9590925b430e2f3f066df504ba360efa9dc4d94d1be08f3ba4e44359473d864cc66f43bccc5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273019, "uuid": "3eea6c8e-e4da-4b25-89c5-6732e3692cab", "value": "T11FA4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273019, "uuid": "edee08a1-aad2-4010-8d79-9e08569ed611", "value": "12288:Qr06CUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZY:Qr06CUv4t1cNk/wjibhv4b2Ona", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273019, "uuid": "aa711087-6d3d-4cd8-a77d-85bf7b1fd0ae", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273019, "uuid": "3b784513-9bee-4bc3-b0c3-e88d68713267", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273019, "uuid": "668bec36-c9de-45e2-a925-0158f6f9d5c5", "value": "0056441e90ee0d2b3121f0a761660b52644bae557196a4599f5480d48e853d8d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41094189-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271162, "uuid": "d45bdd68-3460-41f8-9d31-03517a1bea5c", "comment": "Malware payload", "value": "f3d20213c06cb774e424e554ed96c00e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271162, "uuid": "57cc8123-3cbc-47c1-9f3f-015a89019229", "comment": "Malware payload", "value": "01346dc1f2d3ff4e19af98fc867b3042e914fe99c95cf036c76e218ef28bb213", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271162, "uuid": "9ffc8165-04f8-4def-9b8f-6d57048ca65d", "comment": "Malware payload", "value": "8b70d0f8edd0293b7321ee3771962181773e400c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271162, "uuid": "38a33e71-83d2-495b-97ac-2724f9c282c4", "comment": "Malware payload", "value": "6c70b57333324ce01bd1eaf57de5720a8e4773165c25e3ca4330c7f4c30aecf272fd9ba99ee58e04f8903d3c2e04bf15", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271162, "uuid": "522295d3-763d-49ae-8349-648803a4966d", "value": "T112C42304340641D5835A2B1EAEC4E7E0BEB5A0DBFA1CF940AADD7ED06DE92A173C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271162, "uuid": "517a74bd-4487-4b41-900e-8040f60e883c", "value": "12288:z6wlOMWROC/FTeHo22Qm7NzofOr68mVeA924EwCT:r4MQOC/gHozN7NzomW8DA9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271162, "uuid": "834c6cb6-8baa-4f04-a5f8-82c6b43cc515", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271162, "uuid": "4f2d28c8-d8e0-4a69-aecf-f18fe6eb36bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271162, "uuid": "f86b0c8d-a2b9-480c-a419-59b38a395167", "value": "01346dc1f2d3ff4e19af98fc867b3042e914fe99c95cf036c76e218ef28bb213.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c64adee-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275557, "uuid": "f5fe3354-fdc4-4124-a802-e1df63d21250", "comment": "Malware payload", "value": "c394b3f15d4976a22b8ed5d611b30c73", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275557, "uuid": "c482ac7b-b489-4bed-8916-f21b8765ce65", "comment": "Malware payload", "value": "018934eee20af190a89883a764107c66996870aa8cbb535744a00368ab18f52e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275557, "uuid": "ab55a0a7-fb45-4977-b7ad-08f2b682d38d", "comment": "Malware payload", "value": "8516ed29e810a862bf3e2855827d2b31f964918e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275557, "uuid": "1c4382ab-fbc5-4c41-ad09-196308d8b5ce", "comment": "Malware payload", "value": "065e7010d6cf34af2dbd0629aa9c821ebfc3e112cc98760e9395109994ce6bdc2ad0991ecd478a6f40ae933b972235ed", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275557, "uuid": "b82fafad-8a0a-46c2-b3a1-28e7669b9437", "value": "T118A4236D922554376D67B9D0AD1D2B020E70D18932DDDBD5CE0F38A08EFAC9C1EC61AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275557, "uuid": "e5fcaabb-a467-427f-8aa0-d0d9ad9af702", "value": "12288:mW+GusvMa+4zYfcEaN9B/Jm0LU0gM7aQI:mWF/vMa0fclN9BhmSHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275557, "uuid": "ff121521-556f-450e-b69e-278aad81f6be", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275557, "uuid": "a740e155-3fa6-4367-9f71-39495a639c4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275557, "uuid": "8dd68f48-2a3b-4ae8-a0f6-f7ff1ef91ae7", "value": "018934eee20af190a89883a764107c66996870aa8cbb535744a00368ab18f52e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702c6ac3-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791273389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273389, "uuid": "317c67b3-1e6a-4f37-a5fc-9265bacc9558", "comment": "Malware payload (RemcosRAT)", "value": "1767435c84e05eec76d99ee40a50e171", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273389, "uuid": "c38104ed-e009-413a-81b8-86498a1eb35a", "comment": "Malware payload (RemcosRAT)", "value": "01d41cfeaa36d7fb6990d7f3cc3486ab1c5be9338f3fa78b2403a6b9de8294be", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273389, "uuid": "016bfd9f-7def-4280-96e0-7064c61a62f3", "comment": "Malware payload (RemcosRAT)", "value": "c690aff4f90edf50fe94cbb1c9ec52d5db42eaf9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273389, "uuid": "62bd68dd-d3fb-4e4b-ad98-978f284f2c76", "comment": "Malware payload (RemcosRAT)", "value": "250fe0d70c5e1d599545d472f40307f34cd815c926e41c99d7e6dedfbd79bd183650c8534d4bdb6e42bca62a9b5cd35d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273389, "uuid": "e02d3196-9a41-4a2c-a5a1-5e897665e55d", "value": "T1F9365F965E68C383CD974D69CBE7DD6F227A03692A424946DDCC12A78BCF140FE09B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273389, "uuid": "ddc8ac11-b187-47cc-a89b-74ea9edf56a2", "value": "768:2CDFYoDCPMNHLxzf0tf5yTuUnYU7PxUruu0ub4WuB6vS8GDLaT+Il/dF0GNYflRU:6UnGV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273389, "uuid": "2dc95f0b-1bf7-47aa-b93e-30060844bd7a", "value": 5183348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273389, "uuid": "043227d7-dd1b-427c-a3dd-2b8b3d15e855", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273389, "uuid": "52a73d17-9966-4fb2-9247-76590ca022db", "value": "Multiple Card Charges.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962acf65-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276030, "uuid": "6ac8c190-dfcd-42a8-9baf-72d7785b54f3", "comment": "Malware payload", "value": "bb7d3eb578b458a6b6028451168be803", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276030, "uuid": "076fc6ef-c637-463f-b955-812d803fd29e", "comment": "Malware payload", "value": "01fcd342a7213606432223a38fc468bf3bd779b5931401e80c9a67045cca2553", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276030, "uuid": "b5f87b0a-0014-4632-b212-7ca16c70b8df", "comment": "Malware payload", "value": "e9358dc6907348839f113c044ce829daef106d18", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276030, "uuid": "87ff23ea-99d0-4ec2-9971-c00ef4d61947", "comment": "Malware payload", "value": "5e52b6fb76191edbf7f5bd3f7cd81844e760d323c86625562cd981a7447ee41243fe508f1355a2dec5e98498df77ebda", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276030, "uuid": "35cb58a0-19e7-4b5e-a7e9-0e63fd75e35f", "value": "T1CFA42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276030, "uuid": "ee45d0c8-8db7-4b9e-901a-967ccf930470", "value": "12288:MSCDe0U+m1V6ECbniSPfS3e2R3feeintFckXTsuC8hHp:MDe0wUTiSWzeeiDsP8dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276030, "uuid": "151d26d4-6306-4a28-9bc3-409aa87d21fa", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276030, "uuid": "4698d309-f1b3-43ff-a2c6-27863a827ace", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276030, "uuid": "524b6fb0-1be9-4898-a1b6-ab4142fa018f", "value": "01fcd342a7213606432223a38fc468bf3bd779b5931401e80c9a67045cca2553.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1844b12a-c199-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299870, "uuid": "024e2912-68af-4cd5-aac3-0ad09fed9154", "comment": "Malware payload", "value": "4b8d332f9a9c48df5d37998d901a57e6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299870, "uuid": "eb5394e5-b94d-4ba5-ab58-92f6a3acc304", "comment": "Malware payload", "value": "02223b985eeec86c8353794f80cb67e5ec2358f572fb9845312e21f5c2f9243e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299870, "uuid": "f501f028-5248-4cbf-b243-5a57fafba194", "comment": "Malware payload", "value": "791838e575b95373241cec50167b6169b6681e4f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299870, "uuid": "9313f17e-f27f-45ed-82b6-41e4df8861c9", "comment": "Malware payload", "value": "14afb493620452107fb55f62cfcf60aa97b70a18a504e8babd34c52bda2028331c0a658cafab960da7d41280b665e9c7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299870, "uuid": "94b40524-8e59-4d14-b807-d05f3d6dd4d1", "value": "T1EB252393717D36C7E7522F3A30A8D3E4C83710A6792B837E368AD10DB956791061B4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299870, "uuid": "03e2282f-9b9a-4c76-ab77-a62d16d88914", "value": "24576:e5acHJ2X9h1wTZ1FUt4lGRmMiMyXAScyi8sbLVbl:C5HJ4h1wT7Otfya8qpbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299870, "uuid": "d69d34f7-155a-42f4-8e86-a1006e8fca2e", "value": 983652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299870, "uuid": "5783f829-b6ef-4509-be1b-9d0e5b9427dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299870, "uuid": "ec641c7f-81a0-45e1-9fec-9eb72469d629", "value": "mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d380b15-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271639, "uuid": "68ad157c-25fe-4a75-bfab-d236d9e43951", "comment": "Malware payload", "value": "c2cc4c4b83872297106da8d2eaedcfd3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271639, "uuid": "f98e219c-c140-4a38-bbb3-3afa8b1ffe13", "comment": "Malware payload", "value": "02b981a7d0cec944810fefb3a992c582df16b0f4a31e42ef5ea3eed03bc8438d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271639, "uuid": "67a1a3eb-bc88-4912-8639-51f0ee4a1f65", "comment": "Malware payload", "value": "bfbdae67d0c19e85d784981730386074e6caf077", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271639, "uuid": "5f54003c-36d6-4f1c-a61a-ae10a4163a7a", "comment": "Malware payload", "value": "4c90d480c6f8bab47cb9d76b7d58d6c053ccf728a6e04f253e8e16b4f71085a21307593aeb18a20c44cf9e4c0984c2ea", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271639, "uuid": "44a77a61-28c3-4626-890c-fabb6a935f70", "value": "T191C4235D7018EB38E507A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271639, "uuid": "9fa8eccd-711f-446f-9952-ea1ab6d6f7fa", "value": "12288:5MU+0xq75aS9iYIp6cP/G2Bku8RtNvC28c5/VTUPkYym:9+J71vI/GbYc5/pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271639, "uuid": "92c993d4-d48b-4ffe-9c57-731693fd7ae2", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271639, "uuid": "d61e3b29-2c72-487b-8525-175163981fdc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271639, "uuid": "1a460337-0213-4545-be3b-71425ad8856a", "value": "02b981a7d0cec944810fefb3a992c582df16b0f4a31e42ef5ea3eed03bc8438d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79479206-c11c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246346, "uuid": "a3cafa52-2a5a-48e8-aaa3-5246cf3d3108", "comment": "Malware payload (Mirai)", "value": "9e9cce287d6114bab04e6cf07f8348b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246346, "uuid": "f2fee258-b769-4bc6-af20-7a45ea72d561", "comment": "Malware payload (Mirai)", "value": "032589028f28a1553b3d3799743666d5d2e948919a7b375f076ae2592db3d6b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246346, "uuid": "bfd66d7c-26b2-41b9-86a1-b76aadb4f393", "comment": "Malware payload (Mirai)", "value": "0558566554077845f97d0077c77769b6bd92e35f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246346, "uuid": "124c27a3-fbc8-4c1f-ada2-5dbd7a813277", "comment": "Malware payload (Mirai)", "value": "60accc2b5aedf315a9a7642772ee9dcaf4c88339351954fe5852428abb6eb46379b1bcaf042d288ea6de287305c16153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246346, "uuid": "cb78249e-6035-4ad6-9e47-e942ad2a6cd6", "value": "T1C9B47C02FB92CDB2D46200F112179F615A71EC361437E597E3E63DB8DA206D19B1A3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246346, "uuid": "a5173548-4b76-409b-81e4-04e39cb0732e", "value": "6144:Ooa0SHWXrF2WRH7Ldtx5LkdRmkSXmtPRvu3JdltEqcordREr6+h89FTyHS35N:OQkWXB2WHtx5LkdAn3ogdRXvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246346, "uuid": "fc3f24ec-a580-4bd4-aefb-b9126447d276", "value": 504656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246346, "uuid": "43393fb3-3322-48be-ba4f-3b7dcae1a3d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246346, "uuid": "7ef022f7-1871-425f-a158-9d7e767723da", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6b2633-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245734, "uuid": "9b91b259-de3e-4b18-a480-a5ba016a6ad4", "comment": "Malware payload (Mirai)", "value": "231d96d4072b5e782fe2df5b2f21f803", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245734, "uuid": "6c442f4e-a04a-410f-8841-4b255665683c", "comment": "Malware payload (Mirai)", "value": "035c4e56551a4b530872e11d5fc8304c628d1f6f2d18a27c0e9359c49a8fe06d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245734, "uuid": "3d791dd0-6068-4210-bbbb-212268abc563", "comment": "Malware payload (Mirai)", "value": "f25634539b21d791f4e687ca2ffae9a7d49507b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245734, "uuid": "13fcc6da-24ed-4d6d-94e1-6595ded8cde4", "comment": "Malware payload (Mirai)", "value": "6c79c82f2fd57a627d98f57c13cf1979d1eeb04917046c5f13fbe35228515ac85a610ce6acae3c4dcf0945c65094878a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245734, "uuid": "682e7ff2-6795-45ff-8ee0-15097108c1c1", "value": "T1CFA47E03FAF104B9CC6ACC74875F5727D37AB4566223A75B27C96B113E2AA60AF1C710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245734, "uuid": "1780fa70-d084-44f9-8a0d-e0cec7ef5336", "value": "12288:p95YyTiW/5qDpKrv1HPONBuOSbv78iuV5BQPtZ5NgKr/I:eyTp/YDpKBPO8v/65CPt/SQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245734, "uuid": "40a8dcf6-0cda-43e4-9039-4252adf7fc54", "value": 479904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245734, "uuid": "33ce9c65-26e0-42fb-b0e5-56bb7c3cf0a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245734, "uuid": "054c108a-01fa-47d6-9fdf-cdd50f3dd490", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537f48a9-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275488, "uuid": "f289fb57-aa9d-44ed-ba1b-324c233178dd", "comment": "Malware payload", "value": "623f7973119598f2ebb958b21e8205e7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275488, "uuid": "4c6f0ecb-da91-4b30-981e-d930db74dd75", "comment": "Malware payload", "value": "03fea0006718d00e3b73a51dc4f2e67244065bb8add35df4b5c7e0d55201b0bd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275488, "uuid": "03731597-c330-4e98-8cc8-b11e5dd42213", "comment": "Malware payload", "value": "69e11b6bbbc6a6c513b95c235e04c897f5867b0c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275488, "uuid": "d61ced8c-c95d-4ea0-9c2e-3f36edb6e551", "comment": "Malware payload", "value": "6f2b635bffda60e4fd5b2213449637527832bff53753dad9e5f89c0f5fe09a38a4475e4e689dca04699c8bc6f49c78a0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275488, "uuid": "7aa88d55-7c5f-4479-9b54-93f056678849", "value": "T1A9A4235CA9511D32BC777AD03C2D9F020F28E547B5D98AFB891B3A904CBEC2862D52DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275488, "uuid": "534a9d52-5526-434b-ae66-003106baaa62", "value": "6144:ue9ZfnUXRCvHWUEDH3s/bTaY4k2k7Xa5ozFYJHd3XcEqFN9KAK4Jmn+VJFNZ+0+9:ue9Z/U30/xzYfcEaN9B/Jm0LU0gM7aQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275488, "uuid": "f3506a41-8110-43a9-bccc-309434f7b6c3", "value": 466717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275488, "uuid": "dcca96c1-0465-48e8-b20e-c4babe8eb404", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275488, "uuid": "cf678aad-288d-4124-ad4d-cfb2ee7e5c53", "value": "03fea0006718d00e3b73a51dc4f2e67244065bb8add35df4b5c7e0d55201b0bd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e5baa5-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276090, "uuid": "4bd497ff-918e-4998-b66f-373802396911", "comment": "Malware payload", "value": "61f6a613b20efa9ab533e29db2698fd7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276090, "uuid": "bad4c954-a3f2-4f9f-9bcb-6c965594900a", "comment": "Malware payload", "value": "040eb5960afa240e6c656058fba90c180af3966ad4491dd7b7e04feaa9dc1bfa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276090, "uuid": "3b5b92c0-868b-4637-afe7-83ee60f5702c", "comment": "Malware payload", "value": "26e01dd23b5f054b94206448e1312fdcc7276f4c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276090, "uuid": "fe2b5b29-ddca-44b4-b1e6-d17ab3685a67", "comment": "Malware payload", "value": "6f44c4c2520f5fb7c492d56d7a2c19088cfbf14d080505914e85005ebfce74037a39a373ef3824cac2364c4bdf7c4879", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276090, "uuid": "d78cb167-1af8-4f46-824d-7559b5a296f0", "value": "T1C8C423052521C0CEC3891F3E5BC0AAD06DF6509F9B48F5843ADFF91D79C0AA536E9B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276090, "uuid": "48efd628-1a2a-492f-a87f-bee1d24c007b", "value": "12288:X+CGvJAevoAVcAz6wlOMWROC/FTeHo22Qm7NzofOr/mShz:5WJR9cAr4MQOC/gHozN7NzomLm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276090, "uuid": "b987617d-ba66-4049-89c0-a3728131b79b", "value": 584667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276090, "uuid": "23dfc92b-5997-43f9-ac48-c736ab0df6db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276090, "uuid": "ad0c5c44-cc0e-4d53-b195-3841628d6e39", "value": "040eb5960afa240e6c656058fba90c180af3966ad4491dd7b7e04feaa9dc1bfa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a179d52b-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275190, "uuid": "b4275d2e-96c9-4b36-a7b9-686d24ae8404", "comment": "Malware payload", "value": "30530e7a0f366e1998c2d7903e3d4aa1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275190, "uuid": "43b4b689-8930-46d3-9189-436ccbcfd58c", "comment": "Malware payload", "value": "041168e457ab92d0244ae1fedf6348eb3dd19a324310760665cf48b90525ac53", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275190, "uuid": "2a3b4149-6dcf-497d-8f30-f8ffe7319d31", "comment": "Malware payload", "value": "cd61e1b2474bee4e5d31e48a1f8b29b3a94934ba", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275190, "uuid": "e164d1ab-e62c-4da9-bc89-2977d7c3f9d9", "comment": "Malware payload", "value": "4458bc056278ddc1b85bce063d3ecdfb1aa535a2efbdae71fd3029f0a481c44989f8250454d44d77298f2c7873277c5e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275190, "uuid": "fac458a5-524d-457f-8753-32ac467780b2", "value": "T13EB423CD64BED0A87B658DDA9FECBFD30CFC00366D7526F2A51C1A13A1C400B64A958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275190, "uuid": "aa0a88d4-7ceb-437d-a57c-a680c059d367", "value": "12288:ZB/e4pqNFTFbEXkTDoGbDDGIabs/7iiEVwYg2l3/2Nyr:ZBm4pgThoGTabs/7iiWw0Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275190, "uuid": "690a9f03-89f1-4f55-8d16-6ce38d4fc09c", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275190, "uuid": "50de6c63-6ae0-4128-87c7-df8a8f917d27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275190, "uuid": "9447efc3-07a1-4e58-bc19-0fd23f478690", "value": "041168e457ab92d0244ae1fedf6348eb3dd19a324310760665cf48b90525ac53.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a83475-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274153, "uuid": "da6edf90-c51d-4dd0-9297-fa79eab66b9d", "comment": "Malware payload", "value": "2b50a15ce3de45da8c8cb3dcda747382", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274153, "uuid": "dfa90959-5635-4655-8588-4a49e0ab274c", "comment": "Malware payload", "value": "0453c8b1ddeced4a2fd22658a04e95abd7134d674715659c52a95f9a43bba31a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274153, "uuid": "ff0a67b2-5d9f-447d-b4c8-a9f6851b2d62", "comment": "Malware payload", "value": "0d9fc94bb7854591bea9c837b246f49f0f780e50", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274153, "uuid": "04ce1c6d-3928-4da8-85cc-0c3f02e98154", "comment": "Malware payload", "value": "cbe0c167e8c7e8578b0b42e768ce11c0728e2c372628db0a81737036c634b63db3984ac72cdae24c59ab4ecb7a5f9e1f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274153, "uuid": "277598f4-e89c-48be-bc3e-e06e9784b052", "value": "T1F9A4238274716D06C096CFBDD4C1AACAD06A023D35663BE5A39294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274153, "uuid": "2705506c-23d3-4209-8b9f-7ce7c4d87f1a", "value": "12288:or06lUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZt:or06lUv4t1cNk/wjibhv4b2Onn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274153, "uuid": "8b22fafd-291b-4632-b7c8-78a6aa4e8036", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274153, "uuid": "d509b730-285c-4b70-ba3a-463469bb557f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274153, "uuid": "f6ca5917-48f6-4114-9df8-0ca34454b431", "value": "0453c8b1ddeced4a2fd22658a04e95abd7134d674715659c52a95f9a43bba31a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50171bb9-c16c-11f1-927a-4201ac107004", "comment": "Malware payload (QuasarRAT)", "timestamp": 1791280636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791280636, "uuid": "71e16172-e880-4e02-ab3c-f1de83591811", "comment": "Malware payload (QuasarRAT)", "value": "e128e67b901447b15b41a5a2c2f89fb1", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791280636, "uuid": "770a16ae-28c8-4368-a865-a73e73e1cc0f", "comment": "Malware payload (QuasarRAT)", "value": "045886ce01e604aea1c2616af00c86685faec6158ae626dd77386d57837e795b", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791280636, "uuid": "0d902412-d3bd-47cf-969c-3f5941c12cd2", "comment": "Malware payload (QuasarRAT)", "value": "7a1b6e10613c22fd4f0b2c389851bf0105ccb292", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791280636, "uuid": "e4ec365d-1098-4a99-ad15-02be8f45ad81", "comment": "Malware payload (QuasarRAT)", "value": "f80679e5f765ce9fba14b15cc0e4019f7a9df7b453826bffa86627f28ade63b072d18ef4887dc46c4e8a6a7660cf235e", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791280636, "uuid": "ee3c4d0c-6334-48d1-b0d3-a53c9a5d55b1", "value": "T1A276332267F5BE7E5131141157A1C2099FB3AC9D535A3EAC12BB4BD0DAC0873849B3BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791280636, "uuid": "ff3f5ca7-30c1-49a1-8057-ba4a1b752a37", "value": "196608:9n5yaz2buldftW+nRTmLRSc2jeuPsyxZv2i5:V5XibH+nlmLRJyxtt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791280636, "uuid": "e9b985a4-6387-42b5-acc6-bcee7fa1ef39", "value": 7278811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791280636, "uuid": "59e0d74a-36ec-4d97-b16f-acfe63d02487", "value": "application/vnd.rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791280636, "uuid": "1e49bbe1-937e-4e63-89a5-21156601703f", "value": "Google document viewer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a28d4ba-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276009, "uuid": "9c6de2df-1fd8-4bd2-83bc-922545b126fd", "comment": "Malware payload", "value": "6e6f81a14614a94c313e0feca1b53d73", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276009, "uuid": "2c5516ab-9910-484f-88c4-16e2749c3e12", "comment": "Malware payload", "value": "048970ca1445ee358bd49d9fd8fec7171b45ca3641d77ea3c11e15055953482a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276009, "uuid": "796e4127-1606-4aa0-94a5-7e5d175e38cf", "comment": "Malware payload", "value": "5260cb7ed1cb34444112279ab6d479850d231e86", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276009, "uuid": "08ce2141-7e15-4ef0-9169-8f03ea305549", "comment": "Malware payload", "value": "ea5d0a10ba08b07efe086053d969f9b92878e6cb14073a28bf22e7361478cf4354a5391f5f67b842db5b5ecca0fc44cd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276009, "uuid": "d8b4bb0b-d33b-4436-97c9-24e31774cf53", "value": "T1ADC4236D7018EB38E507A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276009, "uuid": "6285c29b-9fa8-40cd-b419-d1b3d46562f3", "value": "12288:ZMU+0xq75aS9iYIp6cP/G2Bku8ctNvC28c5/VTUPkYyp:d+J71vI/GiYc5/pJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276009, "uuid": "143181ab-64cc-486a-8ef4-6882c7e54297", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276009, "uuid": "a6587666-01c0-4de8-b574-ac4195d0799a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276009, "uuid": "3c2e72e0-a50d-4998-9196-e30ff43cfc1a", "value": "048970ca1445ee358bd49d9fd8fec7171b45ca3641d77ea3c11e15055953482a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe6dd6b-c12d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791253524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253524, "uuid": "f4b825a5-debe-4019-9d57-4fab2d1f0ff4", "comment": "Malware payload", "value": "bfbbb8eda053c6b765c3c4a9b114e568", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253524, "uuid": "82e30fd2-2864-4a68-8750-d1787f31848c", "comment": "Malware payload", "value": "04df146a3f6287561014164b4ca6bbca02889700396d31641632d2e14ecc95f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253524, "uuid": "0afe5c07-9d61-450e-8077-1a92916ea559", "comment": "Malware payload", "value": "f83bf90384e29a6b4cd73cd74b407cd4821ec4ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253524, "uuid": "170eee4a-fbd9-43a6-82dd-4cff2259e9d9", "comment": "Malware payload", "value": "361dc875fb4f46df219072ea33f6f1cb6b3d916d65be93a7b97e8b4e0a52c44768bd08f67bffe66a1d380d80f2c94b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253524, "uuid": "f278907b-127b-4367-a41d-32763da37dce", "value": "T17D561797B9924942C4E43A37BDBE81C432635EBA9BC716566D14FE3C3EBE1990E34304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253524, "uuid": "0c55229a-43ca-495f-8f93-f3b8a895b525", "value": "49152:FpWAggJIy3aOCrvtFZ1BRBUriQpCndfn895Et:X1fKFrlvnVn18TEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791253524, "uuid": "541d66a4-663b-4571-846b-e4970c337f13", "value": 6029496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791253524, "uuid": "2fc16a91-19b3-4477-a7f2-23a8b97cf79c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253524, "uuid": "d427a55e-c1eb-48e2-af20-b1e534e29fa2", "value": "04df146a3f628756.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac5a92a-c19c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301431, "uuid": "cf6a24ac-4baf-43f6-8a0f-74386e4d174b", "comment": "Malware payload", "value": "f5f509ec5ee9bcf31858e4852546d692", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301431, "uuid": "98bebc08-e0ce-455a-b1c6-2a8123ac64bd", "comment": "Malware payload", "value": "04fcdc38f849b5186adc0a532efa86ae6611dfa4b943e50c289f70b6b28b9cb0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301431, "uuid": "1c01feea-31e1-4394-bd61-137a19644189", "comment": "Malware payload", "value": "37c63b98a956913ac397f21f1775ab7c31794a74", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301431, "uuid": "714d38c5-f344-4202-abd9-ead32c8aeb89", "comment": "Malware payload", "value": "1656199134413001c7c2a3c38f160d9891c1187c482930bde65dd9f40fce94854eac84dc8e111275d140cc3a0162e273", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301431, "uuid": "b228eb0f-e328-4b53-adce-48e20e4d9cb1", "value": "T1F0E422175C4E04B6E523853095CA5ADAFF6510D1D22A721F01FC6A8F05CBA8F2F4A7EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301431, "uuid": "b53bccf5-238b-4958-8372-b137ecb3c928", "value": "12288:LAy1gdBrX12zuUMeqyg/DKW1nCj6LMCkTyVRrZoWtBNGcjKXpGWoJZTzchm43j9H:L51gdf2zceqjWW1XfzbNG1XpKHzcU4Tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301431, "uuid": "544780a9-a81f-41d6-bd74-a4784323f9aa", "value": 697718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301431, "uuid": "4b59140c-6697-49c5-a7fe-73ad2bc5d7e7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301431, "uuid": "ea7c1570-3927-4206-8286-e5bb6635a6cd", "value": "SwyzzyClientCracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1761e633-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290420, "uuid": "c0f6c406-f0d1-4d89-ac44-d6d5776df1e6", "comment": "Malware payload (Mirai)", "value": "6184730ad5114cdaa38b49e5521d1ee3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290420, "uuid": "d372dd9d-1588-4d52-8959-7ece97f3d39b", "comment": "Malware payload (Mirai)", "value": "0584a28244d97fcf774b45d1e56063f55f4e28cc39c049f05b484d47aa0b1103", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290420, "uuid": "d84b462b-f825-413c-9a08-555370802105", "comment": "Malware payload (Mirai)", "value": "5e83f5418cc5d08fae9d038ab01742fd4ac5abf7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290420, "uuid": "ee6b85b4-b7ac-425f-b02f-320c9a28e849", "comment": "Malware payload (Mirai)", "value": "f7f73909d7fe8ff2fa9a45f9d2aa69d30ce7b997c752a2ca52d3039b07b3b2d76974de2115a81150773232c5a2171397", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290420, "uuid": "2b8da96c-0fb6-41f0-b8cf-60c1714e9110", "value": "T1C5514BCB025147312E66BB27FDB99E1DB1E150A31DE12F045AFC35F5A2ACDC8B054A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290420, "uuid": "95ebc854-c4bb-4e96-b4c8-9e61672372b5", "value": "48:iN4Q4hmlN4O4nElN4F4CXlN454ePlN4ay4azvZlN4as4aFvjlN49NU49z4gelN4K:iNNqmlNnEElNa7XlNG/PlNFyFzvZlNFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290420, "uuid": "c2179fab-374f-4c2a-b5dd-61d3b88d59a0", "value": 2959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290420, "uuid": "df73f401-e94f-41a5-bc65-8f69bcaa6400", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290420, "uuid": "ea94b59d-fa24-4266-996f-a7323337b0fa", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64e7558-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288593, "uuid": "f31ed9f3-2e9a-4171-9502-0a66c0fc2b2d", "comment": "Malware payload (Mirai)", "value": "810a0c92244b990bf38cf0eef3eeafc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288593, "uuid": "f501d64b-6e46-49eb-95dd-133f0b244891", "comment": "Malware payload (Mirai)", "value": "05f83fe5771cc1db9ff61371c1f7d55766afcb2cc6a60f24e05b1584937de4f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288593, "uuid": "26e19a52-c3dc-444b-a571-f1ff16d04f65", "comment": "Malware payload (Mirai)", "value": "887cdebaff824a87aa8cba51403e519f984b47a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288593, "uuid": "c1eb6919-958f-403d-bae4-3cbc5a074a7c", "comment": "Malware payload (Mirai)", "value": "70ead5d67b7205207f71ac13ba0884683570644324afd57ada8c7ad479852b25098be7b28ea06bc797ccb3c1ececac16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288593, "uuid": "2c79f641-4caa-4d41-b047-c3136c6ae7d1", "value": "T183044A01B646CAF3C4830FF512A75B750632E8265B2F9A49F36DBDF48E175C9B20A358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288593, "uuid": "1107ee3a-83ca-41f6-aa23-e6d31ab497c1", "value": "3072:qXNvbUB1I27ghB3tdr2LgHqLBkOQ4ef5uDGQyVt/ZxaX5jby//OHK0lI4cHe:qXNo/IVHdrZHSBk0eRuAVtnaX5jby//s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288593, "uuid": "01999345-811c-4164-af06-aacb58b4b3ea", "value": 189835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288593, "uuid": "7387eb31-dee7-461a-a9be-4a3c806d6da9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288593, "uuid": "76343d8e-37ae-4b19-be88-4fffbdb7e724", "value": "qv3.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be05934-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275851, "uuid": "19afcd5b-6a79-4631-9c3a-896bcc93abd3", "comment": "Malware payload", "value": "7cf6a2bf7516a7385b9bdf3f51a74ede", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275851, "uuid": "c9fd8502-72de-4380-8a46-d4b6140709d1", "comment": "Malware payload", "value": "06301e011477c4adc8f566e761972ccf145819133fa52a097115103fb401e330", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275851, "uuid": "922f31a7-a133-48d4-9223-fb0ea319ea47", "comment": "Malware payload", "value": "c96e40ba545e701f7bfef26600cdca536389bb81", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275851, "uuid": "4efef7a5-2944-4cba-8db3-972f88663df0", "comment": "Malware payload", "value": "eb6b5663fb6991c575ce2b8f34d8c060df9572b2b7b499e33685f2f3d1b689967c7ded21a1acdcb7e72a07a6c64b709a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275851, "uuid": "66382431-c39e-47c6-bcb6-bd6eaa7f8167", "value": "T13CA4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275851, "uuid": "0f56521c-f5cd-4228-9c92-5e7626f5032b", "value": "12288:Er06xUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZB:Er06xUv4t1cNk/wjibhv4b2OnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275851, "uuid": "9ae56be4-4b57-4c81-8ae4-98dfd8b537df", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275851, "uuid": "95461f34-d2da-4134-b1c3-1d6f4554108f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275851, "uuid": "1cec497d-f1b4-4645-9591-29b095127ef7", "value": "06301e011477c4adc8f566e761972ccf145819133fa52a097115103fb401e330.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1928a047-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263364, "uuid": "af768a9c-a48c-458b-a023-704d3c62d04f", "comment": "Malware payload (Mirai)", "value": "57a4d68b2c8b181aed6552b2a0b8968e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263364, "uuid": "9db571b0-cba3-49c8-a2d8-dcfbd5eb8cf9", "comment": "Malware payload (Mirai)", "value": "064885cd57b8afdb893b0fe5020543a81f6de69c4aab59598cfb943330814d89", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263364, "uuid": "94400bbf-54a0-4b5a-9d34-a989a57a975d", "comment": "Malware payload (Mirai)", "value": "24d29a05cdb2a478391c8e9d9fa6a341833b9f05", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263364, "uuid": "91bb1ccb-d529-4439-b9cb-519b2fdc36ce", "comment": "Malware payload (Mirai)", "value": "51f6447b731b09c52f04453fb0a402b3c36109a7edc751159d4d4f652a4f9ce80f0769e2175331afc9e0ba0baa3b8d7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263364, "uuid": "d691b2b8-9a6a-4f77-bad8-5338a4c8df4b", "value": "T1C93157C931706E718D8CCF4AB0E146E65647E5C9B2930AF2E4423DB9B9DDF40B415A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263364, "uuid": "dbf3aebb-bb1d-4c67-9771-8d17b43cbcf4", "value": "12:5kfH0dt6h1NaKj/6lODOqUDUAfaMGfK1/k1ZNVbmVb1LBqNN0XN0KvtIz2e77XQz:+fEcFFNDyRuKJkVgc2X2MtKgCXcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263364, "uuid": "6cd31745-23be-42d8-abd3-f02a41c16c9f", "value": 1876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263364, "uuid": "bd1a49bc-66f7-4ce8-bce5-68a3278d9178", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263364, "uuid": "3181e3a9-7b76-4c6a-8966-89d969d1969b", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a676128-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276251, "uuid": "e4b79630-d8fe-4caa-9b61-59c0e5b73902", "comment": "Malware payload", "value": "261d6839f09c501b77e07cce7e6df96c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276251, "uuid": "9fdc64f5-f115-4b3e-a016-f4dae35496b6", "comment": "Malware payload", "value": "06564851431029af910d52d65ea6bf817392a0361f5eeebe601e7ee43a3a3924", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276251, "uuid": "c4d63f88-8d27-45e8-bafe-5518f73a5c53", "comment": "Malware payload", "value": "c623822bae60b544e06358e9081c9345a8734d12", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276251, "uuid": "7d0961e9-01f1-44f5-a128-cb8029338cdd", "comment": "Malware payload", "value": "e30e64a303a5bfb4f24cfa4979b53a010c229bc6bd6ce85a77f010f0aa66d5c0a9ae90889bf0a36b3d695452b56a2821", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276251, "uuid": "de67aa94-2dcc-4599-b282-fa735dea5d73", "value": "T106B4231EF4D078CFD68ACDA394292C785F6C96C9CD126B7246C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276251, "uuid": "281656f8-b4c7-497e-a2e9-93196054d4c4", "value": "12288:1TibgSMFBOBSlqrXKu7FxPbzJTVBU+8JM9hAC8Z3iVOBRkbKQDiUbpKg:scSMFYdKkxpTKJM9mCw3iVOMWAPbpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276251, "uuid": "bf869f3f-7c11-4c9b-8068-55dbca24ccbe", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276251, "uuid": "147b4f16-3cb1-426d-a2ae-da6b213fe8e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276251, "uuid": "dfb3a8d7-e6d9-4c6d-b223-5d26a8d4eff6", "value": "06564851431029af910d52d65ea6bf817392a0361f5eeebe601e7ee43a3a3924.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c00b50-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276135, "uuid": "ddb6d08f-778b-4813-9ba5-f615e9d690ce", "comment": "Malware payload", "value": "d024c87ea9c91240497314da7e25a38d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276135, "uuid": "aeb567be-fbc7-4928-8fc9-c5f3515683c0", "comment": "Malware payload", "value": "06651fb294120b7b22b4b157abfbfa14d2ad86661aabd3ebd47aa97a5c7bee5f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276135, "uuid": "05ba6294-ac7c-4ecc-9890-b29d3ad89b25", "comment": "Malware payload", "value": "af26d96f6d3948bd7f845a3094e9884984eccabd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276135, "uuid": "4496ee2e-afe1-431c-ba08-7d904b279c32", "comment": "Malware payload", "value": "3d31c25e72f28440dd017e5c9aa8ac0bce91cd0362070bc9f05af9f7879be251a4cd3b4a1c7af418c4d1e1a7f82e4569", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276135, "uuid": "0b8d9796-9419-4f65-a0c4-17936311d540", "value": "T11DA42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276135, "uuid": "066e9f48-7d6f-4882-ae9e-1fcc62d1da9a", "value": "12288:SSCDe0U+m1V6ECbniSPfS3e2R3feeintFckMTsuC8hHG:SDe0wUTiSWzeei4sP8dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276135, "uuid": "57106bf7-70fb-4b86-a507-30130689365c", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276135, "uuid": "f0ca4112-bd81-41f4-bc57-f5c6022d1c04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276135, "uuid": "f037a4cc-832b-4cbe-a99e-920b1b4ccd98", "value": "06651fb294120b7b22b4b157abfbfa14d2ad86661aabd3ebd47aa97a5c7bee5f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344e18e6-c163-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791276724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276724, "uuid": "9bc38202-34cc-4f06-93c9-3136b3e4cb4b", "comment": "Malware payload (AgentTesla)", "value": "34121ed8a5911c5eb96b6df76ec42dd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276724, "uuid": "ff5c4bc9-e3c0-422c-8f4d-d267473ed54c", "comment": "Malware payload (AgentTesla)", "value": "0665d268afd27f396d751bf464237917184225373a5f2ad21f5273e63c7e5063", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276724, "uuid": "42fefdbd-3a24-476a-aacd-37eeee6571ac", "comment": "Malware payload (AgentTesla)", "value": "7bc9b74202c5077794f6c9b07534f3bdad84a888", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276724, "uuid": "b3ef0d3f-c74c-4420-8e05-bde5c12ab114", "comment": "Malware payload (AgentTesla)", "value": "6f7526c73c2d7ce23817f6fd7e964ab41d68f8c599c42835572d6cbfc77bec1f442aa1726b9ebb145fb448d40c56060f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276724, "uuid": "87698a95-ff0a-4c24-be45-4f48d7e2965e", "value": "T1B4E4E139A4879471014BCBBF971F46D916BF1B80F60FE17987EDC3871B9866086B8C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276724, "uuid": "224983aa-d2e6-4169-b0f9-7167f2f81507", "value": "12288:SHM0p9Zo5vkJ6+IhS1kASQUP1JRLAKU4ENm5dX6obikJwfNpvd7Ov0gk91:STnZnJ6+qS6xMKhENmPKo2SwVpvESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276724, "uuid": "4d01ba1d-2ff2-4826-9eaa-5e1b665f1cd3", "value": 704553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276724, "uuid": "7b1d2f2f-83d1-4819-aa67-41ff90c978d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276724, "uuid": "529e3d82-ac6a-426e-aee4-18916a001ce9", "value": "BIN_ORR_100626wvd2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a0c180-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1791273208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273208, "uuid": "b5b8ce96-a0bd-4024-a3f1-dfe1e1518f89", "comment": "Malware payload (VIPKeylogger)", "value": "fefd18152ba0911c87d9a69e6db5a259", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273208, "uuid": "fb06e614-8b70-4a96-8c78-f7aed3c33b4e", "comment": "Malware payload (VIPKeylogger)", "value": "0681966167924bfe319294a2344b67e5585d8ffc830e12ea3402938d673faba2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273208, "uuid": "4604332e-86d7-45ee-bf65-e618d923ce18", "comment": "Malware payload (VIPKeylogger)", "value": "dc30d806ea45ebc0a7ba92ab5485d1d7549e9d56", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273208, "uuid": "8393264e-b5cc-4c0c-90e7-2f13ac747edf", "comment": "Malware payload (VIPKeylogger)", "value": "7f7b3cfc0c047b1b72be4f351f327b32bf1cc8b85664aafe05e7c486ff0293671260393c32d99c339289c614c67454c4", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273208, "uuid": "e71e52d3-de0e-49ca-a4e4-837369d95a32", "value": "T10845237A85CA32DD0113A7F7FA93A454749D138B59C2421B635DC3A436B41B2BF3BCA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273208, "uuid": "126781ce-fa31-4ef7-800f-0d973b465765", "value": "24576:NXctesJKAmmqBW7slZ5iJc82Ze35JUOWUwCpYKpsQyH2D/YpheIh6:NcIYslKzBzYaeXWj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273208, "uuid": "6fc37f2e-7a8b-44c9-bf69-aaeee55e9cc4", "value": 1241256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273208, "uuid": "effa1b83-baed-484c-9e53-3331bb370ac4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273208, "uuid": "4f5826b0-9527-42cb-866f-bccedad46032", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ab4577-c151-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791269182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269182, "uuid": "116a3a05-19ee-45af-8a4e-73c460e9433e", "comment": "Malware payload (RemcosRAT)", "value": "1ad3729976f26d9d7ea44e2a7195b572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269182, "uuid": "6ac84cae-58d7-473b-8443-975e342f3509", "comment": "Malware payload (RemcosRAT)", "value": "0693e042dd629efb54a385e8fee6cd00c7a54543d31bceb3f790365a72e55448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269182, "uuid": "1ff6b734-5b77-44a1-9f16-51fabbfe1921", "comment": "Malware payload (RemcosRAT)", "value": "bc2745c026a8d0efe3849978221dccb0bb3906db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269182, "uuid": "57d9e8b2-53c4-4aae-a9a8-11e47a09fa88", "comment": "Malware payload (RemcosRAT)", "value": "a2b14395957c03295562a5cd41e013c97e36b04868812f51256b7adaa4a6db48b99ea9830404d9d6f64ec4451f01d2a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269182, "uuid": "63f5000b-3ba7-4027-a299-2d7ae10e2a66", "value": "T199F3020232A5C057D8A64A301D3B96322AFFED254930870F2F545B9FB9376A0DD0F75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269182, "uuid": "c1f17f3f-c296-4f0a-8ab0-711322a0bf0b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269182, "uuid": "da5b1653-8c6a-484c-a73a-8a3e2e9647b7", "value": "3072:jDxaVzwmg4CSW8JSuP45ZAH+cSx0VU4QpgPzxIqZ8QvZIvrQduq4Msk:nMm4CChAAcy64QcxT8QRoMsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269182, "uuid": "e4f92ebe-73ee-4526-a83c-b1c341f552a2", "value": 171160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269182, "uuid": "15f48ee4-1eef-4e8e-8f53-9a294ee05f73", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269182, "uuid": "4570c92b-cb12-4731-925e-725c68b99bd9", "value": "SCN_20260928_161058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2d1d12-c13f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791261569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261569, "uuid": "017cb230-ad33-42a9-86cd-7995810a1cc4", "comment": "Malware payload (Mirai)", "value": "f459b0dc8ce299ff67f8ee2786d56163", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261569, "uuid": "88c8bd07-514c-4034-973d-78ca01fdcb32", "comment": "Malware payload (Mirai)", "value": "06a21fa074360b9bb5079efe2d02a8e3722e99988c069a1b6e477d11da870177", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261569, "uuid": "5718bf84-c781-4cb9-8e48-bb7ed62f68fd", "comment": "Malware payload (Mirai)", "value": "959e1908f6a2dfa87cdccb61ccc693e80ed3ac3f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261569, "uuid": "d2e87684-c813-489b-8242-e96dc08da4c2", "comment": "Malware payload (Mirai)", "value": "e634dafa9054eba7d1605499ac592dc642304369711836620dcf955a7a4f548d6993d0c2864e7fc0522b7c32e0b4dc3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261569, "uuid": "1b763351-b590-4e42-8550-815f84a5a9c0", "value": "T1CC417185B3806532BFF29E5675F6D804B090A0A3DFC92E41D5EDB8E9C98CF08B490B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261569, "uuid": "f60bf60d-bc36-43b9-aac9-c247e81fe6e9", "value": "48:vp2fRpZTRpJO/Rp06oRpjHRpOPRpNvRp5hRp8DRplhe:v6lw0nux/sQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791261569, "uuid": "f62e0f58-1ef4-4bdb-951f-06941cbe3939", "value": 1933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791261569, "uuid": "4cc10a4a-25fa-4e94-b55a-9bc36ec22aa3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261569, "uuid": "91a034fa-b818-41b6-8f67-daf06f286620", "value": "bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8804c80-c198-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791299817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299817, "uuid": "558c670b-1fb3-4d80-b0e4-f35cc6a1e813", "comment": "Malware payload (XWorm)", "value": "f0daa03a707ead97fe5da00715dc4c95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299817, "uuid": "10f43afd-f614-4b9c-bd7b-5bb910b94929", "comment": "Malware payload (XWorm)", "value": "070da675d17b5558ec3159a9bc8c7f1431237a540429b0389d5df4284fc551dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299817, "uuid": "b981ca23-a78f-46ec-bd9c-b70249430095", "comment": "Malware payload (XWorm)", "value": "ff30deed3d2783745f060167a9496a73ad169d48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299817, "uuid": "cd7786e0-0965-4797-bd6c-3452a81ecd9f", "comment": "Malware payload (XWorm)", "value": "75ac88eb983f45df7bd5a1de43e35d795271d053e4d154e48637f5eed28d65185da420741808ed1eab17e72bac865ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299817, "uuid": "38293098-daaa-4bd7-a21b-62ec02e295f1", "value": "T156365F869718CB1A8602694BDD87570FB7651D0177CCEF9889FFC3A0BC708A7A4D7298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299817, "uuid": "f2f03efa-5fe7-4f97-9e5c-0fe678eeb897", "value": "384:f8spypDNLHNETCCKTyVVTXPMAaPv1AcRmFQiXG7KjkHY4oRWkykeVq7WmDY8OEcH:HauTyQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299817, "uuid": "4c749458-d373-4ccc-90be-acd40013b369", "value": 4876238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299817, "uuid": "ed68b86f-0a75-4010-9cbc-892c2ebecf7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299817, "uuid": "43192409-0aff-4ddd-ac24-4ab228186bb5", "value": "wennedbestthings.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143e55f4-c144-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791263356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263356, "uuid": "4322cf76-7742-49f6-9a8a-0d93fc8d0502", "comment": "Malware payload", "value": "146ae7630bbc909111381453901ee154", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263356, "uuid": "18fe595a-ca24-4013-a5de-c03f94d6511b", "comment": "Malware payload", "value": "07474aa7445ca8caa4540636ba6a51544432f4735e391a48d22eae7be70abcc1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263356, "uuid": "cdf0abe8-533f-44d5-bd1d-d0476f3470ce", "comment": "Malware payload", "value": "96987d370c6391bf155e87c22533c2406ed8bc38", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263356, "uuid": "07da28c1-1c0e-46c5-b187-a0aa6547557b", "comment": "Malware payload", "value": "5553e4e67050d7b4351f1b49698a99a5a15badef7bcd9a4a258d92624db7336b1cb5f35e23bb668b8ab2502a781e4322", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263356, "uuid": "392e59e9-cdb6-4d98-bbb6-edf323a87891", "value": "T1CE93E803BF01DFA7C85FDD7206B98B1124CCB8A766B5372A3270DE6CB6165874993CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263356, "uuid": "a4ed079e-4bfb-4483-baab-7488f0aa86db", "value": "1536:6kpwpK/CX2Xf5ih7Fe28snrPlSZcGc1LBZPREwivPR2t0BQ50YNagbaPpJ:6kpwpK/CX2Xf5ih7FjSZFc73EAg6Naia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263356, "uuid": "ab13c24a-2526-4b77-b266-0c8ec3ba9d70", "value": 92104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263356, "uuid": "b27ec0e0-97db-40ca-b187-817a06ffc4eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263356, "uuid": "a21ee409-0f63-4632-ae0e-4bdfe2476170", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cd1ffc-c1b0-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791309978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791309978, "uuid": "5e953527-8f5a-4191-92fb-fda8bc49b655", "comment": "Malware payload", "value": "95f3b272e868ae13c01e4b69980fb99f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791309978, "uuid": "3151277f-a6fc-4ac5-949a-0efbb876e1bb", "comment": "Malware payload", "value": "07f9ea17427378edcff042f019680f4149b0c34a1b589b8621a30e2c8e240310", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791309978, "uuid": "afd7ac4b-ca1c-44c1-8725-e484d94c0d92", "comment": "Malware payload", "value": "3f4ce9eb61100f874b5a2b8e7f61ab0fe518b8a0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791309978, "uuid": "e082714c-473d-4757-9e70-65079ceffcb0", "comment": "Malware payload", "value": "b4f85ee5457ccc2ab5a00c1fd62b750c29cebddce60b5c2f8409e8c0a817244c8bddd4134c19cc4d3138614ab1268841", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791309978, "uuid": "1a496dbd-28e1-4faf-8e97-13be9ae602e2", "value": "T14542195CEED1A1B0EA1703DEB7AF28690228A0C7240DC484F54CDEE87F46BDD4A56B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791309978, "uuid": "d460c643-7a8c-493f-ab11-01cd9a94fdd1", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzPbqFtCnSqTwRUM:sXX+/DV7k/3mFtkTwRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791309978, "uuid": "4c727558-3010-40b3-809a-bbf21106b662", "value": 12059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791309978, "uuid": "87ae675b-d49b-4c2e-b5d3-5be2cd4a78ab", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791309978, "uuid": "7f59572e-4479-47cd-b676-d2f4c1e741d6", "value": "fuck_niggers_2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daac6556-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276144, "uuid": "17025917-d47c-4551-9e5b-171f30dcaf10", "comment": "Malware payload", "value": "01ad9441b0d4caa35d94ff4736b96a75", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276144, "uuid": "eae87110-2d84-47fb-8ceb-2a20cff0a3a1", "comment": "Malware payload", "value": "09ca949e92daac27d1a7b62b5c59596d72fe800c097139b99b537252bfb1bd28", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276144, "uuid": "b2327502-b8e0-471d-95cb-c4bda8ad5e3e", "comment": "Malware payload", "value": "f5c6a4b3b47d7e040f83144d4440bdd3ea0a6f60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276144, "uuid": "1ee7b51d-362b-4a8c-a570-1898855ddb82", "comment": "Malware payload", "value": "37e97658d237bb5ef8545779d2089558d6e1f48cec46af8511b9ad206033ab457c3ee90522e0c81bd8a8e2e1a9d0bf05", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276144, "uuid": "59d23bcf-0dda-4fd3-8f46-34649d131c70", "value": "T170A423F366B0D54717685FB9CB66CF73129FA644321C83208ED8DA89D84932EB7D842D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276144, "uuid": "27ea60f2-f30a-4ec7-ac9d-52b86af12a4e", "value": "12288:B4lhhLoVDI2FLmMJKNCCH1oHF9nJ/qJZk5LchPNNt9:+xopIAmMJIH1ELnQy+hPNNt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276144, "uuid": "ac078295-1258-4cf8-ba65-68ada036cbc1", "value": 487650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276144, "uuid": "59ae5795-a5ee-4b61-aa4d-3954d41117f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276144, "uuid": "db477a02-d673-487f-83fb-21aaa77233fc", "value": "09ca949e92daac27d1a7b62b5c59596d72fe800c097139b99b537252bfb1bd28.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15f272c-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275753, "uuid": "09af8bdc-9298-42ff-ae89-6e2c97c70dcd", "comment": "Malware payload", "value": "d06509361a1adcbbc8eaa3ea417fd71b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275753, "uuid": "41418395-1681-43cb-8c0c-a6924c2b5065", "comment": "Malware payload", "value": "09ead1ca64b3390375d84cb1c9a726708dd9b7b9d65558a6b808159b24504590", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275753, "uuid": "6fec373c-dc01-40d8-9fd4-e11037f812d7", "comment": "Malware payload", "value": "4fb6425ada28359d84d85a7ba746db5ed88df357", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275753, "uuid": "ff93d396-afda-49b7-b671-75f73b12a434", "comment": "Malware payload", "value": "fcb335dde6c658093c2b44f8ce6a188ad6f62e331c39b41c37ce3b8611356f7048a0124dd756434b3c79963796809ced", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275753, "uuid": "089d0627-5643-463d-90c2-bf5a2dc64d25", "value": "T195B423CCB6CB88CC55A63134E6A20B4154DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275753, "uuid": "5652fcd3-fd4e-4000-867f-148564c78908", "value": "12288:fwsK8MG1KnyC/G76u6M0gXar5qdupct2ien3P+beH:NKGcGmuwjhQen3Pw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275753, "uuid": "1117906c-a685-4052-aac5-dc0d885779ec", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275753, "uuid": "9bca9ba7-3783-467e-a37a-f162fe07d5ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275753, "uuid": "302d65ad-44c8-4a95-b757-ba25ea6fb985", "value": "09ead1ca64b3390375d84cb1c9a726708dd9b7b9d65558a6b808159b24504590.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78043c13-c11c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246344, "uuid": "2bb40b26-0042-4bc8-9fe2-c8ee36446f4d", "comment": "Malware payload (Mirai)", "value": "79d8eb14353373fd1a54122ebe75370d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246344, "uuid": "e6af0161-b6f7-475c-94f4-dea031b3a88b", "comment": "Malware payload (Mirai)", "value": "0a79e8ac1b1fc4cf24b9b295a78ef7f62a1f1c528dba56069052e47add8daf99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246344, "uuid": "569b05b2-162a-4998-ab90-585ec735c5c4", "comment": "Malware payload (Mirai)", "value": "88102a25b14bb15f497baa47d4ce6f465590e2ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246344, "uuid": "982ccbf2-dbe8-434b-b200-90139f46230d", "comment": "Malware payload (Mirai)", "value": "a629dcf174cb7c245800437ee2d3149a50cfb06d74112e7ae56d98ac171f7f3850686e384aaaa7f2e6c09ec4a2278ca1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246344, "uuid": "607cf811-b5b2-425f-af15-8ac95c83b436", "value": "T123C43D02B71E0E53E2632DF0773B1BE183AF9D5134A59641790F7A8E92B3D31154AACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246344, "uuid": "c1e50dc3-23b0-4cdc-80da-6106928a5b6f", "value": "12288:y0yKsnjz2q/Wh44RPVugzXFvQfRDqn8bjiU:JyT/yXi+8bj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246344, "uuid": "e4d67dc5-9806-4a65-a74a-fce0cf420d36", "value": 579200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246344, "uuid": "9ef46f7d-b4a4-4a7e-837c-d84edc1ca312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246344, "uuid": "450a0ab5-1aea-4ef2-8093-4551a707db1d", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f79430-c182-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290114, "uuid": "ce5d2d6a-2c41-4ed1-a374-c87be07cf219", "comment": "Malware payload (Mirai)", "value": "158d97b6b59bc1d28adf4be0da785386", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290114, "uuid": "7208794c-9ca6-4c05-bc7d-012733dfd6a4", "comment": "Malware payload (Mirai)", "value": "0ab5b088d1e79673d782f29dcff3b24af55f5ba5edf6b51de9b1e172a4eba855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290114, "uuid": "49c4515e-e6b5-4663-b198-1693c4ac4f6a", "comment": "Malware payload (Mirai)", "value": "1f8ab99f144225755f089c84b3e042a9db4ccacc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290114, "uuid": "def14bc3-d938-4ac4-833a-544ed6eb0e4f", "comment": "Malware payload (Mirai)", "value": "88706d872c7649f73e0d5f1403050710c5d76c180f3c57d0d8157a87b06fb57b56926fc172dc04cad2c0655637172193", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290114, "uuid": "987680d9-1e60-4e64-bf08-563730ee3cab", "value": "T16C330213B655FD62DE751C3962F88C8E3148026ED0ECAC2239C8ADB162D3157BBD45D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290114, "uuid": "ab509a27-6fb8-466f-bfa3-6aab632d1feb", "value": "768:ffZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbGR9q3UEL2qEK5J6OAsNTGjf2tl8XOYA:EPtQjiZVcykHRDGEL15J6RN2tAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290114, "uuid": "394ddf8c-816c-4456-8378-941369516d4d", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290114, "uuid": "eb9d993d-ade2-41a9-865d-df5a7ebe71a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290114, "uuid": "d5259698-cb43-4469-8deb-a45a8969bca7", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e371a108-c16b-11f1-927a-4201ac107004", "comment": "Malware payload (PureRAT)", "timestamp": 1791280454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791280454, "uuid": "bb1a3a31-0949-41a7-a596-84332ce58299", "comment": "Malware payload (PureRAT)", "value": "54c4d164ca064ac9eaed2874e18c6bfb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791280454, "uuid": "dec72744-f5bc-47c8-9355-7e8638df33b7", "comment": "Malware payload (PureRAT)", "value": "0adc3cb190e10f61005d7a0c12cfe6f4f8e082a26a1719e0df560dbd61e81613", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791280454, "uuid": "e6f19adf-a69b-426c-a1b3-58b497bc2cad", "comment": "Malware payload (PureRAT)", "value": "9ae85bd1c8c1d3592fc0803eebafeece29cc496a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791280454, "uuid": "143464a1-bf5f-40be-be74-c07451720c7b", "comment": "Malware payload (PureRAT)", "value": "f9e900b7b848f13c9fe79ccca8b2cb9045bba08f6364a975a2e8e73c065bf989758c1b2da0dbede9d1e5f97d5b3a0626", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791280454, "uuid": "5be211ff-a99f-494b-8925-9be776d357a1", "value": "T134741273B0848232C1490370D5AFBBD1A7A5EC58AF52C96365BAF2991F37EB063039D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791280454, "uuid": "2836f4e8-424b-413e-b181-d72927843eb8", "value": "6144:Gnvr3wA9KlME2MejKFOffKKBUmQMhRV+KAz6lW65U8ND8guvCP:Or3wAAlgbXHKTsWKxWON0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791280454, "uuid": "c7a2dba8-e74e-45c2-9a13-8061a19c6d5a", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791280454, "uuid": "d415ba66-0cad-408a-9be6-7bb04afb4841", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791280454, "uuid": "3b3c441a-d45a-437f-abfe-8ca101caf019", "value": "223_FINAL_0of61.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769ff11c-c164-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791277265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277265, "uuid": "bb1bad56-3af7-4aa6-ac77-a60246f5a651", "comment": "Malware payload", "value": "346558ce5e09e8f9e178ca4353379691", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277265, "uuid": "d9b1ae3c-03ff-4cb1-8f59-4ca0a96c2a0d", "comment": "Malware payload", "value": "0b5aea8e222b76dd2c7ab384b0909f099c4a9a39209e11677cfd5154535e9384", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277265, "uuid": "c7ddfc3b-18e4-41c6-922c-fec8afd003fc", "comment": "Malware payload", "value": "097360dc9adb3e3e29a2582d78dc0491f0ed3679", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277265, "uuid": "4ceb029f-55f3-4075-987f-fb6ed0a280cd", "comment": "Malware payload", "value": "bc5d6019fb4698dc228ba977ed711770e78d2589fec0341cdbccd66b3ef85ec6e9afb35aa24acee0f51d0385fde1e640", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277265, "uuid": "72e7bacf-8e2f-4913-b5db-99b1e104ae3d", "value": "T13ED42373AE16C537C2176CF19B763ACEEDF446C79D234E47FDA4A0A2DCAA162061804D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277265, "uuid": "b87801b6-b4da-4d77-85cf-ac761829ccc2", "value": "12288:QcJsx2vDq4hIWHI5vYh+Vl1PnCNf5PKqD7PT7iBPasJcJOtw8fBb:Q54NKg8Vl1vCKerT72PH+Jaw8fBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791277265, "uuid": "67b91fce-ed40-400c-b507-f49d0bc3e1c2", "value": 657042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791277265, "uuid": "6c790abb-962b-468a-8606-2275a699cf8d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277265, "uuid": "46fa7551-8779-446d-b9b7-1535a383b971", "value": "5400049363-H3209VXOrder.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bca910-c1c4-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791318356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318356, "uuid": "6e6bfb21-be23-44d7-a2c8-fa704f19a51f", "comment": "Malware payload", "value": "3a2370412e4564e7364e48bec5cb4deb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318356, "uuid": "6e736352-ef5a-4c9a-92ce-da3860c11b8b", "comment": "Malware payload", "value": "0cd4604de3284d716488b41fe24760b3375f116651d1e7a325736de8950c196e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318356, "uuid": "0141a7da-256a-4a02-aebd-70ad2e8c9fc5", "comment": "Malware payload", "value": "8f4048aedf960e33732ff7d2e37c5746dc7f5a5a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318356, "uuid": "f986e109-f6ec-4f9f-a00f-fa1a519e6b54", "comment": "Malware payload", "value": "ffb992bf79d71d89accd07401e1c140c8df793f4e8c910b5fa159f123f1edd5e528040cb80d928525cb71a731f533626", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318356, "uuid": "feccde9a-802a-49d6-844f-a233462539e8", "value": "T11F41DD241BE94225D77ACD3AE869A314C97AB486DC338F0D018191840DB4619FDB1F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318356, "uuid": "3f9d3fdc-88a8-443f-afb3-382c84715776", "value": "24:8+166JBG9agWA2AkmDf6ERXeGwz5fegaRReGwzGOwfubjT4o028dabf0TAsm:82HJgN1dRXgggaRRgDLbjMoCa7AAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791318356, "uuid": "240b1067-c6db-41c0-be7e-2dff609b9367", "value": 2183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791318356, "uuid": "b8241915-c3ac-4090-b494-feb4d42f64fe", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318356, "uuid": "0a8ede4b-0021-452e-a34a-2f2a9df97cfa", "value": "\u0422\u0435\u043a\u0441\u0442 \u0414\u043e\u0433\u043e\u0432\u043e\u0440\u0430 - \u0432\u0435\u0440\u0441\u0438\u044f 3.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b389d24-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791273407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273407, "uuid": "5b7fc16b-ecb3-4d88-ad85-53be8274cd0b", "comment": "Malware payload (RemcosRAT)", "value": "640efaf4a8c3569a3146722050d86ee7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273407, "uuid": "18dd46a6-72e9-4a8e-b15b-f87c806517b6", "comment": "Malware payload (RemcosRAT)", "value": "0cdf7b0b240f25a49017c59302e9887f41b3688a5f380594c1652a7e73b1ac36", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273407, "uuid": "82e6c30d-652e-4aa6-b553-8aa775851663", "comment": "Malware payload (RemcosRAT)", "value": "200d2ece823cadb822bfb8c46c5af13147591090", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273407, "uuid": "e0ff245d-aa7e-4d4c-8222-1eda438f47d9", "comment": "Malware payload (RemcosRAT)", "value": "e34974845d53e42750e6ba8ebc212e41967462e82fe15d08d1200307b11a02952dfee6b54dd1fde830fe2d41f06a724e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273407, "uuid": "a7077ae7-95b8-43e8-8361-46d66a15a0d9", "value": "T15B554A5303851BBDF68D0EC9C95B245B20F2D9677D241298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273407, "uuid": "ebba4d23-95fb-417c-85d9-c28871a64f11", "value": "1536:m2HhkUL5MbLeUnB1keeOz5jS6hk/D3c51F2zWmsj7jA9nu70m03OWhLq491mlcLT:JL5MbSodrheijnCUHDD0IwEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273407, "uuid": "474f9163-d2d9-4df9-a8df-7e154ec733d0", "value": 1294364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273407, "uuid": "4a3d6e8d-da67-437d-8495-fb9271bbf829", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273407, "uuid": "d34f01b0-490a-43f5-9a94-b7caf09216a3", "value": "purchase_requirements.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be531af4-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274808, "uuid": "3f901bcd-8a2a-453a-b9b6-d9282055a693", "comment": "Malware payload", "value": "6851dddc32f664985c58765981af0c9f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274808, "uuid": "4682b00b-cadf-4a8f-9ee6-a100b75e7d2b", "comment": "Malware payload", "value": "0d4f7f93ef880ec80170e5c0d84817f55a53c5be19fcd18daa463d6c289b509e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274808, "uuid": "4cc2e425-50c4-4985-b528-055df9c152b7", "comment": "Malware payload", "value": "62534b18108ade2f012e9f2c2b76a7a06f9fefae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274808, "uuid": "972d5901-271a-475c-ba79-3b30f06ad9b7", "comment": "Malware payload", "value": "43102c6157fd0392b6936c4d61464f6d3a4bfe23156f07d4197c1b5836ad23ec60e8517d734186d79cd2c81b663eba63", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274808, "uuid": "c96f78e9-7a64-46b6-85e1-aac537d10332", "value": "T18FA42397E39996EC8CC47ABA8B2C0D08B37CE7745CCF06A8537E5335D1688A29E0751D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274808, "uuid": "b49b6df0-bc94-49d0-be19-dd3b2aea5737", "value": "12288:SsS5lyFd6e+6sVXkvgSe5ycqr++rVOje+yH5w:Ssgx/6sSvPDy+6eTH5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274808, "uuid": "e251faf8-4524-4a36-bb60-34a02329556f", "value": 492541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274808, "uuid": "0079e0f0-1f4a-410c-a103-f9f8bc9bc1b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274808, "uuid": "c652471f-054b-4409-be13-46112f21d73a", "value": "0d4f7f93ef880ec80170e5c0d84817f55a53c5be19fcd18daa463d6c289b509e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d18b885-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250567, "uuid": "9bf3a0b1-afd2-4e52-84b7-9d21875421c9", "comment": "Malware payload (Mirai)", "value": "9f0d122d4b82ca87817ed8ced5415c4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250567, "uuid": "81eadd2f-ca8b-4b14-aba1-ecefbdc7e5a3", "comment": "Malware payload (Mirai)", "value": "0dbde09b48af5a0f30af31e919940feb63e4a4262ba3f765dbfe8d18a064bbaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250567, "uuid": "72139cb1-b926-4995-af56-ff2a31f1c4ce", "comment": "Malware payload (Mirai)", "value": "cafe2d33affbaef770d66f18c3952841c4203ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250567, "uuid": "da87370d-b509-4d8e-9382-386861cbc588", "comment": "Malware payload (Mirai)", "value": "7837d5d56df8d3e8a40732cd32449a9260a73c0266af2eec163ab1bbdf64fc15809b1ace8c132073d256b6fb0b5ea8d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250567, "uuid": "bed953b1-e609-4a81-a890-14b442e91bb6", "value": "T151432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250567, "uuid": "51500247-af8a-4473-8abb-1a0ccd768d02", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwc:RqtmZPuutfbltZFBSJsBcfDSTFI+BEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250567, "uuid": "bb4ebd63-4137-4925-9a87-f225b4042e39", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250567, "uuid": "7b6a30c1-20c9-4e8a-baf3-3e4f16d92e00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250567, "uuid": "9b2a688f-55c0-4833-a2fc-875217cfb255", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90977db-c17c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791287711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287711, "uuid": "e639a69d-e07e-45d6-a131-ef2b2771a2ef", "comment": "Malware payload (Mirai)", "value": "6d16e9a95800dce8ba2c474f1fd35068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287711, "uuid": "608ce0a2-4fd3-4c2a-b4bd-7aec40b1d386", "comment": "Malware payload (Mirai)", "value": "0dc7eeccc8ff047fb593c42e46fa9ca706f0ada25b779c1819a5dba946c7fb55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287711, "uuid": "8567be53-06a6-47fd-bde9-8d2e2279b1a9", "comment": "Malware payload (Mirai)", "value": "64ab0734849346a0ee167d08b295e8a4fa269bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287711, "uuid": "003f5b60-cecb-426a-a85c-54e80b94b81b", "comment": "Malware payload (Mirai)", "value": "c9feb1b4a58b45990f49b285a2d9d46d82244fce5612b8bb0f3830fc782f67ae166827305c517532e7baf2df99fa1498", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287711, "uuid": "6bc6f8dc-706e-4857-830a-7f74b6f0529a", "value": "T123D47E03FAF10475CC66CD74870F5723D7BAF44A6226A75B27C96B113E2AAA1AF1C710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287711, "uuid": "7a98c6a3-b1db-48f3-a9d3-6e9b781712c8", "value": "12288:VoKlsqf2bgeHSYUHveuPOBfOSD19h42s4WuEiLSMkvg/aYu:h88eHSYsPOnfKj4rLLSMkoiYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287711, "uuid": "648a7643-9755-4249-8d8a-8daa651375de", "value": 615624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287711, "uuid": "3f5a62db-f830-4492-9f27-772b37402567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287711, "uuid": "a4f1d6f5-c5db-490f-8032-6918c42688e8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a66ff7-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303109, "uuid": "8282f9ef-97e9-476f-a33a-0d9e0a5cebd6", "comment": "Malware payload (Mirai)", "value": "518a6532c81802b9f9eb8c19b868e709", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303109, "uuid": "4497d1dc-57eb-45a9-a3c0-21b2d88f82c2", "comment": "Malware payload (Mirai)", "value": "0e684f17f8d42997e8fb10bfcd46cd944ae73436519562ee014598d54be229cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303109, "uuid": "a268ea65-1f9c-41ae-a616-5e269e2b9e76", "comment": "Malware payload (Mirai)", "value": "10a37065e783d0053579a78a7a1c96a754d8c6da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303109, "uuid": "2feefc58-e8ce-473a-8f22-285ebe7bc474", "comment": "Malware payload (Mirai)", "value": "2f5398484c6b91f78aa91edb52d71f0d1c4a999401a4b35866548d5dddcf8d80f05fde25cff5e62da556a77d43a66b3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303109, "uuid": "411c40bd-ab35-48f3-b458-99326b872829", "value": "T1D6147D01FB284653D5925FB44B3B0776D32D499308BAF10D1E0BBB1A1673EF6A19B788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303109, "uuid": "ef88965a-29db-4563-b7fd-bb2e1b3444f1", "value": "6144:C452E2r2kd1PD5yP/l9iG+N9sJsCR6mewq:CwkrP69YsGwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303109, "uuid": "7475689a-c024-4ff4-8839-1116bc5db918", "value": 197948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303109, "uuid": "7c06d002-d88c-43ad-9edf-9602eaf9c7fa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303109, "uuid": "052ddd84-9c99-4cd7-aa2e-9d1845e22d4e", "value": "flutter.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63809ca2-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791273368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273368, "uuid": "acbd636c-401b-4b9c-9325-d654c9108d56", "comment": "Malware payload (Formbook)", "value": "f985002bb878f5000cb860ad7dd7ae48", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273368, "uuid": "f0d60094-c5cf-4e47-ac96-a9f94dd9459d", "comment": "Malware payload (Formbook)", "value": "0eaf1f86209364e670efab6af97ebf1552a93f0940efa6696c7b68c47c0654b2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273368, "uuid": "b980fa96-8893-476f-83a3-3423b5eba930", "comment": "Malware payload (Formbook)", "value": "9f93f1568bd7d25b8670a5791a001c36afae8376", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273368, "uuid": "bd2dd5b7-5876-4d92-8a90-5a5468e03fe7", "comment": "Malware payload (Formbook)", "value": "76c56c012b5d0a046e707acd18b9833bfbcdf15c6bc014c017d280eec598994853fbcb89b11c6d7b0ee7b601e6038618", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273368, "uuid": "f26ead17-266b-4df3-bed7-de7ce365ec67", "value": "T1DEC2200049A178845333ABBFAB1B98E9FB77056B01948447786CB851AFF2C1CDEE4DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273368, "uuid": "8e60d6a8-4a10-4f36-8d99-ed4e157e0978", "value": "768:PQ6H6RylvbR8XO1fl1HYwtFwwVeraTP7idghCPxm7Stjf1MPjXvcUsarQCP0s4Wg:IqVZaUtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273368, "uuid": "256e908b-593c-49e4-84bb-7a248a54f978", "value": 25965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273368, "uuid": "47effb8e-6336-4446-bfa1-f6fae1723f70", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273368, "uuid": "dc1b124b-e7ea-469b-8b70-298de29f7adf", "value": "20260610_\u4e3b\u84b8\u6c17\u7cfb\u7d71\u7528\u30d0\u30eb\u30d6\u4e00\u89a7\u8868.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6e9130-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274644, "uuid": "d4cf0419-b3b5-4b90-9e76-2fcbecb72f3d", "comment": "Malware payload", "value": "c366f402858b0d26f72b9f05820bf6b4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274644, "uuid": "0318b45e-6aef-4c08-baed-a9404889575d", "comment": "Malware payload", "value": "0ed7a8454e3f3f442288799893dcd8d14b2ca6c3b180e818b8a9b60bb7695027", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274644, "uuid": "7de3cd30-f42f-42e5-a776-e9cff33b1502", "comment": "Malware payload", "value": "943a32e1cbd838a24f6d23d27caa09c00a58c874", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274644, "uuid": "1f14eb3c-986d-4079-9b04-62c0a7c1bee2", "comment": "Malware payload", "value": "ed19525acbc42df73d74f6f82491caf038ae216fef3f8fff32354ee3cd3645efdb909830130a082e99b38a28cf50c9aa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274644, "uuid": "bbe47bd8-e287-4295-90bb-ff243c832aaf", "value": "T1B5A4239CAC901E565C9637905E3E9F130BB0E81B32EDCA79970B36A0D8F9D8456D824E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274644, "uuid": "2b4dcd1c-050a-4183-acd6-95bc3fdb9099", "value": "12288:8zYfcEaN9B/Jm0LU0gM7aQSF/KBrh6OF8uRNiwowhA:zfclN9BhmSHMKD/qWnogA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274644, "uuid": "17fd6083-9a02-4149-a202-855aab089c2c", "value": 467813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274644, "uuid": "d06654d2-b2c3-48a4-af57-6cb72587310c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274644, "uuid": "55885a73-d1fe-4814-a796-c0a01e19fc5c", "value": "0ed7a8454e3f3f442288799893dcd8d14b2ca6c3b180e818b8a9b60bb7695027.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092f84d1-c18c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791294261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294261, "uuid": "d39f81a0-125c-46ca-9d23-42f8196a8b96", "comment": "Malware payload (Mirai)", "value": "df7a6a29ea486c1e56607e21e18d6ca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294261, "uuid": "174c8171-c8ad-4f97-aad3-f3d4b2366e29", "comment": "Malware payload (Mirai)", "value": "0ef7ae3bc2f195d13288a0c05ba9b2edde1d927752142d73ae6b539c2d65b0d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294261, "uuid": "25e2b0b7-70cd-4b19-80e6-8af39281ecef", "comment": "Malware payload (Mirai)", "value": "0ad1a8577791fa1157e732123709977ed749ff64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294261, "uuid": "9be15ca4-ad18-4523-8772-dd1a4c2045d1", "comment": "Malware payload (Mirai)", "value": "eaf0dfbe01facf02a66156ca1190aba62a5f03b0723ae60aab52c19fdb84d209a9e31d505a7bd570b3cb07feac260e87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294261, "uuid": "7b406869-8138-440d-bf13-fcabe3cd6705", "value": "T18453F791B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294261, "uuid": "ae691322-1160-47e2-88c3-28bd1a153d3b", "value": "1536:dn385gSW19bj2h1XBfpu2ac/ISDMSvhWy5pXY:dn3QxJpRISDMKf5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791294261, "uuid": "e3cf21c2-6e04-44d4-ab38-5265b4a47d45", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791294261, "uuid": "a74586a5-3569-4f96-9c65-3ea28cb411dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294261, "uuid": "99c206cc-907e-4fdb-ac5c-f04aad77d6b8", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a8b38a-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275549, "uuid": "7d6101ce-8045-4469-9daf-d48fa703de3e", "comment": "Malware payload", "value": "b71c7eeb9d82a0280f348a047234f7e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275549, "uuid": "569ba41f-2c02-49f2-8879-d8efe535ab54", "comment": "Malware payload", "value": "0f054d7c6e4efccb491f085dfc3ed49f38d45f1b8f42bcd0f3980b820e6f1a34", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275549, "uuid": "e6769d34-5791-40ac-9cf8-9f84c4978f21", "comment": "Malware payload", "value": "e993847a68822b6d320060b8bf14181efb0c755d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275549, "uuid": "072eb7c1-73c6-4fdc-b439-346819157085", "comment": "Malware payload", "value": "89d59546c1f80dfd0ca0b58817f018a345fdc5fb35de1d4596b6181c2701d669c2499ddfa2210e7d724090ede441a7e1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275549, "uuid": "b424304d-7957-4ff8-b820-09a161d3d0a3", "value": "T12AB423F193429E0B23A4DAB457A3DB3375CE7292769D9301CA06CA9F4C7072896DC16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275549, "uuid": "22a28435-20dd-4dfb-9f89-4670a14c10a2", "value": "12288:Ekmht7Drvdyi4CCH1oHF9nJ/qjuybgoJrrzTPwke:EkmHzMtH1ELnKbgoJnny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275549, "uuid": "d5dc5249-0f47-4886-bbe1-3e34b234023b", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275549, "uuid": "3543771b-fcd1-4253-96aa-9e40279d9b4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275549, "uuid": "2a922179-8555-4073-8212-a8d9d732d891", "value": "0f054d7c6e4efccb491f085dfc3ed49f38d45f1b8f42bcd0f3980b820e6f1a34.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889b7ff4-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273859, "uuid": "e7277ee6-be8e-4480-b4e0-ac20331aed3b", "comment": "Malware payload", "value": "d696670c08b80ce4d5e34b7b21eae50f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273859, "uuid": "1e70faed-2f98-4099-8aef-f47959d309af", "comment": "Malware payload", "value": "0f33d8c590f0f75b658df3710f65ca7b5e4b7697838a63ab324f386f389877ab", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273859, "uuid": "5317616c-f7eb-4628-8734-75fb1357541d", "comment": "Malware payload", "value": "1a87afa5bacf35c04b88a5eabd0b4b9b0153e4b9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273859, "uuid": "6afbfcb1-f083-48c4-93dc-db2e365dba0f", "comment": "Malware payload", "value": "fc31585a97ca1c17879e303620ca0884b0c928c2ab3d1b92584f61ba30516dcbd660701f84bc04dcb86e3f309fdf5e94", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273859, "uuid": "6d32ed94-cb0e-40f5-9632-7785471238d8", "value": "T190B4230A85D01FFF8A9ECB9946D4A4672FF467952F93565BC0CD20700AEA203D6EFC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273859, "uuid": "920d3aff-90a0-423e-a681-750a6610308a", "value": "12288:DvOi3UDYXndLQ/jJOjB89RitlR0XjuIkVp69d3iY829uhBcbY7vPpCkIS:DWiEGnlQ/jwyil0X7kWv3icYcb9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273859, "uuid": "0ebc3733-0f6f-482f-921a-836f4d72d7ca", "value": 540419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273859, "uuid": "6a9d711f-f734-4a2e-b15a-0604fd21d360", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273859, "uuid": "b25f4207-98d8-444b-ada3-255758ae5099", "value": "0f33d8c590f0f75b658df3710f65ca7b5e4b7697838a63ab324f386f389877ab.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369bd20e-c163-11f1-927a-4201ac107004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1791276728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276728, "uuid": "4c6c42f3-8e61-46d5-9b14-daf22df37dd5", "comment": "Malware payload (VIPKeylogger)", "value": "0318610bc0acc54abc723d6489991acd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276728, "uuid": "43eb4fab-7674-4e62-8eb3-18e4b53ed9f2", "comment": "Malware payload (VIPKeylogger)", "value": "0f745e6ad9650b0bed5ab1681c437a13c1851e594811e49c4e4bbc1f7318155b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276728, "uuid": "f06b892d-cec5-4c6b-8cd7-b6356259a4fe", "comment": "Malware payload (VIPKeylogger)", "value": "c2b8bdce1c586fb84d7e74556f15aaac4667b933", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276728, "uuid": "1cdd03e7-e233-4fda-81de-5841f1bacdd8", "comment": "Malware payload (VIPKeylogger)", "value": "457fc7029415a1f9316ac9180dfbb5337809200b8f06b01631491cf5e63728186fd5e59a9140824e8fab31b04e383b32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276728, "uuid": "425ebf0d-5ba4-4abb-8d13-504d86696f0f", "value": "T171F5C3911F8791327720AB8D4639EDB0980AD48319F6CB3071BCD65B361CD1BA35FAE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276728, "uuid": "9a8fda99-4b72-4c68-bc67-3d6ceee489bc", "value": "98304:L0Nnu5c6NduXi4YA1Mg2vVMUhWjSmxuIsAZSh7JJVMxNMqaW3hkMrk9efZ56SGW:L0NnTcdQYA1D2vVMPXwIsR1J8K63hkM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276728, "uuid": "9fda496e-fa37-41be-a346-736cad27dda2", "value": 3511258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276728, "uuid": "bee892e3-7c73-4160-b1f6-db466ce77e8a", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276728, "uuid": "798a9467-752a-4cea-9659-c8e78f5b9d22", "value": "PS2026-1658 SATIN ALMA S\u0130PAR\u0130\u015e FORMU PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e2a34a-c16d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791281126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281126, "uuid": "00a62ee1-bcb8-4ac2-863a-809acc402eb9", "comment": "Malware payload", "value": "9c24430331a76b19cfb5dd756e6c8703", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "jvm-agent", "colour": "#3F6D53", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281126, "uuid": "fd7488d7-6764-4fc2-b54d-1dd4c46cc7a8", "comment": "Malware payload", "value": "0fa4177ccc1cc52febf7c54f98906a2bff941549473607c9e862333faea5ff05", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "jvm-agent", "colour": "#3F6D53", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281126, "uuid": "8a883f97-8b77-48d2-84e0-004d34dbdfca", "comment": "Malware payload", "value": "cf8696f2884b74b7b5ce7ec584c7c917dc94847d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "jvm-agent", "colour": "#3F6D53", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281126, "uuid": "1009fe83-63a5-4542-8a30-832e19ce3c1c", "comment": "Malware payload", "value": "9f0af703d867e46c60eb5bb3efac36ff1dc4dc1743fdf420651a41cd0eea5632a26bc3c831ff8330c3adf451747e21ad", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "jvm-agent", "colour": "#3F6D53", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281126, "uuid": "a4a669c2-2e5e-4f59-81ee-30ac8c881a63", "value": "T1A733F129388C699DF9BD3DB017D2C3256926D6BC5061068FF1CC61BE2FB410D6F22E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281126, "uuid": "814b26ed-218d-4b1a-b181-080e0057a154", "value": "1536:2cu2ZtWCc+xEXyTZCeOEPPt+rv5VCwpS31Qtqj55:OCxiyIqQdVCwwatqjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791281126, "uuid": "df184c86-9ac4-4865-a11e-18a722dd7ae2", "value": 50562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791281126, "uuid": "319ce908-17d2-4c35-b298-933b925babab", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281126, "uuid": "713c0100-a77a-4d87-8516-3bc9fa868a26", "value": "updater.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a66027f-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272466, "uuid": "189a240f-ac23-490b-a2e0-b5a9dee29dd8", "comment": "Malware payload", "value": "b89a4fee31df9e02490ffe41540d7074", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272466, "uuid": "95e895b0-0dbd-4c1f-9e57-0186adbeba2b", "comment": "Malware payload", "value": "0fa88dc740aeafb4e9caaacd1b9c4add0384435b99c87beaa60ab166ca53bdb3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272466, "uuid": "1242d87b-db6f-4971-916b-ce9afcf20a5d", "comment": "Malware payload", "value": "312004be3917153b724dbafc1c4f8f0d47e86faa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272466, "uuid": "0b57e019-8039-4cef-badb-733d89d9fb5b", "comment": "Malware payload", "value": "e57f1aff780e973b14a91fcc29399aa2c3524221fd46bc24d99bc16fd6c1aff52eafa08537bc4813dc67bac2b8fd1657", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272466, "uuid": "c0677d6d-c44f-4b7d-883a-1d0de8c4817d", "value": "T1A5A42394C1B857962448E3F9017F19AE5F302CB6CA3DA78E941FC6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272466, "uuid": "e219863b-f2ee-439a-bb81-b149500c32a5", "value": "12288:ASCDe0U+m1V6ECbniSPfS3e2R3feeintFckvTsuC8hHV:ADe0wUTiSWzeeibsP8dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272466, "uuid": "60d5582d-3b47-4728-955d-10e185932872", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272466, "uuid": "67fcb590-a926-4c33-b456-0ba0f19ea918", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272466, "uuid": "19b5bd7b-cbc5-4975-a67b-6f9b30d3bcdd", "value": "0fa88dc740aeafb4e9caaacd1b9c4add0384435b99c87beaa60ab166ca53bdb3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d988de-c1ca-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791320945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791320945, "uuid": "df62ac7b-a145-474b-abc6-ee62ded5650c", "comment": "Malware payload (Gafgyt)", "value": "0126a389136ade4b080af553900fd84e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791320945, "uuid": "184e10df-2059-471a-a14e-a81779838d94", "comment": "Malware payload (Gafgyt)", "value": "0fad00ddec16b67f3131aa4efffbe32d78fca178407895920b7549667d7bbfbf", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791320945, "uuid": "a3a2bb96-dfa8-4251-9d02-6e8951d886cc", "comment": "Malware payload (Gafgyt)", "value": "0e5533113cef49b8faaf283240760a601efa614f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791320945, "uuid": "a046cae2-49ff-4234-a9b1-1a16e7b7aea1", "comment": "Malware payload (Gafgyt)", "value": "f1e8d59fda1a9240bd117250d2e81ebe199ac142d35c1966fec6f55e06552523047469b6a2d99179c133de5d3cc9987d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791320945, "uuid": "50366661-b065-45db-8ecc-fcbff3f6b9db", "value": "T156E1C3D721A708702DE0E82B72BB5C0475E9A59F40E6AF896EEC3CF951CDD48B090793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791320945, "uuid": "cfefabeb-03a3-43fe-84e5-444a0d8be322", "value": "96:Gvf+srLjrzrHCKxJDUWgyQEol8fHn4El2KxiX1Dl8pPeOKx+mqcl8z:juGL5l8wEAjDl8pPbzcl8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791320945, "uuid": "1551063c-845d-44b6-ad5d-e851c38cc7e3", "value": 6802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791320945, "uuid": "7e0c8c23-946f-499a-901d-9ee436d9c38a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791320945, "uuid": "e30e1108-f9f9-4947-b5ee-28d82a0af846", "value": "handshakebins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8f0cfb-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303102, "uuid": "3c645c89-87cd-462e-920e-76d471083a88", "comment": "Malware payload (Mirai)", "value": "da82e8663beb567512037e2f3d2e6986", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303102, "uuid": "8a15571b-44f3-4ed4-ab72-b4fa55459ab6", "comment": "Malware payload (Mirai)", "value": "0fed65a69b3191eda6e14599b1f579fe6d973b9ce4152a0144ebc98ddab25f70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303102, "uuid": "05e10311-7fcd-490a-bea4-95fe512f6cf3", "comment": "Malware payload (Mirai)", "value": "bd13dd5f8e41f9a6613ea32a6d16f3ebaf7004d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303102, "uuid": "7dc624a8-85a3-44c4-a608-a8254aed2a05", "comment": "Malware payload (Mirai)", "value": "b8d25baebee4018393a0c1dcc88b130152bbadf7d56c9b7d3d4fb8120627cbdc9c0a29d685856c680953cb88a0563e4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303102, "uuid": "6d22a3d3-9d86-4a1c-9bb7-a14f32c8ba86", "value": "T119344A8A9EA01EDBC46FCD30062E871719ED599BA3F1773AC67CDC48358E24946E385C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303102, "uuid": "1e8f80b9-3490-46c2-b078-17f722361e98", "value": "6144:U76gAOnXSgXg+kqjJq2ZhFIlkYahfP4TpCCHJlzK/a8j:j9KXSgXgQjJn8kiYC6Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303102, "uuid": "4923ab08-b3a6-4bd0-b21c-40332243401e", "value": 241720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303102, "uuid": "2ca3dc11-017d-4e52-84fd-70e8dc3654df", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303102, "uuid": "450399c9-0c0e-4028-83bf-1a17f4fd569c", "value": "flutter.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6024d201-c13e-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791260907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791260907, "uuid": "10d4dbf3-8bb8-4b0b-8631-0161ce3af824", "comment": "Malware payload (Formbook)", "value": "ad6a7fe9c9d21c0f6d68b3d44f966150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791260907, "uuid": "80570a15-e646-48cd-acbb-3114cfafeb7b", "comment": "Malware payload (Formbook)", "value": "10333cfe3b8de037f163d4e80af8e1f18cd5ca7af555dbc9c1da5409925a079d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791260907, "uuid": "94f8dbe5-c14b-4fdb-9ec7-292e1e59be3a", "comment": "Malware payload (Formbook)", "value": "572b625b6f48b64ec15e038500c1d196f387e808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791260907, "uuid": "7e00f2c7-b37d-48cb-9a5e-db57a28b89bf", "comment": "Malware payload (Formbook)", "value": "3f57198e2df541e87d8da7e67b51ebbe0b21fcc64026fa693c65ff63b80fa8c69d33032862c52010d2d41fb495e6586f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791260907, "uuid": "6383a30a-6a20-4239-86eb-4e686b0eb0cc", "value": "T1BE158B04215BCA23C25526B0C9B2D2F90374DE54D932C36B5AEA7DBB7F35FF1A5402A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791260907, "uuid": "ce7d5af7-a4f8-40d0-af73-fe4674a9fd0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791260907, "uuid": "8de59f7e-4d87-4075-943e-79bb5d7ce9b6", "value": "12288:9Aoa3fikONrtry2VNX/tK4hSq8/W1fz795m8yDllVqlbc7n4P0:6HvifFy2Vp84GW1vS/VqJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791260907, "uuid": "01fb6f05-de37-427d-be1c-b25fac59bc9c", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791260907, "uuid": "ec0acadd-8971-4a5b-903c-d966e7703cc8", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791260907, "uuid": "48b34e84-1e2f-49bf-b4e8-8ee15baa517b", "value": "QUOTATION_2543_REQUEST_FORM.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d029cb2a-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273979, "uuid": "ec5e3ff7-ba7a-4afb-b24b-dc8fea42a804", "comment": "Malware payload", "value": "a2e77c93d36f2b24b7f530f837e7b3af", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273979, "uuid": "5c75f1b0-a0a3-4cf8-a82e-cf6a187ac6b0", "comment": "Malware payload", "value": "105d17fd4f69eb3e1273cfebeaac7cb6706d531237a94488f36512ceed717522", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273979, "uuid": "3f1f9c60-6815-4bae-8e32-5c47011281c1", "comment": "Malware payload", "value": "e23fcf52b02db14c8b612506cd04323ee35ce2c9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273979, "uuid": "602578ce-cb44-4841-8334-05b165a782b4", "comment": "Malware payload", "value": "45e3ebbe18b5d3e342d80929a14cf9078045b5563054f26a736e16b9926a6da0e9c51ae6ca2d78a801b3e033c2678cff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273979, "uuid": "cf607560-9a71-48b9-b19a-89721b7a426c", "value": "T134B423816C6C2B73F541F98C1AC5342CD4202C3B9AB763DC5E8844D3647EB66BD6A9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273979, "uuid": "b2a4c311-634b-46f0-a910-5d3ebb4224f7", "value": "12288:AjXlNMiiXBZTlViRziobl9jcr91+rTY3r8qNfUhuri:wXR2BZJ0RLbl2rKY3Iu8Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273979, "uuid": "301c7435-3a37-4a3c-802e-2516c569e6bb", "value": 530766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273979, "uuid": "79d17c01-39ac-4649-bef0-7ba251a56e48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273979, "uuid": "0954b043-9e3f-4f04-8868-a1efa40b600d", "value": "105d17fd4f69eb3e1273cfebeaac7cb6706d531237a94488f36512ceed717522.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b828cba4-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272221, "uuid": "c1dd7f18-c057-472b-ae87-3e2d02c60f21", "comment": "Malware payload", "value": "2edc37a29556dae0956b980652eb25ea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272221, "uuid": "05410f1a-cae9-4f43-9022-d622da6c2090", "comment": "Malware payload", "value": "105ff846d4486eebd6b81a4e59e48283cb4495486430c997904ae23d4e0d8ad6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272221, "uuid": "49c7652f-26ac-4370-8f09-b051d7de0ac9", "comment": "Malware payload", "value": "82294f8eefdbb2fdd34d177a15b096d9a57bf197", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272221, "uuid": "f4e151ae-9b89-4f98-84f4-d9741137a9dd", "comment": "Malware payload", "value": "c166ffd8079736e49500c66a027b795bd7fe61feda8469097983a714ed55591b4181eb7b3dc742b5400a5780704a4666", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272221, "uuid": "e74eb418-56b4-43c9-bb77-c8a84bdc0c28", "value": "T1B555338AC17C1CC49F3E0A9779FF555CA2248EFC200208636B2A59A7253E74FC7B595A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272221, "uuid": "027913a2-5045-4e4a-83d2-1f69c9b89369", "value": "24576:WPTJsZg555oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRV:WbJZ55oZ9bq+MmMEL+hcjXHC/wnwdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272221, "uuid": "721aa472-e425-4422-8392-eb7ff214a17c", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272221, "uuid": "301bf395-2baa-434c-be6a-a59b89400577", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272221, "uuid": "41de83ee-1d55-48e0-8ed5-8dd733791d14", "value": "105ff846d4486eebd6b81a4e59e48283cb4495486430c997904ae23d4e0d8ad6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61883765-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791273364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273364, "uuid": "86d7113e-f134-4386-a78e-5d027bd8faa4", "comment": "Malware payload (LxBaseRAT)", "value": "0e491f7fadc9109d6cc2d999a2d39eeb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273364, "uuid": "a7390d07-d65c-4de4-a8ea-eab2f29371a4", "comment": "Malware payload (LxBaseRAT)", "value": "107206a7343455aab6a6f0849a9427de29e69a6b61d6b03670af08fddb2ee3e1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273364, "uuid": "6f69dc3d-e7b1-4f6e-8c84-b2633f5e08ce", "comment": "Malware payload (LxBaseRAT)", "value": "a3584e890dd162d58bcc9f8c79369ae563982be1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273364, "uuid": "a65ab551-deaf-4712-8130-b9256f498022", "comment": "Malware payload (LxBaseRAT)", "value": "85ddd3b43b63c98aee5550279518efc385f5572752609837a9f1650afea8164c1087fa2aad1571cd90299c1e66e165f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273364, "uuid": "4f0f1399-5709-4a57-ad71-3ff78f1c6673", "value": "T157F49E31627C905D3D67945B633BB5237A0EFB2DD20A2B0045FE43C671E61BA92374AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273364, "uuid": "91229334-c3cd-493c-aa14-b58246236d02", "value": "12288:yiX4hIycRFtmDu81FOay3GrwSk5oFdkE9WMrhxM1lFvqGUopO9tv2i+03cG9:yiX4JuFtmDRKD3YwSk5kWMrhyTFvjtUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273364, "uuid": "d030114b-ebff-4401-b19b-d245f8382c94", "value": 733743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273364, "uuid": "3d89582a-61a5-4832-bc14-ff55a64599f6", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273364, "uuid": "6abb2877-53ef-40ad-88bb-817b60704d63", "value": "BI\u00caN LAI GIAO H\u00c0NG-.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58215c8-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271841, "uuid": "b7f706ef-7b44-47ab-80e4-455cb1261cb2", "comment": "Malware payload", "value": "aad87ab2eb63572c7a80f8d96771bf55", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271841, "uuid": "8f9a7de5-8695-46c5-af5c-5caf0189efb7", "comment": "Malware payload", "value": "112a0275cd44bdd5b850f82b6b3ed430b9a6cb7bf1b27dcbf57ee14dd8ac65a9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271841, "uuid": "d944e295-052e-46e0-b6c6-42c6bf85e86b", "comment": "Malware payload", "value": "6cc5256257e07291996288f6f328bae7a12151ba", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271841, "uuid": "e566bc2a-38ae-4bd7-9d25-2e7019cef864", "comment": "Malware payload", "value": "0dbaf46584cc7b756c20b0d8f05b655310292557328719d10011c4d2653d274941d4a314a0022dbbb84f1f18a8bd042e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271841, "uuid": "3616da72-574a-4cb9-9cdf-f3c7a01207d6", "value": "T1A35533D781BC29C44F3D0BA3A7FFC55C72248DFC20020867276985D66A3E79F46A4A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271841, "uuid": "5892e4b4-6c74-40f0-8913-fab1666096e8", "value": "24576:1oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRI+a5+t6:1oZ9bq+MmMEL+hcjXHC/wnwdja5+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271841, "uuid": "c1b58d37-e70d-4955-9f33-77c66c172009", "value": 1380742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271841, "uuid": "0a796bce-5a53-4bb5-803f-b41c371df866", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271841, "uuid": "86e13d5a-0ea0-4db5-83af-a2d51bcb8d7b", "value": "112a0275cd44bdd5b850f82b6b3ed430b9a6cb7bf1b27dcbf57ee14dd8ac65a9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ecb559-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275841, "uuid": "feeb5077-224a-4e2c-ac50-c5f12a92867c", "comment": "Malware payload", "value": "d1cc0eab22a8c66aacbc9ea1f80cba11", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275841, "uuid": "757ef6ec-294f-4be5-914a-15725bd5c3db", "comment": "Malware payload", "value": "1159fbd39590943b6b6c07d7d8e542abec6c6870478bc6147a89f89d8fe2dd36", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275841, "uuid": "c6453fc7-3540-4155-a840-a213fc7d6a8d", "comment": "Malware payload", "value": "32ad0c71c1b3f356e320f1a5e4f37416318522be", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275841, "uuid": "b20b3692-067d-4407-8bd5-9a37f8546ba0", "comment": "Malware payload", "value": "1235886822a28e7c3190016ead781aca2b1fff6cc8f347436489a4f620ab3a6e16065f91f943efec55b1e06606671e12", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275841, "uuid": "4e1b2371-3733-49da-b24d-a7228f5a292c", "value": "T1AB55334B813C2DC89F3D0A57B6FF446C62148EF821421C371B2658D7753EBAB867898B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275841, "uuid": "ef86eeb0-b065-43d2-a83e-9557e5eb6f8e", "value": "24576:uoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRWt60BwgS:uoZ9bq+MmMEL+hcjXHC/wnwdj0BDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275841, "uuid": "952365d9-541f-4a61-a80b-e6d923b35611", "value": 1394759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275841, "uuid": "68a2f647-24f6-4fb8-ab1b-e0e1eb9e82b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275841, "uuid": "3af04047-4a31-4af8-b35f-9ae30495aa66", "value": "1159fbd39590943b6b6c07d7d8e542abec6c6870478bc6147a89f89d8fe2dd36.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253eca7a-c12d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791253506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253506, "uuid": "7d7aea53-dd9c-45eb-85dd-62c28a2ba928", "comment": "Malware payload", "value": "3cb1565a4d3cf7a9adeb234d195a81e0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253506, "uuid": "735ef758-ddf9-49ab-b155-b300eb6f97b2", "comment": "Malware payload", "value": "118219364649af5463b56abe19b313b810440cf2969b0e7cac64105eb5303037", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253506, "uuid": "6f145760-e99a-4e04-8115-606f6b2091b0", "comment": "Malware payload", "value": "cbf56ab21736787e547edda60b73593403b485b2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253506, "uuid": "61715358-6cb4-4da5-9c7d-16a145ec55c5", "comment": "Malware payload", "value": "90e7ad75e8b736e16b90140a787b60831cc240f6e9a69915fc486bf4339d71010c8f20bc84fae778f7c27c666104114b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253506, "uuid": "d1fab6cf-bf0e-4f84-9837-48038b156454", "value": "T1AB561256BB89452EC876C1310D9A533026635D82CEA36B4BB554331C79B3BC84FDABEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253506, "uuid": "f6032968-472d-43ee-9b9c-7f79bddb5d10", "value": "98304:WNZyeq5PX8U1LhN7aDOF+4zIi95Yfzm3xVs+NRmx3FE+gcaYPzwZYYJFh+3S+:GyLdNoOIti9Izm3fqV3gcaOz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791253506, "uuid": "1b8a60d6-ae1e-4a80-9b2d-dd6ec8270107", "value": 6149542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791253506, "uuid": "e6e9c465-6c28-42ea-82aa-22305e9fc4c2", "value": "application/vnd.android.package-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253506, "uuid": "4fdbf2d0-1505-4e60-9735-d65e9b495fd6", "value": "118219364649af54.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d037d9f-c18a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791293597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293597, "uuid": "a1c09deb-9bd1-4714-9cf0-8cdfc40e35dc", "comment": "Malware payload (Mirai)", "value": "8570bfc42fb452c59489561873f8c068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293597, "uuid": "a7a6c5ce-e185-40bd-8965-fe6cbd56dad0", "comment": "Malware payload (Mirai)", "value": "1193810b0157347872aabe7a6725eebd938e7a90a1d1eb53eeaf62bc60dfbb6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293597, "uuid": "75bd6752-a1e7-4d8c-93d2-62956dcab1b8", "comment": "Malware payload (Mirai)", "value": "6a50e9464a32debd532f0d0c6fcf35399abbdf0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293597, "uuid": "aeea2cf9-9123-4c91-bb55-3f0998768bbd", "comment": "Malware payload (Mirai)", "value": "84df138208a76d35e999750a2a43f97ee3ce60bfd2910426e2aac4a4f589dad762f1a1095820e54aaf77cccddd548394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293597, "uuid": "c1e57410-b197-4bd9-b70e-f3f8cd9e2c1e", "value": "T174D44B032B2D0B83E7974CF0777707F0879AA85620F9F549EA0AADC69771870625E5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293597, "uuid": "f704e8fc-7a3f-45e2-9f64-e4ed670a881b", "value": "6144:SikIGx2cq8gYpLaTRxyEjZlyitTLR8Wwlo/vsmzZuucG86GXdAGUKm6x+6COcvLt:7G7q8WRxyqgmIC85i8cvLItyuT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791293597, "uuid": "1286252e-e53b-4e8d-9d65-bedfd69cf10b", "value": 642416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791293597, "uuid": "01a7b0e3-2c04-4681-a788-7b3e9d635bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293597, "uuid": "3c5932c5-63f9-4288-b05f-92c2b73a7f1d", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8d4760-c18a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791293594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293594, "uuid": "08a3f611-ec77-4b65-9842-d109dc421e07", "comment": "Malware payload (Mirai)", "value": "2f1662fe56a80024bbeeed4d9baff8d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293594, "uuid": "e6eeecc2-7d33-4097-8431-1045de9e397a", "comment": "Malware payload (Mirai)", "value": "11996f5499d3475503751677e10b20902f26c7ee6cdc85e3c0c545f1e7168d14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293594, "uuid": "f24c86c6-fbb8-4d4b-a125-b7e0ac880565", "comment": "Malware payload (Mirai)", "value": "94dcf3f0b35dcfe32454ecaee7d0800892273046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293594, "uuid": "6589673d-d255-49d2-9004-a9340e4f98bc", "comment": "Malware payload (Mirai)", "value": "19cc482ecb6f51fae284a0a19ff64f3b6d57fa60dde4024b7308379a2554c5a17246e3c2263154064b6b9784ab5ffaec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293594, "uuid": "c808553b-a2a1-417e-9067-bab64cf50a36", "value": "T172C2D070F8C0BDE6DEFE9D34485185D07BE62F0D37D1CDDA208DEE215616D329AA8A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293594, "uuid": "96408b15-7d0a-4c54-84a2-11e6d333f45a", "value": "768:7KnqLiChP7gI5gBZw+LajR5B4uVcqgw09m:7KqL1h4Zwa6bB4u+qgw09m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791293594, "uuid": "2bc1dc92-1ea1-4476-afc8-446919f1d2d3", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791293594, "uuid": "9fd0fad7-820b-4296-a5b7-9dabe103f15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293594, "uuid": "b6a8c3c3-bd36-41ff-92ba-64a59127a459", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4926c0-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274243, "uuid": "121c63ef-094a-4962-abd8-2e94a25b5ae2", "comment": "Malware payload", "value": "a17cd1594cbc00c75fa251091813522d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274243, "uuid": "f8ea33a9-b96d-4b15-9f38-f128a1d2e075", "comment": "Malware payload", "value": "119a6033913ece3014c32535f0280d69544055b432b2eab999898da6420ee17f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274243, "uuid": "9eeb4eed-a8eb-4c47-8a8e-3892ee660596", "comment": "Malware payload", "value": "ec4f19ccbfe2a8cc6225ace46211d62549a60e4a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274243, "uuid": "e634f582-6534-4cd0-a5c3-188b905da379", "comment": "Malware payload", "value": "8570595e99d7aa1aee0f2fca135811ed91a1243f62050595466a5f13df96d204f588d80faacd135caab5d74b1cb75f00", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274243, "uuid": "e86dce6e-4a37-4ddb-af1c-a23283886b0d", "value": "T146A4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274243, "uuid": "937e7446-f392-44eb-9733-9d53a9047f66", "value": "12288:or06BUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZ1:or06BUv4t1cNk/wjibhv4b2OnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274243, "uuid": "ba3d6e3c-a84a-45ee-9da1-14d9ef56baa7", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274243, "uuid": "3a416b8d-ee37-4627-9257-77aa20e21878", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274243, "uuid": "b5d0c4a8-5a11-4bb1-ac02-2c35088061f2", "value": "119a6033913ece3014c32535f0280d69544055b432b2eab999898da6420ee17f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a202de9-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275070, "uuid": "45c58779-a901-43fd-8564-14c65d4a9971", "comment": "Malware payload", "value": "165214309383bb886c0eaa487aa830b8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275070, "uuid": "ca3d2a0d-0489-45ba-8f4b-3795098cf400", "comment": "Malware payload", "value": "11c66acb0e277bd324a5b2714bd12f2b54f585ea9bed99eb527be9eaab92433b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275070, "uuid": "a08503b1-d4d6-40f4-8bfb-cd2dedd99da4", "comment": "Malware payload", "value": "43b79a1fd6b1dbb355468a1478a7ad1ce547d339", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275070, "uuid": "f8a1647d-a616-40a1-ae80-dfdbc4f9bfd6", "comment": "Malware payload", "value": "6f3701f320ac7acd96c25f505d9545c81a632b43928c9882cbd962612c5b0b28f78ea0c8657dc873fda4211997e9c9a6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275070, "uuid": "8ef0b802-5635-4e28-a3ce-b2fbbe4b897c", "value": "T1FA55338A817C24C88FB90B9367FF919CA2148EFC100304677B1A6997213EBDFCA7555B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275070, "uuid": "12259d10-b4bb-45eb-9662-04b8d0d0e32e", "value": "24576:iKBnBN7/oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR5:9BN7oZ9bq+MmMEL+hcjXHC/wnwd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275070, "uuid": "c532d076-2646-4938-a4c7-7f6a4695d19a", "value": 1387157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275070, "uuid": "695f8657-355b-406f-8d75-808a26bbfeb7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275070, "uuid": "13028a5e-96b4-4528-ac62-973dea6e87fe", "value": "11c66acb0e277bd324a5b2714bd12f2b54f585ea9bed99eb527be9eaab92433b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad94dcad-c15c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791273921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273921, "uuid": "812d3e70-a549-4164-8621-a711f0605d25", "comment": "Malware payload (Mirai)", "value": "b0f87c42512cdf2daa138077507c97c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273921, "uuid": "46724712-7f1c-46a5-8f6e-c26b4bd827a7", "comment": "Malware payload (Mirai)", "value": "11d703a3aeb726003e281271e0720137461783a7ad53370d558b6aef0514c9dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273921, "uuid": "61248b58-dd22-4b9e-839b-eb72577f28b9", "comment": "Malware payload (Mirai)", "value": "173439f61b2b4519032a35e0824959915bc33199", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273921, "uuid": "4a6da294-c372-4837-a981-8b47e8022ea9", "comment": "Malware payload (Mirai)", "value": "cac56f48471a845fbfab9d12beab1288f163530d8b4ce4c696613012539691c2931e455ee6101312943f2c20b90e0c93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273921, "uuid": "c73f3ce0-206c-4bc3-a257-deacdaceb657", "value": "T17D431891B8819A23C5D4137AF56E56CD372023E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273921, "uuid": "0105d3ca-d74b-47f7-8433-4cde123c323f", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273921, "uuid": "679df190-2ee3-46b4-b805-387c82617337", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273921, "uuid": "5acf8c49-e2f5-454b-90b7-2a2dc55f7c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273921, "uuid": "ba24857c-14dc-460d-b488-bef1a0a544fa", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3b5874-c1ac-11f1-927a-4201ac107004", "comment": "Malware payload (RustyStealer)", "timestamp": 1791308064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791308064, "uuid": "89d8415a-571d-4ca1-8b49-68c952d1e8ae", "comment": "Malware payload (RustyStealer)", "value": "8f9fc33ab36f20a0938eb86652e6eaa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791308064, "uuid": "85c27dc6-c6ad-45f7-9924-a31a1b3bfa46", "comment": "Malware payload (RustyStealer)", "value": "11d7da51a1d765e6f6946b27566876a5c42e4d157bdb2c9f45dc579c87417f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791308064, "uuid": "04fe543b-fd72-4834-bd6b-af9dee1c0dc5", "comment": "Malware payload (RustyStealer)", "value": "afd7870efc21f64af53990bf2f2b4f172b23ade7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791308064, "uuid": "62111f9d-df22-46e4-9f12-f8a18a9ea1c5", "comment": "Malware payload (RustyStealer)", "value": "a1aae4c0ecbdabda27fffb6357703e7db0babdea42f3c6ea2e622b7e7bf84e96227efdc8519ab45b53a235d7f9abe8a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791308064, "uuid": "59a06f4b-52fa-4705-8a62-a665398f2487", "value": "T1FEB69D43E6A6C0E8C52AC071C346E2B2FA727C494B2575FB06E46E273E21ED05B3DB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791308064, "uuid": "0325b1d8-4ae9-4e7b-a0ee-a15f41e3dc9e", "value": "14b5211b474625586733f7a3ad9cc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791308064, "uuid": "3386806a-620c-453f-ab44-24b805768a0d", "value": "98304:Y64iYWmrjOprKCsPmGkF2l5c6EGq6hfOB3Dp65RzwvSAogph3u+ywM4iD+vbaI+W:lYiFc5chGqw2B3ARhDcAbwRiD+vbaIWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791308064, "uuid": "25d0d0ec-639c-4fa0-a437-766e6a6dbc5c", "value": 10963674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791308064, "uuid": "83e3c2fb-c28b-410a-9102-d62d24ea64be", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791308064, "uuid": "54b54804-ace3-413b-accb-c197633cda3f", "value": "Havene catalog.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9313d5-c18c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791294541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294541, "uuid": "4b63eb72-f14e-4d76-8060-f9065c967e52", "comment": "Malware payload (Mirai)", "value": "ca4beae200b8db78b7b83ca7261bd6a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294541, "uuid": "57da1125-18c3-4d74-8362-ae2fb55d7ca2", "comment": "Malware payload (Mirai)", "value": "120e33accef4877c7e908e538206305b350fcb9aa6e6fe6596d878b4ea06a243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294541, "uuid": "6798cd5f-0fbb-41b3-af46-38dcb235da9b", "comment": "Malware payload (Mirai)", "value": "c51533a6133b9caf5aecd62ba685cacf70b66f8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294541, "uuid": "e96f5478-3977-46ac-9dfc-b7428e830b56", "comment": "Malware payload (Mirai)", "value": "df9e42681a6387b4859b9934da4adc54fff70b778546262d9dd5ca3bf2b1f776092ae1d599bc86dc0eebe3866fd8c038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294541, "uuid": "18ef6e41-84c0-4bd9-9005-610a14e2c706", "value": "T1C4540706AB919EF7C89FCD3706F68A1120CDF4072165772B7678DB1CBA0A94F49D38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294541, "uuid": "4daed6a4-aab4-4e11-97b8-7e6df0c70a6f", "value": "6144:R86bCStvvWcMF4FXix33OUfn4lxOSongCzBYjAUW7gaQP:RpRHFr83OUfAOSongCzBYjAUW7gaQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791294541, "uuid": "f909f210-d201-4c2b-9d1b-b22068173e74", "value": 279608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791294541, "uuid": "7683596a-d4c3-47d1-ae5b-0a65d3b9ecb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294541, "uuid": "f237bc26-5d8e-4825-8d6f-5a3ecde0fdee", "value": "qv3.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decceb1f-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273574, "uuid": "56f9e078-6588-4e3b-9aaf-9075e9a489d8", "comment": "Malware payload", "value": "82e30c835e055cd6685c815aaecd1280", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273574, "uuid": "ccee873c-a135-4701-9263-dd26005c6044", "comment": "Malware payload", "value": "12aa496cf2bcdf445571839e547f7e2ed8fbfea9eb013f8c98f02ee00ddac348", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273574, "uuid": "27b0c52d-0ea5-4d5b-8dc4-ca10778bb6dc", "comment": "Malware payload", "value": "f4b4c7d388ad045484b193f885767da6bdfe2ec6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273574, "uuid": "a54ea793-c02e-4559-97fa-e4f7e0149821", "comment": "Malware payload", "value": "227bc1403e6edd913f70c3e27c4f02addac7a4b4b03799fd4fc81dc7a24b1617d43014a635ef2e2529dcc34af5ca22cb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273574, "uuid": "b8538daf-0311-45c4-8005-863f7dbeaa68", "value": "T13FC4231DA0547B51F64B6A78B323CDB09B2AD03FD219C388A0840B399B5BE5769CD376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273574, "uuid": "1fe00368-523b-42bd-ba2e-fcfae948ee94", "value": "12288:mMU+0xq75aS9iYIp6cP/G2Bku6zXLnHXP427bW:W+J71vI/GzXDftHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273574, "uuid": "fa1756e8-4ee6-4421-b32f-79650582f397", "value": 587431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273574, "uuid": "4e64012b-190a-4755-95a0-b651ba1c2aaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273574, "uuid": "9ea002f6-f8f1-4918-a269-123001427a0f", "value": "12aa496cf2bcdf445571839e547f7e2ed8fbfea9eb013f8c98f02ee00ddac348.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db7bd9f-c17d-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288014, "uuid": "8936daa2-c33c-4e2a-9226-25b7cb23a435", "comment": "Malware payload (Mirai)", "value": "7ccd110c81bdbc29c5fa7471ac047fd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288014, "uuid": "c6a46d78-9a3e-43ae-9ef8-eec7dbde808d", "comment": "Malware payload (Mirai)", "value": "12b0d9541ab19b2e332f4337ef62684b1a5fce45936c276faf73c3d2a1c60c9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288014, "uuid": "71425585-4af3-4cb3-a4b5-9dedaaa2131a", "comment": "Malware payload (Mirai)", "value": "77e49533182bc8b1226856840bf962153e61f8e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288014, "uuid": "2f9d94ac-c86a-4331-8582-2fa58867b686", "comment": "Malware payload (Mirai)", "value": "dd1f1f5e74a0f5a9959b49453ee9cc1302dd9a802c222f8e9b5b86d3498bb525baa96d5f1fd58ed5a3808d014ed6860b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288014, "uuid": "c6f7630d-bc16-4543-82ce-2a3dadc5306b", "value": "T134053B076F609DF7C86BCD3306B5CB2624CCF48332A53B6A7678DA48BD1960756938B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288014, "uuid": "3fba5b33-d7d6-411b-bf0a-b91c553615a5", "value": "6144:s7K/Gx03Knnge7iiiSk0piEccR/8BmlXTw530Op2ude738+QjDx+Lh5we4+18:IoanngeeiileXCR4Fza3x+t5we118", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288014, "uuid": "e3959f90-058d-4bda-8777-f67169e14d2e", "value": 858228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288014, "uuid": "f7453af2-1f39-4b05-8f4b-fbb46d3041bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288014, "uuid": "cab983d2-cf80-48eb-adc6-c684f97a6ce5", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0015ec58-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272342, "uuid": "fd608b0c-9303-4185-9fda-6258a5fdcec8", "comment": "Malware payload", "value": "1b6bf8ea06c4b0de4355cc7e387c492f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272342, "uuid": "fb5d7bfd-814c-49fc-91e2-cff099a5cd6d", "comment": "Malware payload", "value": "12f051329b981a18c69d82995e137953243a308fcaf84b885e5c2d71d371ce34", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272342, "uuid": "46f06e69-95f2-44bc-9c90-74050c27fd09", "comment": "Malware payload", "value": "14666e6948e404164786d326551be2aa80c463ed", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272342, "uuid": "a24e2527-173d-4795-ad03-1514bbc01fd8", "comment": "Malware payload", "value": "320db54a7cc9017334088c44ede79c6fa08fd9851aa9b83c094cc4cb0f3c25a0bb06bcb13078191dcac5545f2164533b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272342, "uuid": "c84dd801-abca-409c-871e-00faa9133e7f", "value": "T10CB42369227F71900C7543A84B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB195638E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272342, "uuid": "861c8bf5-357f-437f-a2e0-5c15a7c2816b", "value": "12288:T7JZAaFpeMqO3g/ALyYG0ZaDajTCXMO8xzDOe3WS:TLpemA/f0Za6TCXKBxmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272342, "uuid": "5dff80dd-f0eb-46b4-ba3d-2b825d0037d4", "value": 542164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272342, "uuid": "c0c9905e-4803-4e34-8dfc-71d497f8e38a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272342, "uuid": "e384d04b-cd2a-47b2-93b5-1e96dfeb215b", "value": "12f051329b981a18c69d82995e137953243a308fcaf84b885e5c2d71d371ce34.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b3916c-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272650, "uuid": "64883c30-11af-4834-b545-3e7dbe77b0ab", "comment": "Malware payload", "value": "ddb5dca49923a9ef173f500d9711ff44", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272650, "uuid": "227a754f-674c-43f0-919a-e58cbdf574ed", "comment": "Malware payload", "value": "131c95cffb8d9e1e4923a44d40b39490924e8601f1bad44be1d014424c04966a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272650, "uuid": "3012f139-d6bc-4622-8069-13e5a6b4860f", "comment": "Malware payload", "value": "5df833d02e50506c535ac32c1947e711f5a1ab52", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272650, "uuid": "f8206402-2ba5-49a0-92f4-b703f26c1aaf", "comment": "Malware payload", "value": "6eebf2c4cf22470fe6a0c3e3767536b4c1625ed562753ad7f3e34c9d9411965c43c8489a135c65a45c613d3051a0be4a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272650, "uuid": "60b5c777-4af8-4af9-9727-be5e9f9b00d6", "value": "T1E65533C7813C2CC44F780A97ABEF855C61248EFC100218776F2685EB653F79F86B995A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272650, "uuid": "18cd130b-74f2-4edc-9397-d00f0f230c5a", "value": "24576:1pjJAt8oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRA:19G8oZ9bq+MmMEL+hcjXHC/wnwdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272650, "uuid": "9a20d6b9-cc13-44db-90f0-3d64684e6aa7", "value": 1381514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272650, "uuid": "7396bb98-e8f7-4328-bce4-473a408d0ccb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272650, "uuid": "d30759de-011b-49ac-a6f0-d3f7f18c3dd3", "value": "131c95cffb8d9e1e4923a44d40b39490924e8601f1bad44be1d014424c04966a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb95a40b-c17f-11f1-927a-4201ac107004", "comment": "Malware payload (Phorpiex)", "timestamp": 1791288977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288977, "uuid": "3735cc08-8f38-499f-951e-733aa323160a", "comment": "Malware payload (Phorpiex)", "value": "029d8159751de5f6faabe86b4f7b5077", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288977, "uuid": "e1088577-89a6-4903-a124-bd55ab815bcb", "comment": "Malware payload (Phorpiex)", "value": "13464460a6a916cfcfeba3f29c7d16708bf4ec638af94b0a3b165c5ccb994eb6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288977, "uuid": "6d89e06d-5cf6-4a2c-b5a3-585231d63d6a", "comment": "Malware payload (Phorpiex)", "value": "88785f0c5b69e4a891652fa631389bcd09ce1cf5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288977, "uuid": "23098ad8-360f-47ed-b6c9-2680f233c334", "comment": "Malware payload (Phorpiex)", "value": "12710fabdc2f53e26d19d5873a449e303a85324a7c43062d38fca69288db4316d9283d14cb6777983a7f6838f0c6632f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288977, "uuid": "88b936f3-54f1-4937-a5cd-50079ec598c4", "value": "T18E824B0FB8424316E0D210B09675867BEA79A87933C814DBF7D44AED0A686D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288977, "uuid": "8ec3c98a-b8b1-4a4e-bc0f-a71f00d2add1", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288977, "uuid": "44cb912f-698d-4be0-b36c-9abe8ca72311", "value": "192:mfY86SCngTBv8/V6lXq65FlnJqpu3Wlew7QKUSiu9zwDi7JZTgbOBqmEikrnDGJy:mR6I8/V6l6O3W0fu94i4Uoeav8U9cil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288977, "uuid": "5a8b5f14-2923-4be5-99b4-2a6d21cb10b2", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288977, "uuid": "0b8f38af-cda6-40f1-9055-db5ba417b07e", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288977, "uuid": "dfbcdbb5-ec01-4cd0-9f2b-94736b636b9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1834ef-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791273411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273411, "uuid": "b0bec9f1-e814-4145-9c0d-f6d083c4095f", "comment": "Malware payload (RemcosRAT)", "value": "b5d01581d7699ea8df9eb558b021994b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273411, "uuid": "ca97716f-4161-42d3-b740-e3e5f3426df5", "comment": "Malware payload (RemcosRAT)", "value": "147b204fdecc00ead796cbf6689eb8b8263a03f6ba8069cba45cf9362cc3d4fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273411, "uuid": "378b798d-06f2-4f22-9ea7-fc94b4d1801d", "comment": "Malware payload (RemcosRAT)", "value": "f592877657ea08e8da16c57db25a434dcddff55b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273411, "uuid": "b39aa220-10ff-41d0-a26f-15463d6e5047", "comment": "Malware payload (RemcosRAT)", "value": "ef0cacb5ad455e4a3f01cc5beb93bae0a9089f58fca512dfdfc11c82ccc25abef7ceca8aee4604a8aadeef59cd50ef51", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273411, "uuid": "788943e2-0f92-4813-b920-d15e717f051d", "value": "T1E126125BDC465F4FC8AF5E44325188469832BB665678B5C33CCE1A6DE3A8D307369338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273411, "uuid": "2ea46d7d-4c5a-4a44-9eaa-1262407df6f7", "value": "49152:/5S7r8s1vJDqVVQj1wtTv1CmOGlvYeYm7rCzouLm3WxbkrFnCwDPU0:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273411, "uuid": "ca8aab8a-eadf-46a9-81d4-36099450319c", "value": 4605801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273411, "uuid": "1c6bcc65-4193-4a99-9104-8e17edb43a7f", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273411, "uuid": "4aec8448-5db4-4df8-b2da-dbe767cd0980", "value": "offlinejsCRYPTED.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83c3ea0-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273966, "uuid": "294d3367-7826-4d48-be29-d3600422d81f", "comment": "Malware payload", "value": "387a4091b452a071ed196a8199698527", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273966, "uuid": "7a791dc7-c6f9-4135-9dc6-6eb8404a2c7a", "comment": "Malware payload", "value": "14c14f9057996cf5d6826d073d0fe31eca7c620f80f31c5ee98a3b2259614a6f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273966, "uuid": "5cea901b-c040-4914-9c9d-3d1c1d4b913d", "comment": "Malware payload", "value": "b22df567f381dc1ceaff57ac101c8b6d2c1931f1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273966, "uuid": "c3719268-766a-4906-b4e3-8e6fbc8906bb", "comment": "Malware payload", "value": "facd9e83978bcc16844de6f3144cfa6cdf99ffbe06f0dc33b2a9543e34a1ec1475cc6771808e946cd4acee2337c4828f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273966, "uuid": "fa15c18c-957a-4246-81e8-2efe93b00214", "value": "T118A4236D922554376D67B9D0AD1D2B020A70D18932DDDBD5CE0F38A08EFAC9C1EC61AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273966, "uuid": "863b357c-b5dd-4591-ad79-a7ae97766a81", "value": "12288:XW+GusvMa+AzYfcEaN9B/Jm0LU0gM7aQJ:XWF/vMacfclN9BhmSH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273966, "uuid": "eb68229b-8188-4b77-9f7c-8b7f270de512", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273966, "uuid": "55354b13-ab0a-44ac-b0bb-40b0cff01072", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273966, "uuid": "360b2a14-a390-4621-a884-25d0cc130a7f", "value": "14c14f9057996cf5d6826d073d0fe31eca7c620f80f31c5ee98a3b2259614a6f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882a43cc-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303064, "uuid": "ac141abe-9e86-45f9-b7a7-1f14c7e96701", "comment": "Malware payload (Mirai)", "value": "913e57b85c5cca618d5a93eae7cc9d50", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303064, "uuid": "8f68bc0e-c4cc-462b-9915-8216e5fab0f5", "comment": "Malware payload (Mirai)", "value": "14e2ef6c40d8c740027bb3ba7af1cdc39590ac26809b7060732e33977941ba67", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303064, "uuid": "4a07bb45-c755-4261-a771-c0ae74561160", "comment": "Malware payload (Mirai)", "value": "bb966289932fc96f8c4010ef7120b84a8f75d886", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303064, "uuid": "86cf66b0-f400-4a1c-901a-173ed86bcf8c", "comment": "Malware payload (Mirai)", "value": "180241ccbe7ec1b69b415510058eb9a078f2b1517803182136ee5ba22b6fdb36349ac3e7e05f714455f8c958c19106be", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303064, "uuid": "53728164-9812-4300-a7f9-d0819024b8a2", "value": "T17EC312E1CE85D7E6D08EDAB961D105F5E7053F3C623558904B4E800A6E322D8BEB94BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303064, "uuid": "d5336328-16a1-48d0-ad5b-81e6c66d0bc5", "value": "1536:OTNqF9WpRCBGelR+9dBWIuQJE0JdSqmvN5ANjGUe/arzp0MSP4LysPDRBbOC:BgeR+9dBvqqLecp0MRPDHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303064, "uuid": "8758cb8d-9f20-4e55-a4a5-5949fb811b91", "value": 126064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303064, "uuid": "a734f70f-27d7-4cd9-9163-66a76b196fef", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303064, "uuid": "a758cb5e-712b-4f69-90e7-db98d98a3443", "value": "flutter.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240e562d-c14c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266819, "uuid": "4343661f-c115-476d-aa66-6b82cd24317e", "comment": "Malware payload (Mirai)", "value": "a5bc6569b8feb058dd1a714ff713a995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266819, "uuid": "5491f05f-0e4a-45b3-ba2f-1652c990c938", "comment": "Malware payload (Mirai)", "value": "1531300e9c956f30f9d172b8dcaeaad10d3d41e6f7ddd234b2713b3c520e66f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266819, "uuid": "a675d0e9-825b-4538-b3d8-f5487331913d", "comment": "Malware payload (Mirai)", "value": "fe10a3d76ddd3ef4b91e27fb6869509bff5ed459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266819, "uuid": "e0afc2ad-678d-42d0-a9b6-d8982dd08844", "comment": "Malware payload (Mirai)", "value": "c14f9ca9655c41078d5a5608b3a5f10b9f41932933dbe51150503eb68b1b25410a871fe3d3ef439946b74c45cb1829a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266819, "uuid": "b2d45022-f890-4522-b34e-165916cbe135", "value": "T1E9B33ACDEA02D6B7C4430BB2C297966B46317A354A2ACE49F7CBFCB49B225C871147D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266819, "uuid": "1ca011d4-e533-41ab-9114-8fe8108ba1a0", "value": "3072:WeY45QR5JGaH8Ca1X4P8lAPi+ZB+DySo4XRZhSvn:WZ45Q7MXCapCPiGoDySo4XRZhSvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266819, "uuid": "4260360f-252e-4f3d-99cf-6a1afd6ace93", "value": 114564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266819, "uuid": "d5b8ea2a-7a3b-4855-908d-64db45f2b4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266819, "uuid": "10b29df4-2176-4023-baae-5f5dfc5f9137", "value": "getty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df39b18-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273680, "uuid": "b9fcbe04-273f-44a1-8277-5d1fa593b4b7", "comment": "Malware payload", "value": "bd49adbcc7d92b692d9b79d34adcc438", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273680, "uuid": "369b1bf9-67b1-485a-9e9a-5110a0825be3", "comment": "Malware payload", "value": "1541e22398e453da08fbadcdbb37429e8d15f7833d9197f6e08fe7cdc4f8144d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273680, "uuid": "b8b1fe7e-2a9a-48d6-9e64-80acdc9803cc", "comment": "Malware payload", "value": "23b943d7d48d0fb781cc0a7efe5cca039eb7ceab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273680, "uuid": "62b7b928-575b-471a-a442-ae0fa68990dd", "comment": "Malware payload", "value": "e0d7f2eabeb6586355cd0c8e5130edc35e27aca52051c300f89ba9d8ec8bce363170a0566f090dc0b47daab29621cf0f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273680, "uuid": "7bfe941c-a912-440c-92dd-4978110f2f05", "value": "T184A4238274716D0AD096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273680, "uuid": "aa135a0d-8cf1-4b64-800f-3b0b8f45164f", "value": "12288:sr06MUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZ+:sr06MUv4t1cNk/wjibhv4b2OnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273680, "uuid": "dd7941b0-0f53-41fb-ab76-9aa70dba09b5", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273680, "uuid": "5eb16e31-4b50-4daf-9621-f22323613a3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273680, "uuid": "c37ce003-f791-4ec8-9023-292d1a0cd0aa", "value": "1541e22398e453da08fbadcdbb37429e8d15f7833d9197f6e08fe7cdc4f8144d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b0b4c5-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250578, "uuid": "9f74f113-1015-45c5-bb88-dfdbb40535cd", "comment": "Malware payload (Mirai)", "value": "5980c1f37d2b3bf2a2459dde210542c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250578, "uuid": "9e1220c7-a739-4a7f-ad5b-a7f1fbb7ec6c", "comment": "Malware payload (Mirai)", "value": "15645fbba98fefa4e1aa29ec429c2fa15e99e0d743a7e4901010737b0436c0fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250578, "uuid": "6525e7c6-cef6-41b1-9e63-8232befc6e41", "comment": "Malware payload (Mirai)", "value": "cd0c90ecc61f5e0d2070a72565cb6b83cb0d4d34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250578, "uuid": "6c88d897-9482-4efc-be44-e0d3d6a3637b", "comment": "Malware payload (Mirai)", "value": "5c471621e6382eab7cc6133bf2589f74a824379465c48031af619e0fff6e5e5531b39e865f712489f2c7cab8dc3780ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250578, "uuid": "3598b6f7-d57c-476c-9c5f-f3f4187c2775", "value": "T1E7B2CF3C1B111B98DE1AC1BD83AC0B603DB41B2595429D4B6207FDD7AF568B87453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250578, "uuid": "08ab6229-a16b-451e-ab5e-85576bc8b738", "value": "384:deD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuipbBemd7JgGlzDpH7uNj1q:deD8ZSWvZHZbs1row697qohQvg9pbwiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250578, "uuid": "e2bd92fd-3801-433d-93a6-e398772214ba", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250578, "uuid": "f70ab085-01f7-4e82-bb0d-7ecafac41fb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250578, "uuid": "d788fc21-e0ab-4215-97c7-21db9ef0a848", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf1e0c5-c196-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791298912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298912, "uuid": "06eccb49-4463-4f0c-9078-e7744cdb8384", "comment": "Malware payload", "value": "c0fa59287caaa963e7a566e543de16e7", "object_relation": "md5", "Tag": [ { "name": "CookieGrab_ABE", "colour": "#E53CB9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298912, "uuid": "fd2b8d58-5405-4022-847a-5be0e83e3962", "comment": "Malware payload", "value": "15cd4a35cfe997b261551a3138a3366b75734b7b722f3dcd39b13c707f54bd7e", "object_relation": "sha256", "Tag": [ { "name": "CookieGrab_ABE", "colour": "#E53CB9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298912, "uuid": "d599f80c-18ce-4c1a-8a77-4a3c713208ec", "comment": "Malware payload", "value": "f27d4d5fe33a295a1bd63390e5ac8717725d1cad", "object_relation": "sha1", "Tag": [ { "name": "CookieGrab_ABE", "colour": "#E53CB9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298912, "uuid": "1a4fc096-f734-476e-9bf3-2346cfd21116", "comment": "Malware payload", "value": "d4d7944b8b5889a7a105b7ac2d5d684be075ed3abbc23e71f0e718cb3feba2d83813d4b3ad6a5f9472d65bdc4ffe89a4", "object_relation": "sha3-384", "Tag": [ { "name": "CookieGrab_ABE", "colour": "#E53CB9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298912, "uuid": "0c0c7164-4c0a-4b52-b3b3-7884b200e149", "value": "T13E75084356EB0CF9DD936B7C21DB6236A735FE748B3A8B6B9240C1312C136C16D6AB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298912, "uuid": "16abc4a4-0cbb-4b2f-9a0b-b3233fcdd681", "value": "cf4f9ae6e1931771afedcaaa17446b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298912, "uuid": "1a6cb5a3-dbf7-4a3a-9d16-fb1a9bb4d705", "value": "49152:e9ci0Te3rgen08icXemSYonOrKjbb1Ydnmd81H1:sPaYonOrKjbb1Ydnmd81H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298912, "uuid": "41c7870c-d441-4fd7-b109-0fbeb3e872f1", "value": 1680390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298912, "uuid": "c74b3cd9-21f3-45bd-aa8d-597aa7511cb2", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298912, "uuid": "57a2781c-2e6e-4ca0-8107-a22bda9ab432", "value": "15cd4a35cfe997b261551a3138a3366b75734b7b722f3dcd39b13c707f54bd7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d968598e-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273136, "uuid": "817a7ca0-72e7-45f2-a9b4-09343e34e750", "comment": "Malware payload", "value": "c618c11104f77c8e37bff26ff20604a2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273136, "uuid": "11b562e9-c2fe-4661-bd34-8f73ff8730cd", "comment": "Malware payload", "value": "161a0269683955aba7bfea6fda3ef909442d0c83dbb666982ea500fbd79f5561", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273136, "uuid": "950d34f9-fb9e-4fdb-b34c-d8e5f833c7bb", "comment": "Malware payload", "value": "fbbc007816cc7308ed574aab478243849b55f56f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273136, "uuid": "b19dc254-0f1a-4a18-b4fb-2398596d6603", "comment": "Malware payload", "value": "364ec19d4680751df6e35aee0222cd645e860d737962d274a8fe25de3f198d7779f1f1dcb17be32f113f14778a86e3c4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273136, "uuid": "a2a263a0-7642-42c0-8147-21806c988758", "value": "T177A4236D922554376D67B9D0AD1D2B020A70D18932DDDBD5CE0F38A08EFAC9C1EC61AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273136, "uuid": "aaa192ee-f340-4457-a79e-5e232b39599d", "value": "12288:IW+GusvMa+ozYfcEaN9B/Jm0LU0gM7aQ+:IWF/vMakfclN9BhmSH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273136, "uuid": "42054f68-3478-4f8f-9451-052dff343a89", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273136, "uuid": "6229e21c-cf72-4e5d-a4e3-36a0a4ca5c4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273136, "uuid": "00db3ec3-a89b-49c0-8baf-a3b0055b1768", "value": "161a0269683955aba7bfea6fda3ef909442d0c83dbb666982ea500fbd79f5561.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b231a17-c182-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290104, "uuid": "62648c2b-f36c-462a-ad6b-765041237d88", "comment": "Malware payload (Mirai)", "value": "81af37c755dc5e724b45070ce8bfdab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290104, "uuid": "6482c91f-df6b-4a48-b5f5-a27aa48b11bc", "comment": "Malware payload (Mirai)", "value": "16318e1af4cde570852753cd9ae41ec92f0cb0804230afdc49909ccd7fcc8a8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290104, "uuid": "31e7bee5-2d7f-4f06-aacc-f28e6f28dda1", "comment": "Malware payload (Mirai)", "value": "7963c46a05e2903a4a3c5be0765670c68b9705bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290104, "uuid": "1147dd24-8424-454f-9a0e-265c8db0460a", "comment": "Malware payload (Mirai)", "value": "741c0c70a7b790d8afba2ccd11ec270f269b6009216ef14fa9f0d827f4f1bc9fd56ddf5f1c3325e1bc85e21b9df87f6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290104, "uuid": "eaa7e014-1afc-436f-9453-03d20c6ecf06", "value": "T15AC48D03EBA3D9B1D4A380B150665BBA5971D577247BD84FDBE62C90EE205C0A31C3BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290104, "uuid": "301f47b8-1cd0-4c45-958a-58fcbef21fec", "value": "6144:HWG89PQruDQB9nX/7fYx8ua1NaRU8dt9vwSQwg8mODWF3uAsJIu:2G83sB9XDfJIPN8wkZuAUIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290104, "uuid": "af2cb25e-0dce-4397-a1fc-a8f2eb6ebe0c", "value": 582904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290104, "uuid": "c868dca2-12ab-48ea-9315-9ba38c78ddd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290104, "uuid": "6f4bbca0-5172-4649-87c6-96bde8965cf7", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00a4db1-c18e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791295454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295454, "uuid": "ccd22268-1559-491a-a6ef-40ffcfe9ddfa", "comment": "Malware payload (Mirai)", "value": "e0d32b89793a9b85ec5280ac1bd36132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295454, "uuid": "06365a72-f9c4-4981-acb8-0c0006a2d9c4", "comment": "Malware payload (Mirai)", "value": "169e8094d6dae3bfdf9f4c54c5b8cc366f3c29d9011dd8fbba04fa045011313f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295454, "uuid": "a648911f-0356-4352-9cd7-6a5c1cac3055", "comment": "Malware payload (Mirai)", "value": "bec06d6939f7e40fe899023cddfddfb2499003ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295454, "uuid": "e308b2f0-13fc-4963-b47e-1d7ed7b332ce", "comment": "Malware payload (Mirai)", "value": "72b7f77761321f83885cd40d950153b02f4b79ca37e73529d05c4b8b70d5879fc89436f5bec3e638c3a95347890cf6bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295454, "uuid": "9bd2fd82-7c30-4c4d-bafc-3423207a3ee2", "value": "T1D605F65B2E329F7EF579C7308BF34A74D69962D726E0C588E19CD20C1E2024A651F7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295454, "uuid": "31c2e3fb-8895-4e45-898e-61522c70e3c6", "value": "6144:6EGkOjMdyfYrlrRbPUf+k0K+oaH/Bnkr13Ax26HqOB7yDM3uYLRnYri1k7svfMPL:4kIqsgl9bJhEIaFb3VSRKOlkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295454, "uuid": "06555132-cc1b-40a7-a4d3-0bd770fb3a88", "value": 858200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295454, "uuid": "048cbbe4-7a05-41c5-88c5-7601a698bcf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295454, "uuid": "f7e340bc-a989-4f8b-a0a8-1e73a9c3ab21", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935acbe7-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276025, "uuid": "72b4177d-e2d2-4f71-ada9-be7c86ae2c97", "comment": "Malware payload", "value": "79953f3cb8c06e922a8cf79c0ffa3e70", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276025, "uuid": "97945f68-46b0-4d65-8ee8-0f427630535f", "comment": "Malware payload", "value": "16ba060f71d503f4ff1a1aff26c9dcf067a04249db394a4eb3a1ba1ca1d74f0c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276025, "uuid": "8769c1cd-6da2-4a72-9ef9-6543bdd2d035", "comment": "Malware payload", "value": "06011470ebe61716af625858acb1bc12a7f6c838", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276025, "uuid": "f864c7bb-bd3b-4fa1-9ec3-55eed4665f25", "comment": "Malware payload", "value": "d5f99b4b6977b984d4ee3fdb36c2c1a0ee136cfe739b5e87368400ec330275cda78d14c7c5101f2b18b22cc28029c318", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276025, "uuid": "069caaea-7e27-4f65-bb4d-cafee632eb56", "value": "T16EB42369227F71900C7543A84B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB195638E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276025, "uuid": "812f2909-fc6d-462e-92e2-9557e4b815c7", "value": "12288:17JZAaFpeOqO3g/ALyYG0ZaDajTCXMO8xzDOe3We:pLpeEA/f0Za6TCXKBxme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276025, "uuid": "83f53607-e87e-4caf-9a51-db03ec8d81ca", "value": 542164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276025, "uuid": "0a66c817-b0fe-4bf7-82dd-fa3467ea52be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276025, "uuid": "7ea29c68-db75-4f8e-9608-a33f0bbaba9c", "value": "16ba060f71d503f4ff1a1aff26c9dcf067a04249db394a4eb3a1ba1ca1d74f0c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d210bebb-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271835, "uuid": "f382d999-3163-40c5-b305-1cadbc58e7b3", "comment": "Malware payload", "value": "32455a48af1be841648a9b50b64ec65e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271835, "uuid": "282df8fc-a53f-4e08-9595-74009728d222", "comment": "Malware payload", "value": "16f4b35714e2d709464e69582d65ccf33c9ecbe6e3216fcbc0489450c0b4fedc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271835, "uuid": "ba972aa0-e737-408c-ab3d-22bdaf9b3796", "comment": "Malware payload", "value": "c33afe179a4b86e00e306929fd30589824660981", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271835, "uuid": "e2c610b1-accb-4003-94c5-2fb09dd852cc", "comment": "Malware payload", "value": "3f28ffba35093b5879496d60953fa65333d0dcca1217b007b6652bdd1051cdbe98ff8c2ffd108152bb5395aa9b4c0c4c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271835, "uuid": "ae88c7cb-4036-49f2-8dc6-b74fc0a57f07", "value": "T1D8C423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA545F456267BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271835, "uuid": "f9727383-fe1d-42f9-8a6c-5abfbe3c843f", "value": "12288:YA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWnSFyorOIic/7MP+:jm6Jj6ESfUxZ91kmY/99z8SFXicTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271835, "uuid": "5f366c32-b3a0-4226-a42a-2fd707906b45", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271835, "uuid": "5c558b5a-6a31-4dde-80ea-ceff9dec8531", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271835, "uuid": "f9df631a-585f-484c-980a-d6c0759726a3", "value": "16f4b35714e2d709464e69582d65ccf33c9ecbe6e3216fcbc0489450c0b4fedc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6c449e-c156-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791271478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271478, "uuid": "433e95e5-5133-470c-81fe-bcc4e5e0c0b7", "comment": "Malware payload (XWorm)", "value": "14873f091ec6e4b5cd510745741f246e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271478, "uuid": "54199f98-9fbd-4f1e-99fe-759b0f0b6e90", "comment": "Malware payload (XWorm)", "value": "17161ca9b95f7b2550a69cc0f2fce78ae93ae27869f6652fd54cbc2bbec68b38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271478, "uuid": "dfe5e92a-049b-4f56-9d8c-70d521f61f84", "comment": "Malware payload (XWorm)", "value": "763e4abf5dc140cdb702eeaa2a3d075670bc73d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271478, "uuid": "506eecd8-d9d3-4767-b846-5f08cf244aed", "comment": "Malware payload (XWorm)", "value": "16c340a0c3cff9dbde4948077a7ad29ac36d29e44f09b1ad3d3d43a9cb3a9a4e16bf18289707e5865779d81ea7ef0e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271478, "uuid": "b9126850-0023-447c-8ff9-eb47dacddc5d", "value": "T155D4E004326BDE02D5A55BF008B1E3B857B86E9DA931C3074EFBBEEB7439705A540297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271478, "uuid": "65989e5c-0a36-449d-90f8-d119a18b0cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271478, "uuid": "4c567f7f-4597-401f-9a2b-1c235858c03d", "value": "12288:NHQXd7n4P0bJA5dbJNl2TcILTERU+1NsylLjQOr3avNuu:y9nJA5db0TTl+PpdnU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271478, "uuid": "257ef52d-3af3-47ce-bd3a-ed3906b14f13", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271478, "uuid": "22c98ed9-c2e1-4960-8bf0-88ae1cd77f9a", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271478, "uuid": "6b2186b6-56bf-4024-a4f3-20297d3b50f6", "value": "ETC 109 SO#J033 - Invoice6ymao274496354941578CL6233_Id6ymao27439635....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bbdcde-c120-11f1-927a-4201ac107004", "comment": "Malware payload (NanoCore)", "timestamp": 1791248107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248107, "uuid": "d96c22d8-f6dd-4f8c-81b3-3819d25e48d6", "comment": "Malware payload (NanoCore)", "value": "6423288fa0a9d90a7faa2b610debe347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248107, "uuid": "81f9651b-cf66-45c8-abd2-e34833422425", "comment": "Malware payload (NanoCore)", "value": "176e3b8bb480955589c292be9e74c38fb08ba73046c3e3016597384337f95efe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248107, "uuid": "9679d6f1-b0c3-4097-8172-d6e9e8d4c15b", "comment": "Malware payload (NanoCore)", "value": "ec03931691ff02cceca84d9a5bce59860f3c3e30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248107, "uuid": "4c9503dc-1635-4409-9f11-55163ca92ce2", "comment": "Malware payload (NanoCore)", "value": "8b79ce753359b6d804f5b2cdffdd9e691a39b844a91f1b5f3dcbf0a0b8af1ef7aaa8a840628b944ca3859ac5e6d0fbf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248107, "uuid": "23f658aa-d2ce-4372-af06-30f91aacdf7f", "value": "T13214CF2637A88A3FE2DE8979611201129739C2E3D9C3F7DE28D455B79F263E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248107, "uuid": "061df9a8-e375-4e24-b356-ecd8841a3520", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248107, "uuid": "32e736c9-8486-4c60-9854-61a70120e22d", "value": "6144:MLV6Bta6dtJmakIM5S8GL+1WUQ52F+/8Ej4erP:MLV6BtpmkSGLUcQsEEj4MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791248107, "uuid": "3bfac44d-d639-487d-80b8-5f566b898d3a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791248107, "uuid": "31e1190a-90eb-4481-ba99-be436267d803", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248107, "uuid": "6c36c88f-44d7-44d4-846a-6d34f8a8436c", "value": "6423288FA0A9D90A7FAA2B610DEBE347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ed36c2-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271028, "uuid": "67e6d223-e92f-4c39-9332-ba3daaf63bd0", "comment": "Malware payload", "value": "60259f397fdda2d8df3779476bd8998b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271028, "uuid": "f4c17b46-34a3-4090-a794-a647ed5c4393", "comment": "Malware payload", "value": "17cda8011d4a9705bf5098da6a67060ddfe3582a990b09e9f058c938e6de1368", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271028, "uuid": "a4f1e82a-6069-4678-a6e5-080b8c601835", "comment": "Malware payload", "value": "615c24204d1a9427e8ed509145b059d75d9e9fac", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271028, "uuid": "4acf1fb5-cd80-499a-a7d1-f4f31d5bded1", "comment": "Malware payload", "value": "19a0545095b9af7702556faa5974b4b6085da9d2ae69af44c4fc1f3ab2c91ade9e1b20f121559fd796751bcf5b80ad67", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271028, "uuid": "47ed55b4-1c6d-44f5-ad09-be56d8b2f3a2", "value": "T1B5553387813C29884F3D0BB367FF955CA2248EFC100309675E2A9857363F79F866599B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271028, "uuid": "1d1ab5e2-bd71-45f7-a93b-c6adc9ec969d", "value": "24576:XjqZmcpuYoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRn:dYoZ9bq+MmMEL+hcjXHC/wnwdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271028, "uuid": "a52f5a76-29b2-4961-be4f-ce38425ece04", "value": 1394887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271028, "uuid": "c5414ff4-f763-4dfe-8eaf-406bd64c573c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271028, "uuid": "26ba112b-789f-4acb-8736-472c5339d441", "value": "17cda8011d4a9705bf5098da6a67060ddfe3582a990b09e9f058c938e6de1368.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70acd716-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274249, "uuid": "96950866-2b83-4520-82e9-e887e9a9566a", "comment": "Malware payload", "value": "2cceca3527a64a07490b702d8baa7a79", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274249, "uuid": "6bcdca3f-1301-4dde-a555-9e28488536fa", "comment": "Malware payload", "value": "1856dbe716380f07a04e902147bd84c30f7e9e6d55ded98bc9e642af1f431992", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274249, "uuid": "d70d1588-ebf8-4879-b040-d001d4ca5c84", "comment": "Malware payload", "value": "e70d83877d0f690538cb8c98dd2678ac9c1c95e7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274249, "uuid": "c951b9e3-4b30-466b-a1ec-76995bb05829", "comment": "Malware payload", "value": "deb252e29647fe57995395cd710363cc902b6ad4b0ef063e31c9ba8ce97f1c1e80438de04a210225f05439216512ebb9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274249, "uuid": "c4fb2f4f-9f54-4cd2-bca3-ec15526863d9", "value": "T14A55338A817C19C84F7D0B56B7FF865CB10A8EFC100218B36B5A44EB793D7DBC26459A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274249, "uuid": "eb54dee5-fd57-4222-94c4-3a7423745d45", "value": "24576:ZPsS0kJQHhpj8oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRN:kkJQr8oZ9bq+MmMEL+hcjXHC/wnwdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274249, "uuid": "050c9862-a869-4aae-8063-f72748ffbc94", "value": 1394813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274249, "uuid": "f316cb53-83f6-4898-a3fc-f846cedc1f68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274249, "uuid": "107e5ad7-2da6-42d3-a4b3-cd5e48874a56", "value": "1856dbe716380f07a04e902147bd84c30f7e9e6d55ded98bc9e642af1f431992.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43fbe89-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272215, "uuid": "af4ea22e-43f6-414d-99c4-ee4e115c973d", "comment": "Malware payload", "value": "7768c9e0c5661ff406cb49b7c7a8dfd9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272215, "uuid": "8d11643e-66e7-4943-8d47-9a09bd5cbc34", "comment": "Malware payload", "value": "18a4841bf701ac151c3213ffac4e1317227d1bd0152da8b2aabca30b85cc74c3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272215, "uuid": "cb4ec9f2-b0e2-4ed7-b050-55403596172c", "comment": "Malware payload", "value": "c4c10a01a4fb3c143350bd94ad510533fb88ffc7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272215, "uuid": "c1b6562f-6d8d-423c-ad0e-b0123dbfa726", "comment": "Malware payload", "value": "d5062d756829afcbd24b69f3e8aafdecd6ed3f8089983b751d89d23224582cc8f73b734a306c28e2837babf3eb725e50", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272215, "uuid": "1ebc66f5-1f76-490f-83a6-ef9e6c3460b8", "value": "T116B423CD64BED0A87B658DDA9FDCBFD30CFC403A6D7526F2A51C1A13A1C400B64E958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272215, "uuid": "a9c67eea-74f2-4631-9302-0715a489d934", "value": "12288:uB/e4pqNFTFbEXkRDoGbDDGIabs/7iiEVwYg2l3/2Ny+:uBm4pgTjoGTabs/7iiWw0D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272215, "uuid": "0426b978-fea0-4bdc-8309-eaa9effd7aed", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272215, "uuid": "5d390330-4589-4d21-968d-64800afeb65b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272215, "uuid": "b09a3f6a-1675-4842-8d23-0f72d7e848d8", "value": "18a4841bf701ac151c3213ffac4e1317227d1bd0152da8b2aabca30b85cc74c3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63b097d-c14d-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791267520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267520, "uuid": "ac638d7e-54a5-403f-81ae-fbfd520a97d7", "comment": "Malware payload (Mirai)", "value": "cf37da29fc60c20ac4f7eaa90e398076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267520, "uuid": "d38213f4-7215-4910-a0c7-da70b0acebc1", "comment": "Malware payload (Mirai)", "value": "18a6d56d3e50136ad04d500b43cfa0d67a24574db8794b334ac5afdb4ef2fb1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267520, "uuid": "9f099a23-18ea-4596-ab1a-5dc278e31f7e", "comment": "Malware payload (Mirai)", "value": "9179cae833f8eb50a2092075ece1afb1d6910005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267520, "uuid": "145f8c14-31ed-46e0-b4be-a3668ca56672", "comment": "Malware payload (Mirai)", "value": "8a63e2bc77f0b79514b4df324adbfe47bfe358e8fa9edf7e33f07945ad769d55d62d439ef17e1a04d27f1004951e4b87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267520, "uuid": "9158cc84-afe4-4b3b-be21-bad403370325", "value": "T16EC419A6FD41D991C1D42ABEFB5EC2C833070379C3EA70429D06C72569DF69A0E3DA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267520, "uuid": "c6158ff7-3604-4130-babc-484705e2a5d1", "value": "12288:Ua/fi3TlmcLUjiKvO9pRJ84WER91XOpMyr6ofCNU6vQyq:Wbqanrof2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791267520, "uuid": "3310aaae-fd98-4131-9dd8-fac87fcff298", "value": 572892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791267520, "uuid": "58b2e03d-a909-428a-9f58-bafef5b4e674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267520, "uuid": "e61ae540-791c-495d-98eb-9ff187db17bb", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef57fed3-c1dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791329007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791329007, "uuid": "3ab0e38f-325d-4eff-a238-cc30f27e9848", "comment": "Malware payload (Mirai)", "value": "b440de65a0707fb9e551048b50a5f341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791329007, "uuid": "394d7e52-96db-4fbc-beda-9eac7363b03f", "comment": "Malware payload (Mirai)", "value": "18cf4d150e2e3826951ef827095803a3ccef4e15c552e8f96340a025f73c501f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791329007, "uuid": "07bbd8e5-a8a9-4d6e-8195-d3c512915cda", "comment": "Malware payload (Mirai)", "value": "6d8cee706d5a9c72b564389f0632e610a8129a72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791329007, "uuid": "73a82afb-68a8-4062-b599-c2607e3d66a0", "comment": "Malware payload (Mirai)", "value": "dbd3dd82093310bc89333d7fad95d324548626dd5c3c9a7bcf73c7e6834711664678ab08755448ba0d1b980518965eb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791329007, "uuid": "f2f7488f-595c-4847-89f8-376e6b1218e1", "value": "T18A357D1AB2F3F6BCD007C0309BDFC6A24531F07569312D7B26C49A392EA6DE51369B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791329007, "uuid": "964ca9b5-09e4-4020-989f-9aa2a7b0d918", "value": "24576:8C0Ka4rydaCQEJJ1OENg3VNeqFStCwuf36INstWo1:IOENg3VSt60t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791329007, "uuid": "5a5b0e92-aaed-40e1-9227-6c04b2ef4abb", "value": 1090592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791329007, "uuid": "b57f4b06-3113-45fe-a423-8d349767d41a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791329007, "uuid": "743857f1-6f37-4a2d-b83e-783015d9cdcf", "value": "18cf4d150e2e3826951ef827095803a3ccef4e15c552e8f96340a025f73c501f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cb0beb-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272638, "uuid": "69b6fe74-9d71-445a-8f20-e7125f64ba0a", "comment": "Malware payload", "value": "ef644c43e067634e4a5f1eee52f21b7b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272638, "uuid": "87517d22-b858-4e18-9710-c083c8b2dc24", "comment": "Malware payload", "value": "193eb9961dc61caf61456a96794894eb44d62ec12489046cde71e2fb78a70c68", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272638, "uuid": "777fc746-36a2-4054-8260-27b3830ea471", "comment": "Malware payload", "value": "b4e8c2f6f1fccd31b55d777aa7f3570d1990661b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272638, "uuid": "767e1198-3f93-4002-9689-9893b3f1a829", "comment": "Malware payload", "value": "c86d8a9f8c2022b484da5b49741e7eafa51a5a9a0e71c60288f9e0d30b76d4f3f6618b23dbc5b32fa64a926c0f85a762", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272638, "uuid": "49a99787-738f-43eb-ad5e-80f6ae2b171d", "value": "T1BDB423CE5A286CAC5BE85E834F5DBFDA2CF8413F862411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272638, "uuid": "9e099ebe-6a26-4080-9938-b988999bf4a5", "value": "12288:rGRl4nbDDGIabs/7iiEVwYg2l3/2NHay+wK8q:TTabs/7iiWw0KFxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272638, "uuid": "80374d62-2889-4b28-99ee-2ab143bc8f8c", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272638, "uuid": "e83c86c6-cd90-4666-9ff5-cdca0845ca11", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272638, "uuid": "88b7b1dd-eec3-47c0-afff-c7887b850c28", "value": "193eb9961dc61caf61456a96794894eb44d62ec12489046cde71e2fb78a70c68.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c7f0b4-c163-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791276718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276718, "uuid": "0c87805d-a1f0-4383-96ca-519553dbca1a", "comment": "Malware payload (RemcosRAT)", "value": "73de7ab8214a9b4d01051bb5a85fa936", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276718, "uuid": "82abeeb6-858e-46f7-938f-3cda0b5bfbf8", "comment": "Malware payload (RemcosRAT)", "value": "198f20ad3903a5eabfc6a00e9826e68246aa2194c30d505ec5bd21359124e0a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276718, "uuid": "dfbc6536-e7aa-41ff-a58c-732e54fc1567", "comment": "Malware payload (RemcosRAT)", "value": "7d70310f4ce44faca4cce443628155dd6b3e6779", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276718, "uuid": "409f9e8e-b431-4580-8416-95bb7fc45e83", "comment": "Malware payload (RemcosRAT)", "value": "484467a51e2f6f03a384658a58cdebcd9bf9fbfa25b08e0a0c373916de8b46b8847c5b07dcd9264635bf1d58958aff4b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276718, "uuid": "a1f6d163-737b-4887-b934-5a84345f5b53", "value": "T1E126D67E13459632662E9B5C9136CD20958F700329C5CF3D31EDB6087754E2BB3AEAE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276718, "uuid": "635c8436-1cde-41b0-a62a-28585fab5877", "value": "98304:++V8fWfgYyRPy0k4wwNC8Jd23TkOg9M3MAr8j5AhFUFF4NSWf+RXnMqLkxisVPlj:++V8+fgYyRh33N9vNOZMAY5ADx/fknMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276718, "uuid": "df845c5c-667e-4680-bf31-ef634b8a6204", "value": 4646930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276718, "uuid": "c15cff64-a5b8-48c1-9928-d007384c4568", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276718, "uuid": "e223003c-864d-42f1-ba96-52def161afeb", "value": "SOA7No#1666_Approved.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6d496c-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270918, "uuid": "4e1522ea-fc56-4102-b818-19ee628658a6", "comment": "Malware payload", "value": "7787a9ef6e37dbac9586279893640e0b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270918, "uuid": "6a1d1ac2-0fff-47c1-b5f8-bc2c8e1994d6", "comment": "Malware payload", "value": "1a3cc441bcf65ed0953adcb91fa8efb1bad419436587fdb1c79049cdf46eb0e2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270918, "uuid": "ef4a8c78-7741-4380-aa1c-88dc4347e845", "comment": "Malware payload", "value": "10b3e86df77c60184af2fb7d250aab45746f29a1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270918, "uuid": "794177e1-4501-4de4-a6ee-a7564d16c50f", "comment": "Malware payload", "value": "369f90213319fc34b73759acb9f5b72f54414e0b7670ebf3aa6069b2f62d7c401fefc6cfdece205e22991c751d857011", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270918, "uuid": "fa766ff5-193b-4aad-a516-0e68006a0c4a", "value": "T170B42369227F71900C7543A84B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB195638E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270918, "uuid": "62069e5b-b653-4c3d-9930-8c90726d1654", "value": "12288:87JZAaFpeHqO3g/ALyYG0ZaDajTCXMO8xzDOe3WU:4LperA/f0Za6TCXKBxmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270918, "uuid": "d8b53b99-3936-4120-9bc6-f1382d59c3c2", "value": 542164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270918, "uuid": "a494f4d0-6cc9-4773-a688-65bf812668b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270918, "uuid": "b04fd925-ebf0-45a5-af15-389362394439", "value": "1a3cc441bcf65ed0953adcb91fa8efb1bad419436587fdb1c79049cdf46eb0e2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383d6e87-c18b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791293911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293911, "uuid": "71d44b62-52d3-4895-98de-0d5633082651", "comment": "Malware payload (Mirai)", "value": "d1d4cb234bb9a5dc363db68feb6d9fc1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293911, "uuid": "dece55f4-daf3-419e-9e58-bf7e64e6e3ac", "comment": "Malware payload (Mirai)", "value": "1a6a982455bc4a6b95958b1d8ea3b0f227688312c6521d9812f97d30aac18ccd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293911, "uuid": "1424b833-fe7c-4d76-9e5b-3c6c9158e1b2", "comment": "Malware payload (Mirai)", "value": "4feb3a13a2b7cc324a195816d7f9823872ef2ae5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293911, "uuid": "1a7c6834-8a36-4ca1-9425-098f91ea6a0a", "comment": "Malware payload (Mirai)", "value": "dd2018e3142ae01f034678f6485157a2f8c5f9af02ee63f8fcc3e4bea10b96da17abcc41ea84c056580ffb1cb9e93cf4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293911, "uuid": "f274fa5d-7a82-4cc4-b22b-31644ac55b58", "value": "T19F41D0C7115383342DD5AD3FF06649C47A84E4B36EEB1E845A8738EA468EF4838F0E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293911, "uuid": "754b2529-5eed-4dec-8c82-fd53ac5ad734", "value": "24:vPO9seaIOS/NCoOSrnOS+jOSRbOSAOScOSfOSqCQN9Ol:vP14R/jRrnR+jRJRARcRfRqNN9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791293911, "uuid": "e1c182f5-310d-4c4c-bd8f-0acce5992549", "value": 2129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791293911, "uuid": "c630098f-fd91-4573-a26c-c176ef2e1078", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293911, "uuid": "cb019153-9424-4125-88d6-9a67b0ee35a1", "value": "87sbhas6as.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879eff08-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303063, "uuid": "37d5718a-a49a-445b-af4b-301e9f75607e", "comment": "Malware payload (Mirai)", "value": "33811cdbaf844af0a418ae5dd64aa834", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303063, "uuid": "716ed2a3-0cad-4d03-8ff5-f7a22af25557", "comment": "Malware payload (Mirai)", "value": "1a8ae9cd2aa187ca77164ca941e42c90695dfbe3d32b83337968e5a3d8b5cdbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303063, "uuid": "11912368-89e8-4f18-9a42-51e8c235f7a3", "comment": "Malware payload (Mirai)", "value": "f25774a48f35f38ae75a561b9bd5b7d7acdff760", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303063, "uuid": "2b786226-46d4-436a-873a-797e67c246fa", "comment": "Malware payload (Mirai)", "value": "3802e043f5df9a60503610849b4cd901be004be7696b0ff33adcd81abd61850c18fe9f7f4e537b0946c01c3b2886d477", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303063, "uuid": "40107952-5069-4b34-9245-4105d1a039cb", "value": "T15984496EF392D6AED10392720EFB46FC5730A0782730E24B3749393A293A5D1DE56716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303063, "uuid": "ea68fb8b-89e0-4548-80b8-4364f26535fb", "value": "6144:jzCrpyZVIlrUa/xKr6UThdJOJuIS3coagADZ:jO8W+rThquIS3c5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303063, "uuid": "4d3aceb8-1e2e-4f17-ae7b-e61530f4e7e9", "value": 382936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303063, "uuid": "f0f40996-f3e2-4f19-83b9-e7c5b8d2e564", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303063, "uuid": "834a412d-756e-4177-be4f-cbe4f830af30", "value": "flutter.debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c4a209-c1b4-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791311753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791311753, "uuid": "143c5be7-9a70-4578-91c0-4e068af2a25b", "comment": "Malware payload (Mirai)", "value": "baa1855507184d2891e3e00eab97907f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791311753, "uuid": "6db2a146-ba42-4ddc-b26a-9363ed104c41", "comment": "Malware payload (Mirai)", "value": "1b6ad824dde015ae8a70edc40ab20d85148c4377a8b8b0315b80749c3fe799d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791311753, "uuid": "8ee02a24-b0e1-4c58-895c-a3fc09d1b674", "comment": "Malware payload (Mirai)", "value": "994a96a36a3d082766dfad45520d44057fd9636b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791311753, "uuid": "32c044f9-7797-432f-a562-6770c6cdfb2d", "comment": "Malware payload (Mirai)", "value": "e95551f8f13ecfcc58225a47ffa51a085db9c41a1b0b075f306b4a38de75795ef1c3775e1e1c2564626716eaa1ff2eb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791311753, "uuid": "6c44eff4-b27e-4de3-85a9-4cda6b4dfa66", "value": "T117143A83F901DEBEF84BE3BA44934905B530FB6668630632B153BDAB9D3E1C41526F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791311753, "uuid": "a1464d40-5210-472e-9e97-7e982d00c589", "value": "3072:hm1sTg7Bp6KWA0HON+1SbTevqJ3eOlN1mcenalNVHjbifLn2Ps+yoKkH/:Anp6KWKyvqJOOc7alcLngyovf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791311753, "uuid": "51600aa5-f6a9-4867-a648-8930faa37d47", "value": 200260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791311753, "uuid": "cea8e4b3-2b95-44d1-846c-93e52498a3c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791311753, "uuid": "3388481d-a33f-4c8e-8040-14f7964c0d85", "value": "vcimanagement.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f78b291-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270864, "uuid": "a89f29d7-7da4-48db-ad3b-bfe829bdd6be", "comment": "Malware payload", "value": "4688eb13f14ed9f872086b8eeae1a815", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270864, "uuid": "8862fd7c-c428-4ff5-bf62-9e9265ef62ca", "comment": "Malware payload", "value": "1ba1396aac6608a99ebd43501d50eacceeb155ee2fbe9676e5c40a356ac27ace", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270864, "uuid": "a48143f3-1f28-48d0-8401-e5c7d03aba1e", "comment": "Malware payload", "value": "373fa04ce2f6210f9b8832c4f8aa4e7a509a65a1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270864, "uuid": "79ae4bd6-6b6f-454f-94b1-e13059a0db70", "comment": "Malware payload", "value": "2a53a42c709e36635f5af099bbb572bac67948c11bde0753fa9fa290b1a4defe21521db2105e2e82830a73dac41cc990", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270864, "uuid": "e4ef04db-b866-4afe-90be-6e649c6ba19c", "value": "T1A1C42304340741D5835A2B1EAEC4E6E0BEB560DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270864, "uuid": "39ab1416-98dc-4a6b-b3ae-f29cba402ab4", "value": "12288:T6wlOMWROC/FTeHo22Qm7NzofOr68mTeA924EwCt:L4MQOC/gHozN7NzomW8BA9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270864, "uuid": "943d0bd2-8900-4c63-bfc7-c0b76768bc85", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270864, "uuid": "03d52241-553b-4c53-9ef2-3c1d5728cd8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270864, "uuid": "7ae9889b-afed-4b52-80d0-4bb2937ec996", "value": "1ba1396aac6608a99ebd43501d50eacceeb155ee2fbe9676e5c40a356ac27ace.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17adfac3-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263362, "uuid": "927ce027-ea13-4523-8c4f-19cc7a620e81", "comment": "Malware payload (Mirai)", "value": "83bc1d1c89bbf9995bce4f2cb58ed2bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263362, "uuid": "25b852c9-7898-4e92-bf70-9bc81423f6d8", "comment": "Malware payload (Mirai)", "value": "1bb4fbf5df215757d7a6b1f9601515ec4e12a41c4d695e17898793db2e5b38a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263362, "uuid": "76f4a758-cc96-4be2-a131-a1c87f770e14", "comment": "Malware payload (Mirai)", "value": "8cad03474f2a12f1798f9c52ea2ce206d3d24b2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263362, "uuid": "eb86f22a-9b2a-4a6a-a1be-454d69ad8d3c", "comment": "Malware payload (Mirai)", "value": "d5fcf4f6592a2316eaa511f75097d106402b95935918a5f9d70b0329cc22a41dbf3d2ac18e3a3d1fa956cc6dd25d5a28", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263362, "uuid": "24b9a6ce-9d6d-4cbf-9b54-46a770969340", "value": "T142D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263362, "uuid": "15257a73-889a-4780-b185-ebc9f38e827a", "value": "3072:5WbCJEddQ29RHrmP71xmbdspxYNWtrcVhQTv5:5WRjQuRHrmjebmo4trkQD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263362, "uuid": "ee3da81e-c39a-415e-b56f-8c141d75fc4b", "value": 142140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263362, "uuid": "ed7d7d67-2a2b-42ec-b8b5-a24d00dbb598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263362, "uuid": "78742e51-54ac-4012-b744-974415e660e0", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d98a81-c154-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791270521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270521, "uuid": "765af58d-dc67-4307-98e5-22e0e8356190", "comment": "Malware payload (Mirai)", "value": "015968350a49301de42aa5114813b15f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270521, "uuid": "1d10aaac-79cc-4c6e-bf44-306e6b5775a3", "comment": "Malware payload (Mirai)", "value": "1c6a4c08e1d44fa76cdfa97db5970c06c55424c5806ca4ea17bfaac5daa29171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270521, "uuid": "c3e3c5f6-88c7-44ae-bd51-ec756183a41f", "comment": "Malware payload (Mirai)", "value": "c3c4e89503c431cf42e244ad0a4d7340b8a1f062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270521, "uuid": "c92faa1b-84c2-461b-860e-cd72054caab5", "comment": "Malware payload (Mirai)", "value": "88d5b80e4550db018b1b399a554b0737df6720790393462186d85246ffb21007d9d000dba96919a69711974679948a70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270521, "uuid": "8ec931cc-fc25-41a5-be9c-47dd7034f4b2", "value": "T1E3D318DFF2D0CAFAC446A1B1DADB8553E412FA380622E20733D3FD652A2D5C85D592C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270521, "uuid": "2a26d4e1-49af-437d-aaa0-452212b778ae", "value": "3072:9nQpvQDG9HBykwzITRXsCrdrA8Ej8NRq6MlDbcZ4crd7yh+:xQpvQDG9/wzmxrdML1zlDbcZ4crd7yh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270521, "uuid": "c73ff20d-0870-4e59-8267-76ebd999657a", "value": 131803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270521, "uuid": "8f175b83-3f4b-4e0d-9ae7-c7f19e985860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270521, "uuid": "8f4aacf9-3779-4a5f-94d1-d420b80660f8", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213fe567-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273686, "uuid": "36a73b55-942b-4342-856a-1d8367ca25ec", "comment": "Malware payload", "value": "76c00881bea952a334d6854080ca966a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273686, "uuid": "a077682d-ac5a-4f88-863b-5d9c39dca255", "comment": "Malware payload", "value": "1c6db8cce3b9e1c2d09900cbdcadebc90cf656ae6a087686ce5ca365c24e6e68", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273686, "uuid": "0c36a7b6-f85d-4eca-a807-e1ac54d1eaf2", "comment": "Malware payload", "value": "8533ae4998fb3de2edbb3c5b0b422179c6ebf728", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273686, "uuid": "cdecca43-6ad8-46d3-8179-ab7e24af6416", "comment": "Malware payload", "value": "97dcfd6099c2c8b2276417e5600c910c48604978df71e77c46c7c9c7bacd66883652c4abf38695426245fd7f7084d1bc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273686, "uuid": "cc07f827-6c54-4c08-b001-0c6aad20c8dc", "value": "T1BB553387C17C18C84F3E06D7AFAF995C72288EFC100204766A6618AB253E75F87795DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273686, "uuid": "67c6c115-1b26-42a0-b2f6-3276e1533cd5", "value": "24576:2MZLoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRp:2MZLoZ9bq+MmMEL+hcjXHC/wnwdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273686, "uuid": "8cd6fe56-9a6e-4dda-a72d-62913fd09691", "value": 1394468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273686, "uuid": "022c6035-c059-46f5-8d93-ffa9fd25e4f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273686, "uuid": "378cdd03-30ca-4bf1-9192-b65890b92c58", "value": "1c6db8cce3b9e1c2d09900cbdcadebc90cf656ae6a087686ce5ca365c24e6e68.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b88295c-c178-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791285890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285890, "uuid": "169158c0-22dc-4060-bb8b-e171ffa0f3a2", "comment": "Malware payload (Mirai)", "value": "5c11d12f42213656f893832fd2e330b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285890, "uuid": "51c83afa-9ed7-4278-873b-9727db211161", "comment": "Malware payload (Mirai)", "value": "1caaf5aa31c374f3935b910e7dcb12508b01cf61a2bf543a51abe484afeb9f61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285890, "uuid": "60a35995-eff0-4f3c-8e7b-13104f7964b0", "comment": "Malware payload (Mirai)", "value": "caf52b6ae86c764a6712792248833f1d234c1759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285890, "uuid": "66e0487b-f335-4aa3-bc81-be4fb113e41e", "comment": "Malware payload (Mirai)", "value": "0922404ff5acbb28cbf8132f9db6690492d8baff048402df78e0202fbef40e1219568c04b4780c2a6cc2208d861af53f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285890, "uuid": "93b01544-7cfc-431a-8718-242f4df62537", "value": "T1CEC36C86E753D4B2C4530B7012ABE7748631ECB2132B8E16E768FEF55E229C2B50971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285890, "uuid": "043bb778-5b40-4463-b44a-56bfea6b1c1b", "value": "1536:jwAUvya9mUst+IrwKg0MtUP31M/ZojMzHdkPHYPWs7wki7ruIfK14k/DRO8cff:jwHvH9mUssIrwKnqm9PYrslY4kDRO8cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791285890, "uuid": "cb442805-6fa7-48f2-8c95-4920508a4a60", "value": 124938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791285890, "uuid": "eeaa432a-5b50-445c-a41f-1b0a69140130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285890, "uuid": "5aa083db-e6a0-431e-8e59-e88e965ee2a0", "value": "qv3.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9dd46c-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273359, "uuid": "f90b9df8-d58d-4116-be01-fada7158589c", "comment": "Malware payload", "value": "c2d0b88cc02d79eb3655dbf354b9cc1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273359, "uuid": "63b09a99-1f68-4002-a2c5-05acbedc3542", "comment": "Malware payload", "value": "1cfff1adea48659bcda84b5d12bfc3e462e918bb56fa66501e4f749654220097", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273359, "uuid": "aba79033-665a-4ee0-b147-ec90b4cc6a15", "comment": "Malware payload", "value": "f57f3c079eea680a1b68add02bf2e7ccbbb47d92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273359, "uuid": "a4c84812-9a1d-4395-8fe8-41650a6ccbb8", "comment": "Malware payload", "value": "e0ab69fe2643f77639dc9b2bea501cea24f7e667a335c3109c6689ee2fa640fe82d79e8b4c16ea001942c10e2b1b92f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273359, "uuid": "3f561069-72e7-467e-b194-cd71133cddd9", "value": "T1AEF2352011DB4687DEF1E6BCBC9C39820F95F596165D70A42B6246CD0239EBCEE9233D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273359, "uuid": "9eceabb9-3e79-4335-bc66-7c7f6767a5a3", "value": "192:8+oCKqWT/MHksMELPm1FlZ0Wz2LChjXMts3ZP1gaZRgfgLL:/wbAmNKqXMtEZ9gaZRgfgLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273359, "uuid": "44b6b465-7cdb-42f6-8061-ef403c77aecc", "value": 35094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273359, "uuid": "c0ba70fa-e3a5-4f40-a797-04b759d18e1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273359, "uuid": "eb72c207-bd39-4656-ba9d-31f2739ffe88", "value": "New Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29c32e2-c151-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791269259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269259, "uuid": "6c576622-cac6-48c0-b1c7-36508acfcff5", "comment": "Malware payload (LxBaseRAT)", "value": "efc87cb5eb62e020383fc095b9821a6c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269259, "uuid": "3bfb29b8-2943-4c2b-a15d-a25ac19b7a91", "comment": "Malware payload (LxBaseRAT)", "value": "1d258e3a96472f5f61c417a14799d793f6c67fec04f491ca1f2c4f03376f51c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269259, "uuid": "7127c502-57db-4fb2-80c4-4832064b10ff", "comment": "Malware payload (LxBaseRAT)", "value": "136e1999eacdadb188cb6a43af8f314e072ec42e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269259, "uuid": "32bb7170-20ab-4286-adcd-31006ea47615", "comment": "Malware payload (LxBaseRAT)", "value": "3a1bcc082db5ad043274be746cb0363f6fe66c5e6b77c88eab3d56b5bd1de822d13c42d620e091004fc40839b02578c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269259, "uuid": "c35956ea-e349-40ca-8493-dc1d231acbb8", "value": "T15375375203851BBDF68D0EC9C94B215B20F2D46B7D251298EBB36EE7BD3B9849430736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269259, "uuid": "5e045f3a-990f-409a-9794-72c9ef7a882b", "value": "1536:X81V0XjKdpgKDP0qH54OBQQxyfZYHvSmqsdSrX7vkvHxCtSRkkI3/D3uN/4IBvO5:ePIVpDDKts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269259, "uuid": "521e2594-d9a4-4877-98fa-053b6dbc02d1", "value": 1636501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269259, "uuid": "c7a25e14-c780-4281-8f16-5da84d865738", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269259, "uuid": "63017cf2-6f68-45d2-944e-a75a69426bbb", "value": "POTWIERDZENIE_SWIFT_20261002143700.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25d8d6d-c11d-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246952, "uuid": "c2251f0f-229f-43e5-8bef-4cf7b9b4f16b", "comment": "Malware payload (Mirai)", "value": "13132af2d851f9fda0419034be1f7f62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246952, "uuid": "1718839f-fe73-4388-ab63-7db119a0ae33", "comment": "Malware payload (Mirai)", "value": "1d8a10a86b10aa423254c72d9c92d8b492a665e77e73e3f80c425e627db500bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246952, "uuid": "b3038c51-b5ca-462e-8042-66dd57ec205c", "comment": "Malware payload (Mirai)", "value": "3df53a6f0f77869199c2dc077ccc3b7703c46865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246952, "uuid": "d5dfe915-6355-424b-8b73-159b2612c91e", "comment": "Malware payload (Mirai)", "value": "42f729af1d2c7040c274f8852811467aba4e5b519f08e0bab5f32037156be7b4d8276a82d91024dd7414ad689f1d6937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246952, "uuid": "1973f35d-487e-4bf5-a51a-b748801f379b", "value": "T1D7B46B22E836AF49C122E5B4F871CB781F527C6459472EE9E0A3DAB8C153DC9F6143B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246952, "uuid": "ea8ea72c-e9a2-4ddd-8b6f-3fc66b52fcff", "value": "12288:sUOwgCQyHXWBRnuYNp5YLNly7ujfxSwbByEX9MJoD1TekXvYFt2Qcr:dOWQyYvklHjfxdByE/H41c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246952, "uuid": "9d0e74b9-f644-470e-8677-00563cf7ef21", "value": 518432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246952, "uuid": "443c4841-d726-4890-be4f-b26e9e8259b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246952, "uuid": "21f149a2-a724-4b67-8628-bcf67bf610cf", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a690a0a7-c184-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791291089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291089, "uuid": "ed6cdcfe-0d44-4b6e-9e5e-2030f820a31d", "comment": "Malware payload (Mirai)", "value": "a352186d6c4ca1da5473d7a12e314418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291089, "uuid": "7313c1b3-bd2b-482d-927e-55199434b96d", "comment": "Malware payload (Mirai)", "value": "1ddb2d6a0c7430fc2a2ea5772f0bdc330a454822f5d28721abe3b7ff1f347ed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291089, "uuid": "c4176b6d-db05-4f0b-bc3b-4b393e85d8f7", "comment": "Malware payload (Mirai)", "value": "12e0de7954f30dfd252741055acefd73a21fd2a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291089, "uuid": "9d59c273-0cbc-4074-83a0-d9807a643587", "comment": "Malware payload (Mirai)", "value": "1f722cc60a09bc7d8aa4159d69c59da9330da3c98181c0c0c30f01105ce12f8f4278bc5520e9323df863daf24fdff057", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291089, "uuid": "5fb9cceb-f522-49ec-b4d3-6585c2ceac64", "value": "T1E1834B22BA751D2BC4D0A87A21F30325F2F2478A25AC8A5A3D720D4EBF6565032577F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291089, "uuid": "01cd15a0-4a00-47a4-8090-334ec1a18781", "value": "1536:K+ixvSKCqR38/iFmyrHbQet7DJN95DWx0PSitwN8/RW:pJ93GjJdNPaxpcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791291089, "uuid": "fc033a6c-27a1-4378-9ce1-317c28474a35", "value": 81024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791291089, "uuid": "7083e52b-dadd-4b0f-8ae0-be881383beed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291089, "uuid": "df3da00f-f823-48e5-bd50-ec46d4fa86fc", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268619d8-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272406, "uuid": "740e1bec-be34-4f3b-b68c-117066650df2", "comment": "Malware payload", "value": "df69704f1e6047ca802e975300f7c260", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272406, "uuid": "a7e48cb3-f77b-4707-a6df-d1c3636b3529", "comment": "Malware payload", "value": "1e44f3b081e0c0cf3ba789a13d77d4fb594e8c9508bdb48f46204fa11d207fae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272406, "uuid": "aa60ceb7-56db-40cb-81c1-c3b289ebd0c0", "comment": "Malware payload", "value": "5c8115077bd06428d24427505ad7547a7dfe1300", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272406, "uuid": "680b1501-1781-428b-a5fb-6e4bbbb7b194", "comment": "Malware payload", "value": "75ddabb44e4667ebf19affc1e25bcb59ca232d1b2e47eefad081bb8f75733c910fae97bcbace7c5c3cba8f521105ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272406, "uuid": "4fec68ea-c548-4573-9958-bf8596724bec", "value": "T1B7C423445C187B6C3AF6A0FD2AB65D83631E1DFAF0D23DBEA43484FE1C16264A18587D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272406, "uuid": "807bdfea-9dda-4508-8c81-f6ad124d3286", "value": "12288:ob7TqKR2IkSlQVALUMF2G5SLjrlFlU7ecTUNZhmbs2sYbl7y:e7fkSlQVAIMF2SSPrlFYTU3hVYbl7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272406, "uuid": "05a6efb8-d0b9-4ae3-bb67-05c974c645c9", "value": 584990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272406, "uuid": "e602ae51-85b3-47ed-b2c5-8d28e77f7f36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272406, "uuid": "02223b88-1082-4cae-9012-182eaa14d394", "value": "1e44f3b081e0c0cf3ba789a13d77d4fb594e8c9508bdb48f46204fa11d207fae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8adc07-c120-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791248178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248178, "uuid": "73b49a46-d337-451b-9711-dca1ea7c0e09", "comment": "Malware payload (Mirai)", "value": "99562c225c9ab6243a0144fb91d83d1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248178, "uuid": "4c43a6ad-d486-47cf-ac26-3fcdcb5c5a4c", "comment": "Malware payload (Mirai)", "value": "1e637248e6454bb6b6aced6b2aa99901238f9e22c67ce83a3090df51425ef693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248178, "uuid": "ef322281-46cb-41a8-b9f8-713577897381", "comment": "Malware payload (Mirai)", "value": "644860dfd60bd35dd7de59a9e760fa230bc7c601", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248178, "uuid": "77de4a81-b92a-428a-9b87-d9d5a83a33a3", "comment": "Malware payload (Mirai)", "value": "babfd01020aeccdeffbba8760326e169aa17eaa31caa3aed7c3ac28932d1cb9045d70ed9e0007adde765f7fbdf912ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248178, "uuid": "78e83257-b260-468e-bfec-519e9d2e72bf", "value": "T1BBC49E2399766F95C4B7C1B4B4B08F780F52A89642EB6EADD5A2DDD18447CC0F22C3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248178, "uuid": "ea9527c8-3002-4f47-a975-d1f21b9fc48a", "value": "12288:OSwVUctg/GmybMrtDKq/w47bWUVvg86RFx3Z:OM+Lkce7jeFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791248178, "uuid": "cba48117-fa0f-4a3e-bdb8-5c25ce0c7e5d", "value": 589608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791248178, "uuid": "b5505d15-fa4b-4439-9a43-b21b9ae0a6d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248178, "uuid": "de197d7e-683e-4fb1-bec6-c92d564e7df1", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9e6c3f-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275019, "uuid": "19688baa-bd27-48d8-b06a-a680cfde27be", "comment": "Malware payload", "value": "3472606a3e6857079804074b346722f7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275019, "uuid": "66531456-c603-491b-bfcb-701d74fd18bf", "comment": "Malware payload", "value": "1e7e2e4dae5e014323374f89fe5f0d05ee8d7ffa5b1b0293f65a944cdbb91078", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275019, "uuid": "59615a24-83f5-42cf-8881-767c0af61b3c", "comment": "Malware payload", "value": "ad447a611846bc2d29ad8ce9f5dc93f1e6d512fe", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275019, "uuid": "e179c8c3-8210-42c5-952b-0d239ca418cb", "comment": "Malware payload", "value": "bc1d0c54217b147ab0cffb91dc2d69b58081f76165597e9561a5750d9d0c958114970296e40b54e4dfdb6826311b1343", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275019, "uuid": "27a2b62d-09b9-4fa2-b5f2-a002abe59e1f", "value": "T11B553397813C08844B7D0A6677EFA5AC72058EFC20420C676B6A589B213F79FC77496B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275019, "uuid": "62faa630-194a-4799-b407-948cc7a289b9", "value": "24576:SodRumsoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRO:9YmsoZ9bq+MmMEL+hcjXHC/wnwdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275019, "uuid": "1d1c390d-a64b-4df2-bf77-9dc42267aa8d", "value": 1395127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275019, "uuid": "f54f6d52-cf26-4964-863b-ebf942224c1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275019, "uuid": "d76a6c83-7372-4053-8d54-c0866ca453a8", "value": "1e7e2e4dae5e014323374f89fe5f0d05ee8d7ffa5b1b0293f65a944cdbb91078.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ccf485-c14f-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791268169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268169, "uuid": "91558512-d4fd-4889-b227-866e5bde8514", "comment": "Malware payload (PureLogsStealer)", "value": "02232badffa5deee56652903f339c473", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268169, "uuid": "af160bf5-bbce-4635-83c6-7d954a131f36", "comment": "Malware payload (PureLogsStealer)", "value": "1f9a1aed9b76309c3d210c8ac0a88ffcc6dab5c4cf5de85ce4dcb1e371c741cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268169, "uuid": "4b45096d-cd77-4e5f-b7ea-8d609379cf3f", "comment": "Malware payload (PureLogsStealer)", "value": "fa38ed899b29240dec7cccc7bd6fe3e3bc3aef5b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268169, "uuid": "e6fc3250-8bb2-4848-87b4-0c81fd12f01c", "comment": "Malware payload (PureLogsStealer)", "value": "d843e2c222c5e67270f9f8038324ef29dde90e61fbea76f3dbfde0deec91c031525120b798f98f4352d8479ddfb4c6c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268169, "uuid": "a72f04fc-9f1e-4afe-a249-60a31a1b52b3", "value": "T12E6522483AE6CB24EC7C97483F1B8E45D2F01A8315ACDD69C1498E92E76D782C0F9E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268169, "uuid": "6297ce93-bf0a-4939-bd82-ced0a19307bf", "value": "24576:z8xwv0Jm7LmwO1//eG7lVCqVTxnwlWzEsnD9p2UgbjtS1xNZHMHU/w/tnQAEM2SE:z8xoHoZ/ZVpvjzEe2HSdNMHUatnQHosN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791268169, "uuid": "0ff1c4cb-5a9e-496b-8380-257ff7552318", "value": 1513474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791268169, "uuid": "4cb6e20a-5990-471a-a66d-f22c9bc13789", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268169, "uuid": "5b228d99-f592-4dd0-b86a-0c3f744679c8", "value": "Inquiry for Quotation-D2G Group.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea12868-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791273279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273279, "uuid": "2adb985d-34b6-4ef2-afcb-16c2c956dce2", "comment": "Malware payload (AgentTesla)", "value": "646aba6a4d0afb67c5524f95a49e59a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273279, "uuid": "95fdfdbb-62e8-443b-9c41-b928e268e5d0", "comment": "Malware payload (AgentTesla)", "value": "1fdc86a58e98b3b3611c14f36b0864866e4a62c004daa5d3f741eb64d6c0f0cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273279, "uuid": "3eb660ea-65e9-4abf-bf80-2fdc903f01d8", "comment": "Malware payload (AgentTesla)", "value": "5729e6250eac77c8a0308cf5582e43d4d01440b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273279, "uuid": "ba45860b-9c7c-4967-a3bc-8ab9fb6094c5", "comment": "Malware payload (AgentTesla)", "value": "3eb42073cb6fb03c210013775c34e3c251c3391833e165fcb40259482d5db8e1d2292445a4ba7fa49186103498e475f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273279, "uuid": "4c2075d1-ce60-4dca-b417-fab5b0b7a477", "value": "T17B92A9404A81749497776B79AB2BA8D4F37B49AB0194490BB82CB440AFF1E1CDFE4DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273279, "uuid": "d95fbfa9-7c46-4c28-9356-9526674fd1a2", "value": "384:d/H8XuRuhYmU+mgZJil6BOZZz+srXFFnEBi9DVCLFJXPOQDxfH3qcLVbtVnkq:d/HKuRuhYmU+PZEl6BOZZz+srXF9EBiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273279, "uuid": "c99e175c-f0ed-4917-80e5-fe536eb22540", "value": 20665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273279, "uuid": "8e877f54-397d-48c3-8e31-80bf2652d885", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273279, "uuid": "771befc6-807e-4893-ab7d-fa1e21b2bcec", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fab20c-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276004, "uuid": "1211d242-00f5-47e3-a671-b7c873bea8bd", "comment": "Malware payload", "value": "dc49af2c34fe7d602eb692790e18689c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276004, "uuid": "4695509a-3f82-4611-92e1-ce5464b411c6", "comment": "Malware payload", "value": "1ff3f430a858b520771aff80e25409778109197d68e8b24f63100c30bef4d48b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276004, "uuid": "81b5df35-d844-4f23-874d-9212ee2780ff", "comment": "Malware payload", "value": "ccb9a3bff91812df13219612304448e3dc687e03", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276004, "uuid": "ccee169d-cc57-4a90-badd-b6bb7c43d4c3", "comment": "Malware payload", "value": "526eb814636a13af38c77f39a2e68f514c63fcd02c77deb0abd1213cd2ab9fd9c6ae2cd1860a7adbc3196c4835aedf86", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276004, "uuid": "75d4ba91-8523-4c19-8cad-644532bcb078", "value": "T1C4C423B7179AB4897503E3E4814C6D94C9AF20D957C3436ECA1E2693F5BE247FB2009E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276004, "uuid": "6676bb4a-7d06-4061-9135-65ad0536e9ba", "value": "12288:IeElNtIBB2gX3U5VA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9N3ezM:IeSIBBfHTm6Jj6ESfUxZ91kmY/9Hew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276004, "uuid": "d6082a55-6250-4231-8a82-e756fb22228d", "value": 584435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276004, "uuid": "36a96ed6-2eed-42e5-b1d8-6ceda59e257a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276004, "uuid": "1a34ff23-ca20-4999-a858-e1992cef3b55", "value": "1ff3f430a858b520771aff80e25409778109197d68e8b24f63100c30bef4d48b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebc10b7-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271964, "uuid": "8e71f0a5-f243-4c36-86dd-8d58389117f5", "comment": "Malware payload", "value": "726fe64f28e5c1e23c15b2b559c98a44", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271964, "uuid": "ba86e67a-6274-4037-9543-72b85d187ac5", "comment": "Malware payload", "value": "200e005465cfb5edad2b8c14be276e2bbeb91b01c20789d499a62b82400c09e9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271964, "uuid": "d07ee078-d899-4b35-8967-28addcbfd9ca", "comment": "Malware payload", "value": "b2e4728694b59e55b6644ea489ef5d2468a9a272", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271964, "uuid": "71e1a235-6088-4d58-b656-3b8afe5144f5", "comment": "Malware payload", "value": "7b84dfe8e3d69f5c84b9e2af00dae7e20b13933cde191740ee7eb6938ad3fd6941009c1dec8efdb894e4cfb77ee4b3df", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271964, "uuid": "192b7b71-fdcb-48e2-acfc-dbb08e24b376", "value": "T189C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271964, "uuid": "b4dfec89-7009-4c7b-be2b-ec5c93e39724", "value": "12288:7+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2by1H9I1P0QKw6FEF:7+QqldA/TSO713u7xn1H9IaQKHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271964, "uuid": "5f41369e-7f5d-4b2f-b30a-fb1a2d1427ac", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271964, "uuid": "940666a0-e07a-4708-93a6-9d9e9822816a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271964, "uuid": "18b6be36-022d-4359-bf37-581b506683fc", "value": "200e005465cfb5edad2b8c14be276e2bbeb91b01c20789d499a62b82400c09e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af251d7-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273380, "uuid": "b0fb04bb-ce0b-46ba-98b8-c043cc9fc71f", "comment": "Malware payload", "value": "8394cef148f36fd25664db3907611010", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273380, "uuid": "4bef0f6a-52d7-47a4-b6c5-eba67d11765f", "comment": "Malware payload", "value": "20545dd3f3aa1c580c21df9187b7d77087635c3df8ae5c4b79e025ac452f0245", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273380, "uuid": "378560f3-09e8-44c4-8243-867a22820df4", "comment": "Malware payload", "value": "de5484cdfa3dd6f7c62611704a62ebdd07e2614a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273380, "uuid": "a60df1c7-b048-4aee-b6b2-0008b3342a04", "comment": "Malware payload", "value": "792b33329163493ba89d7cdeedc39a9b3a544e2bc4737d3d30604242db9105c6fca1ec413b3ce7f9dcf99da0b1d9fa29", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273380, "uuid": "b6deefbd-ac62-487a-8f44-7213155f6775", "value": "T161A42394C1B857962448E3F9017F19AE5F302CB6CA3DA78E901FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273380, "uuid": "8c67c228-65a1-47d3-a812-cb64397bf671", "value": "12288:YSCDe0U+m1V6ECbniSPfS3e2R3feeintFckpTsuC8hH7:YDe0wUTiSWzeeixsP8d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273380, "uuid": "37cc915d-1ff4-4374-97f0-24c090cbf8ee", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273380, "uuid": "e6e8f5f5-57a3-45c7-8340-769a7cc1b3a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273380, "uuid": "99ac22d2-0ae4-41b0-bf60-43f1c2640f0a", "value": "20545dd3f3aa1c580c21df9187b7d77087635c3df8ae5c4b79e025ac452f0245.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a438c4-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270680, "uuid": "3e950125-2fda-4249-a5ed-5121b9766f29", "comment": "Malware payload", "value": "3460b39791fb125e51f827c77350b9d3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270680, "uuid": "1ad34aaf-507e-4e5e-bf94-d57eb64b9afa", "comment": "Malware payload", "value": "206ccd73d229a42a636c0fb3f717ddab35b055b7c1a16c664fda2ad131cd4584", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270680, "uuid": "4bdbebaa-2192-402a-ac80-d943c172d5fc", "comment": "Malware payload", "value": "360a611bbb7560b9d94d505dc09f37107095fe62", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270680, "uuid": "f62461fe-6f60-42a8-a8fe-ab0c673ca656", "comment": "Malware payload", "value": "02e78e08287d7c2f34ff5289a84248626fd504a257d191b53773beeb0c1b9097d2d8ba1a583b07d48cf474b522b51ef0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270680, "uuid": "082c0f8e-d818-48aa-9a2b-804cb69facf4", "value": "T125B4231EF4D078CFD68ACDA394291C785F6C9AC9CD126B7246C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270680, "uuid": "1acc6cd9-d431-4e58-add7-2b5b3af98223", "value": "12288:FTibgSMFBOBSlqr8Ku7FxPbzJTVBU+8JM9hAC8Z3HVOBRkbKQDiUbpKe:8cSMFYqKkxpTKJM9mCw3HVOMWAPbpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270680, "uuid": "ff1aaabd-de05-4b41-855c-5ab4cf5bb5f6", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270680, "uuid": "d7667542-18ef-4b21-9c2d-165834d0c6f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270680, "uuid": "9ca9319c-3b32-42a1-be55-d672dcc33eab", "value": "206ccd73d229a42a636c0fb3f717ddab35b055b7c1a16c664fda2ad131cd4584.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f16eef-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "43af58a6-06ff-47f1-8cf8-875ef29a1bb2", "comment": "Malware payload (Mirai)", "value": "5ab2d2fc9951294d511ce3b633524ffe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "59d3e239-3ece-4115-9005-feeb18111842", "comment": "Malware payload (Mirai)", "value": "209844df102aea0ebb0c185029f2eaf8f89e9309bfdc1127594b1761519f89a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "1cefd408-1889-4aef-8d2e-dfb00202b00f", "comment": "Malware payload (Mirai)", "value": "af8e5c65894cdce3cca110d96f9573941d6704a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "995e4723-ad3d-4e6b-b26e-5ca1d693c99e", "comment": "Malware payload (Mirai)", "value": "7460d72788f16b7fa883d9b9d48f49f5bff6b52db6cc10bca1c936d981f6666145732ef068729057e041f3fcbef97cfd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "58bd6f66-3bde-4e9e-8521-9b88cb811a98", "value": "T1CBF30745BD518B16C6D262BBFF4D428C7B2A1768D3EE31039D295F60378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "f75854b7-b389-46d0-bdfe-3f74ece5ff11", "value": "3072:smpaNJnxpejYLmzYqNyB6wvk4JX1DRextqziQnS:smpaNJnxpejZVwB6wvxJX1teH+iQnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263361, "uuid": "3af04563-e1f9-4595-986e-e66a1207eb9d", "value": 157400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263361, "uuid": "54ef53ac-24e2-46d5-b0a2-a3272e1315f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "c47695a9-9cf5-4b61-985f-c1d7f374a456", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71e1a5e-c1d5-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791325960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325960, "uuid": "aff8c7a8-8e30-4f36-b6c7-a834f9cd9b64", "comment": "Malware payload (Gafgyt)", "value": "49146711fd692c0855ed8717b11beaab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325960, "uuid": "eb973935-ba47-4ddd-bf91-301022ed5224", "comment": "Malware payload (Gafgyt)", "value": "20d4672f40c452d53b41227f669c481703677e302954c52158515f7003d2fb27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325960, "uuid": "00b49f4b-3576-41b3-9f10-39d705bc6524", "comment": "Malware payload (Gafgyt)", "value": "4d0cc5b0bc1aea41b38d1c2e35e9cf1d0bdc7ed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325960, "uuid": "fcd4fe33-99a0-40b2-b7e4-4fe3041f3a2d", "comment": "Malware payload (Gafgyt)", "value": "a55b0a980765f05c030fb829358a23a4ee156b6dc83a103d9ffee579822825b101a28290ab8b8b29482690bfa46ed691", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325960, "uuid": "adb083a7-7f84-42eb-ac83-c3f205b51f2a", "value": "T1A7E3E5CCFD64476FC2D223BAF74A428F37261A789797F32159A7E9B02BC17481D28191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325960, "uuid": "897f9b80-9037-4c81-b277-7b550e3ef5ba", "value": "3072:qklR8BGM3+mgYwGMyZRgi8KGqiPc+k3WL7tX8h3GbF2lLothTpKkxnwjUly8CTlR:xnaUszTAYowcnaFD6knQCquS5hA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791325960, "uuid": "f26d3220-6466-4d01-834e-4e57437dbbe4", "value": 147864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791325960, "uuid": "15e84c4d-c49e-4976-86d8-2d4300170d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325960, "uuid": "4172a0f4-d979-4c49-8e77-7a596caba50f", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0ef0e4-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288335, "uuid": "d73c8f42-a1cc-46ca-94ac-cca4dca504e4", "comment": "Malware payload (Mirai)", "value": "725a9e7f64c2d8a11637deec39401deb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288335, "uuid": "405164bf-060f-4967-8e23-b21e3ac84e73", "comment": "Malware payload (Mirai)", "value": "20dd1d96761423cc3591d2c4731f6c8e5553e7faee763dc30ea23289fd6100ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288335, "uuid": "e3b971bc-2ebf-428a-86cf-de5280401bbd", "comment": "Malware payload (Mirai)", "value": "7546e4a999fffb01517e8f922c9f3172a4e7e9ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288335, "uuid": "8d869832-d8aa-4a57-807d-0651c8f304aa", "comment": "Malware payload (Mirai)", "value": "115c4bb5db1b02c37b79f79fa8f02e8a79a6a4d92df188fa50d8c55897038ad6e3a92b18186ab1ae1d808f4a2bf73fc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288335, "uuid": "797f4210-8032-45a2-9235-fee5caa78f3e", "value": "T110730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288335, "uuid": "9602f058-46ac-477c-8cd9-f0a7b7c5a6ca", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gppg6T63z5yAMw1f9r/1eUc6I+i3JqwsjAyI:CskiIZJNlDWQpg6Ts4Xwtl/OJqwsjAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288335, "uuid": "7a4fdc24-6d1d-492c-9207-2a2568f87d6d", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288335, "uuid": "589ba7d4-cee7-4cbe-a60d-a487c96cc32b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288335, "uuid": "e8f6818b-6c9c-46bc-9b83-6c53460eca00", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3f6d40-c14b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266455, "uuid": "fab5df87-e38c-4e90-98c3-142833b7aef7", "comment": "Malware payload (Mirai)", "value": "0106008b332c2b4cda59c620560cf5df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266455, "uuid": "390015b6-3fba-40e1-a20f-419e4ce673a6", "comment": "Malware payload (Mirai)", "value": "20e366a0c1d12c747a3e6ba6dcc73ebf369552eba0ed6e28f529202609a310b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266455, "uuid": "64a4407d-aa85-4717-99ae-74616351c548", "comment": "Malware payload (Mirai)", "value": "f190900233778ebca6357ee6c1cb6b76c579119a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266455, "uuid": "98b5834a-1e3a-437f-8b41-f0918536a201", "comment": "Malware payload (Mirai)", "value": "829a09f233001c0e331d7056cc2c53f2e13dcb717d76e28f56c843d53e7b44ba8249a35b849427517849a000ee220fbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266455, "uuid": "bcc8712a-7cfb-4ee3-a351-81afa8ce0a8d", "value": "T109C43D02B71E0E53E2632DF0773B1BE183AF9D5134A59641790F7A8E92B3D31154AACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266455, "uuid": "2225d6b1-98ae-4946-8c24-21ebdacc8ad8", "value": "12288:k0yKsnjz2q/Wh44RPVugzXFvQfRDqn8bjiU:7yT/yXi+8bj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266455, "uuid": "dd18a385-fcf8-4509-ae87-d3cfed8f0c94", "value": 579200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266455, "uuid": "1b4ef034-18a2-40e8-b4f4-97f694cfb055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266455, "uuid": "96b9a4c2-029e-4ce6-8353-08b18ee2c552", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f7f2dd-c181-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791289802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289802, "uuid": "8afca401-933d-498e-ac79-d59304ac016d", "comment": "Malware payload (Mirai)", "value": "6174c6bb1f4fc5aacdcc4595e95f4e6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289802, "uuid": "0a46df78-d132-45e6-a0b6-14980ef73bfc", "comment": "Malware payload (Mirai)", "value": "20ffe59862c2cde57f07a182da74843ef5f05240f884f303893eb51bceb9e286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289802, "uuid": "87a48e8d-fe01-4208-8822-5bbd94b7c6fb", "comment": "Malware payload (Mirai)", "value": "2ec7ed2f5bfcb4cfd4dbf26a0e7e509170e04f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289802, "uuid": "3d82dba9-c56a-4915-a51f-b850e27bcc78", "comment": "Malware payload (Mirai)", "value": "7770dd6ed08f373dcc8e70a8434757f778f32f8f8f7f7c68a8e67303bc87d5b876fe8de94d5922c4ec24daa51d8c2989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289802, "uuid": "5d98f52e-0715-4be5-a565-b2166bbe6e13", "value": "T153C48C07AAF7D9B6F4A240B1115617B50963D937247BD94BDB962CA0EE201C0E32D3BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289802, "uuid": "61f9685d-a8ea-4ae7-a293-e5ef1e684fa1", "value": "6144:0ukDMKClU3EapgglKGJlYq+cOvYS8B3mr5/MJ9eUJbe:LkgLEEybgdvYRAkesbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791289802, "uuid": "3b021d91-bae5-45d5-9908-7ea7feeee1a3", "value": 579736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791289802, "uuid": "6a6b2edb-7950-4e1c-91db-b7b28294a959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289802, "uuid": "78a10e6a-9589-45b8-8685-4b8c23b01eb6", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f358abc3-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274038, "uuid": "c513b73a-460f-40ae-841b-82b501c10389", "comment": "Malware payload", "value": "738f2a027ca3b897e146a92b6d89def9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274038, "uuid": "ce38af12-43c5-4912-8921-51b2f84ad4da", "comment": "Malware payload", "value": "216728d34701ec5517a2ad4bb9bc08bd903bae9ab86181577564a0bd9b11998c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274038, "uuid": "3b1967c0-8acc-4834-8fae-0e43c4ae53dc", "comment": "Malware payload", "value": "383f3e999f50f8b81305aad8e036a8a5ddb28b93", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274038, "uuid": "3d0a5903-94e7-4a92-bdc3-4193b6fe6027", "comment": "Malware payload", "value": "17081e5b0ea678cfc0e827b3e54028fa44eaee89637f2f8accd429e0f98cc96913ca96680b0e815271fdd17f196310b0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274038, "uuid": "d15c4962-2df0-4386-a6e1-3fb3b3a0e544", "value": "T12BA4238274716D06D096CFBDD4C1AACAD0AA023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274038, "uuid": "0f8f1391-35db-47e2-a3d2-c48b7e2ee3d4", "value": "12288:Er06JUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZp:Er06JUv4t1cNk/wjibhv4b2Onv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274038, "uuid": "bec8c108-afbc-48ed-8c53-21d6f6ecfced", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274038, "uuid": "02912051-c64e-4ba9-b8e4-854caf60c269", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274038, "uuid": "85d1786f-e858-4d38-85a0-279892684bda", "value": "216728d34701ec5517a2ad4bb9bc08bd903bae9ab86181577564a0bd9b11998c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae88b1e-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "eacfb2fc-61ca-4633-9b7a-9d64b0b09092", "comment": "Malware payload (Mirai)", "value": "86952950757a26908d0b4ddeee061224", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "7db3d23a-b9f8-420c-87c3-38b6e2c47100", "comment": "Malware payload (Mirai)", "value": "217d7999cef414b8668a8ba9e34f92c6ed288a0cfeaa5b7765d372a27144a72f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "1c2625b0-acbc-42b5-9679-9a91ae307c8f", "comment": "Malware payload (Mirai)", "value": "47e8c022c149847a803f4435dad1adb6f15c711e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "b8a9af2d-71fd-4eee-a88e-408bfa8a389c", "comment": "Malware payload (Mirai)", "value": "ee64a7975794fadf9e501e4f1b66d154cf84ffa83300af116d3c978fb2e7700b11b15f2ae99f135d2643ca4c3318d7c7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "90ba8f10-510a-45b3-8fc4-9ec663b99254", "value": "T1D1C36C86E753D4B2C4530B7012ABE7748631ECB2132B8E16E768FEF55E229C2B50971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "947da744-4302-4fc3-b9ff-e48bedfef54b", "value": "1536:jwA3vya9mUst+IrwKg0MtUP31M/ZojMzHdkPHYPWs7wki7ruIfK14k/DRO8cff:jwIvH9mUssIrwKnqm9PYrslY4kDRO8cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263877, "uuid": "41701300-b467-424c-8a33-fc6711265cf6", "value": 124938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263877, "uuid": "46b64ee8-bdb3-487c-a09e-d27249272db9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "13873f99-11cc-4276-be3f-06eb6109c2b4", "value": "qv3.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c0419c-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271846, "uuid": "e5215a10-6a7e-4dc0-8bab-d645e2e7d83a", "comment": "Malware payload", "value": "afc5a57c04843eb0e90abbfd4a811cc7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271846, "uuid": "4d710f21-d356-40e2-81f6-2ae702b4692d", "comment": "Malware payload", "value": "21b9424748db15c6c99949c6aeaae9d535810b09763d7bbf3cff8b4fa3578042", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271846, "uuid": "210161e1-26b0-4c62-9eb5-34b183b9f776", "comment": "Malware payload", "value": "f483ea62c77793c3f9ed37fad1b05b483c66938e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271846, "uuid": "39f32641-da10-4fcd-9e90-df58531c31e3", "comment": "Malware payload", "value": "6190b71e57e79ff68f20341f0206b22020a583cc44443bcb99c2022a3f527dc87bbf0828d7ef484aa61b86c306aad0b7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271846, "uuid": "8fc5e8c7-d291-46c0-a9f5-e0efa7d0a245", "value": "T145B423F5A7506BCC9D20522F2F4A27CE293B4B41B403C54A1AD2875A421F6FF4E7AD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271846, "uuid": "3550223f-718c-4d65-96f3-8a1ef6d44929", "value": "12288:0BRdpQ73iBVYW7CwvEXgbvM0a4OTHiQIIFzuK9Gd9IU8:0HUw2W29XgbM0azTHiQIouDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271846, "uuid": "e133d917-c59f-4ca5-a0f9-a0e64527c1e6", "value": 542317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271846, "uuid": "6e02ec09-ad58-45c4-95bb-3362c193a4d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271846, "uuid": "4a4197bf-f67f-4fad-a17d-be221907298f", "value": "21b9424748db15c6c99949c6aeaae9d535810b09763d7bbf3cff8b4fa3578042.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c1e87c-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303059, "uuid": "3ca5b376-90d7-4ee1-94a1-479941fc7931", "comment": "Malware payload (Mirai)", "value": "1a4fe1c4b4e6f433832301f0b4cc522b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303059, "uuid": "40b74851-763c-4405-8e0a-469cb7f8de6a", "comment": "Malware payload (Mirai)", "value": "21d212d1abde3217fc6a9dabe0495425d4bf93aa6a00cb8c0a76c8240f457be8", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303059, "uuid": "03e708c1-ea7f-4f86-8721-d886dcb17c11", "comment": "Malware payload (Mirai)", "value": "0d160bbc47c68090a4b297cc37bf369c6c870083", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303059, "uuid": "41018a85-2cc1-42f0-a33b-46409d0714ce", "comment": "Malware payload (Mirai)", "value": "014c4d839c2018da319b9790038b38e1d4b94e2e22a598e72addc66c1b6078a363b0b2178d3070403b6bb26008bff478", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303059, "uuid": "526bafac-3e41-48f9-8f1a-ea6039046c19", "value": "T18C931258CDE6E111C77DE231675AA681020C5BDB33E72C0B88BDFB624FA955D02E83D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303059, "uuid": "169b7c99-4981-4a10-9776-a0beb53a5bb2", "value": "1536:IvkJVJOBquHCx8d18Oh7scJmXwQ9w+6V5mJCw6S3GVAclgAoKgx+VA/KpCrWGDZm:y+JOBquHC4i+scJwwQL6DmTownKDL+DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303059, "uuid": "e002af51-b324-4380-a76d-7eaf14675b41", "value": 92800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303059, "uuid": "be616914-b1d4-49a9-a272-d60aaa6e00a5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303059, "uuid": "ad6acf2d-db5b-49d9-83e4-e3548c51adca", "value": "flutter.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f1674e-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273875, "uuid": "00e5c71b-b4e6-4168-a5f3-1eabec48ab68", "comment": "Malware payload", "value": "23a3afa4bcecddaebdd17b441319eac0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273875, "uuid": "529c7207-f30e-4c51-9748-841bc338a444", "comment": "Malware payload", "value": "21df157b8474abfec196f06dd979c33997bae1458268fa868d20bf6faf01f925", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273875, "uuid": "31cf559c-9bc4-43d8-bbf9-115b46d9a0ca", "comment": "Malware payload", "value": "56902325353218e9dcabc87c926c751e775f8984", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273875, "uuid": "d9d48653-958a-4291-a462-cb3df8141b37", "comment": "Malware payload", "value": "ca94975f4fadf8dab3ee526a5f22cf266513058523c3390972695c4809bd951f5a0422fafd6894bedbf6f4cebf4f9dcb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273875, "uuid": "ddb48424-1e95-410e-8e2b-c9750aba24d2", "value": "T1F8B423F193429E0B23A4DAB457A3DB3375CE7292769D9301CA06CA9F4C7072896DC16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273875, "uuid": "86d03f19-3697-4610-b966-b163bdcb3062", "value": "12288:ukmht7DrvdyiqCCH1oHF9nJ/qjuyFgoJrrzTPwks:ukmHzMPH1ELnKFgoJnnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273875, "uuid": "b323d49a-ca6e-49e8-a8a0-79ed6765a410", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273875, "uuid": "be54e142-3e8a-4ea3-9388-eeade1caab8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273875, "uuid": "f75c9906-0c83-4fcd-b621-fc22f97ff56d", "value": "21df157b8474abfec196f06dd979c33997bae1458268fa868d20bf6faf01f925.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031e54b1-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272347, "uuid": "22c1760c-7b43-402a-83c2-47a00876799e", "comment": "Malware payload", "value": "f03e82987e68e72c9d15e167e29043b7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272347, "uuid": "e4b4e633-57a1-406f-99ca-ea621cdf8a1d", "comment": "Malware payload", "value": "22074a293aad83e7f20341206fee81300182413642b7b6bd0c69abc366c8df81", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272347, "uuid": "4f9886d1-be10-4b9a-9cdf-604d1ae032ee", "comment": "Malware payload", "value": "ff2714975a97daedebaca771824dfea33b5643d2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272347, "uuid": "f8361ad3-eeda-4ec8-8822-8629e8935661", "comment": "Malware payload", "value": "2d1dcf7b1ce4a58bc433b7cf828d2a8d3dfcf3583f3e4bce3f131eb1b1bd5c3d48e86b9eae9d6503ac0452468a2e0927", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272347, "uuid": "deaaf7fe-3eb9-4708-840f-715ed03bd35f", "value": "T116C42304680691EE83D23B6DB34047A0BE7A50D7F70DB2041ADE7AD17DE967077E8A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272347, "uuid": "1ab00c24-169b-48f8-8420-09a8d56b7b49", "value": "12288:ujXIfpqn5R6wlOMWROC/FTeHo22Qm7NzofOrAHmW:CIfoX4MQOC/gHozN7NzomM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272347, "uuid": "321b17e6-c50d-440b-8cde-7cadc845a964", "value": 578961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272347, "uuid": "20097cc3-965c-4df9-ac57-0c8765186b3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272347, "uuid": "28980d6f-f128-4636-a3da-d1ba80367847", "value": "22074a293aad83e7f20341206fee81300182413642b7b6bd0c69abc366c8df81.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb46771c-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272656, "uuid": "f71863b5-1c04-44a4-b4f5-63cd42011c1d", "comment": "Malware payload", "value": "036d004753d92648a9f27441c8afd5b6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272656, "uuid": "e0f14f35-bec7-4096-a3d8-66e9a6ce2ded", "comment": "Malware payload", "value": "22a9fd789c916826759c88cd717da5120f75b30c49c72a82f0faac04ceb5e097", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272656, "uuid": "abee4cef-c2a0-413c-b6b8-0180a93879ce", "comment": "Malware payload", "value": "0fc4928377c48ebf822c577453dbbad3e05f758c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272656, "uuid": "61b5cc53-934e-4f4a-84d4-b2661f6703b7", "comment": "Malware payload", "value": "e72d8a9b397a615cc46625aa6c38fe0dc21fb2de73da473da9020ced6990d0b24168cdcd6621ab7b4a7fe48d7bca0a51", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272656, "uuid": "c8164354-02c6-43d2-9c49-1e2095ecc89c", "value": "T1CA55338AC17C1CC49F3E0A9379FF555CA2248EFC200208636B6A59A7253E74FC7B595B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272656, "uuid": "6482f1de-3f8e-45c3-a3ee-4bd4eb33ffa6", "value": "24576:yPTJsZg554oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRs:ybJZ54oZ9bq+MmMEL+hcjXHC/wnwds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272656, "uuid": "8f2b9b34-e107-4197-89c5-b322b64b8470", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272656, "uuid": "2dd676f8-f1ac-43ab-ae43-c86ed9517294", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272656, "uuid": "010e4c3f-072b-4bc8-8e63-284c7279d41f", "value": "22a9fd789c916826759c88cd717da5120f75b30c49c72a82f0faac04ceb5e097.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53279a4-c184-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791291087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291087, "uuid": "c3aeb019-a39a-4f07-9165-72b74769445c", "comment": "Malware payload (Mirai)", "value": "fadc919c33098093b8fc01ffab4aa74d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291087, "uuid": "8af5a5e9-3e73-4a49-82d5-70c304cea2f4", "comment": "Malware payload (Mirai)", "value": "23548c871c6add3f449473333bfd05f2dd1b0e256caa61dc4c61a80151e05976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291087, "uuid": "689ddeaa-70f5-44de-9353-51a5143618b4", "comment": "Malware payload (Mirai)", "value": "474309e5c2251eb2ab0f504d185b54cc1c58596f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291087, "uuid": "21755765-d986-47f8-893c-2dbb92e952a8", "comment": "Malware payload (Mirai)", "value": "ab5445ce9f04eae077ccf54fbd2dcb84f61a5f718ed54ef3b0cf6579da86f1a990ce6c6a13fdf82c5d8fbb5047a02723", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291087, "uuid": "8a82e882-daa8-4b84-846b-281ec5500ce7", "value": "T12E342B05EA418F53C4932BB9FB9F425133339764E7EB730695286BB43B8675E4F22502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291087, "uuid": "ecd23ae7-820f-4eb1-88d2-2e0fbfae614b", "value": "6144:Al76jsxop5/GP3abjyT/YSSmLlJlsLXRLa0aNBsV/O/gmDo1a+DH:Ah6I2z/GP3aba/YSjjlsLXRLaRBc/fmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791291087, "uuid": "c74a5f5c-652f-4641-b70c-ce3f299c7c80", "value": 234746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791291087, "uuid": "a2b94aaa-b966-4599-bce4-d514d8e0c402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291087, "uuid": "9e804cab-46c3-46be-8c87-136e91f99607", "value": "qv3.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a39e973-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290425, "uuid": "33dc4198-070e-4f9c-adc5-84432a511335", "comment": "Malware payload (Mirai)", "value": "b2ddaee2b34646f5e2bf2d4c26ac6e83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290425, "uuid": "d4879f89-9254-41fd-8bbd-580ac2414bb9", "comment": "Malware payload (Mirai)", "value": "235539cde684dd4b7c8802b1cd4e7b176691d9dd0c8310ff40bf6b6db13a1656", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290425, "uuid": "f053c7a3-b1bc-479d-b75e-a3728a831c9b", "comment": "Malware payload (Mirai)", "value": "649a1dccd6236cb3e405093ebc816c93d8c75e88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290425, "uuid": "84bbff7d-cf7b-4fe5-b35a-f71d44f4ddd3", "comment": "Malware payload (Mirai)", "value": "3d830ec5208530d3ea2b0ffd337aca2ed849a52a8660474263103ef70f0078cb673334f6b16f7d51e727d0aa5dd4ff40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290425, "uuid": "6fb568e5-4bf2-4d1f-9bb7-a669ccf72f6f", "value": "T11CD46C56BD919B91C6D24ABBFBAE4368731757BDD2FF7006CA005F903BDA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290425, "uuid": "8ef272a5-9ca1-4c90-927d-b2436043e337", "value": "12288:Zmw//tx3dBc6u4l93asJavSuGY7KxAOUIG2p9AOI3L4Ke:5//D06u4l93asJavWwOE2p+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290425, "uuid": "435bb01f-b4a1-437e-a806-5234ccc56062", "value": 629864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290425, "uuid": "fb72689d-dcb6-4506-966b-beffebd952ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290425, "uuid": "ee7b8044-509e-4db7-8f5d-efd48d751532", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b929832-c1d2-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791324518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791324518, "uuid": "60c3a544-53c2-4d70-8fa6-84e212e514b8", "comment": "Malware payload", "value": "313d4a5d2675ddc14e593470cd219230", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791324518, "uuid": "0acf4feb-e5b9-4ebc-bd55-49e948b55714", "comment": "Malware payload", "value": "243d7d7c79cccb577e5bc2eade7f2b6d32c502cbd39635f80476610035ae080c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791324518, "uuid": "e509ff99-c59b-4ab9-9fbe-873b0f1c8539", "comment": "Malware payload", "value": "7c6bf881210bdb347fb9e53b7516beae3e138eb1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791324518, "uuid": "0cb9a029-97a4-4082-a5da-4070b8aa2154", "comment": "Malware payload", "value": "8910a30461b7bc6772d29538e4bd395e4769122fa60a2caa83386cf4292948f6cc10a60446b1bc045cbb92451766eb47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791324518, "uuid": "40c02534-58c8-4541-ac02-4d31cc433b54", "value": "T1D131F0E57172E6BBB8A581BCB2879A30380440EB0C44AA7D344E9B701F8D74CB1657AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791324518, "uuid": "49fdcbed-c17f-419b-aa68-14750c430460", "value": "24:ieP4hrSvQu/fFkdmkhIYnSZVcuw5MMTWZVMSq8jO457YLI3cpHq6ps:pQhrSYulImkyYSfcTezfMSq8jJ57YLI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791324518, "uuid": "1021dae9-1bb2-4299-8dad-7d2a3a25a55d", "value": 1469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791324518, "uuid": "7d5fb490-9c16-4013-897e-4b466042cc5d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791324518, "uuid": "f061a106-8d24-40b7-b07f-b5cf0eca95bb", "value": "243d7d7c79cccb577e5bc2eade7f2b6d32c502cbd39635f80476610035ae080c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ff3ffc-c14a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266072, "uuid": "a6c5f1ff-6e92-4674-94de-4f386e556b28", "comment": "Malware payload (Mirai)", "value": "c4afda5a1e29fa3e7bcfc144ff05a468", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266072, "uuid": "0ab29852-895b-4e7b-aae7-a34a9ac41749", "comment": "Malware payload (Mirai)", "value": "24416f1ba0aadf933744db460c9bc1ea86f548b118aeffe128809f121b0e3f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266072, "uuid": "ae4d7329-a22c-4674-80af-e3426fc502c2", "comment": "Malware payload (Mirai)", "value": "3cfde09bc6600b99caa1212053008c3a96565032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266072, "uuid": "35d0d65c-e1fc-481b-9b7d-0a5ceac3da4f", "comment": "Malware payload (Mirai)", "value": "09e4b9a6c8f1f51b59ede2fab50f1893ca96fbb6cbc533c5e298b98186a39fa7abdf24bcb5bddab88f46e5d7e5eda616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266072, "uuid": "ca9cd9ee-45ee-49a3-b2c7-bac9e740b78a", "value": "T176B47C42FBA2DDB2F45200B11617A7615632DC351537D5D3E3E62DB8DA306D08B2A3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266072, "uuid": "2be57a9d-02dd-4709-88f6-06e4704858a8", "value": "6144:r3jRW4oDJCXLCQ3F2+562xmvxUada6q9Q5qGPR5eLR37EA6z5FTgWDol6aWsrCAd:h13FN1mvKoWToWX4B66aWsm60E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266072, "uuid": "8347c36d-b35b-4a7d-8825-b27cbf054d77", "value": 504656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266072, "uuid": "4e3dc896-d373-4510-b8a2-5c9eb952641d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266072, "uuid": "4be81317-3b1c-4ba7-aeb8-bba435758639", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51577eb1-c181-11f1-927a-4201ac107004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1791289658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289658, "uuid": "e054587a-5636-4c6f-8ec0-fda9be06e0c8", "comment": "Malware payload (VIPKeylogger)", "value": "e22066ff2cc65fb93c5bbd799e0245a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289658, "uuid": "528189ed-cde5-48e6-a7f0-383b42aa9ee0", "comment": "Malware payload (VIPKeylogger)", "value": "2450fabd7c6ac77f8c79b9171f4a9f85faf200c46cf3390930847f677347abe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289658, "uuid": "44203bbc-6ac6-40b4-b580-f8ffe445c2dc", "comment": "Malware payload (VIPKeylogger)", "value": "6d981b3d0f8d3b4f3dd0efc52b592e62b63a9954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289658, "uuid": "3574a838-90fe-4474-8111-8341e5ec1817", "comment": "Malware payload (VIPKeylogger)", "value": "b3f2130ac3853a30245afc4992f05491658d26866c8b7494c733dbd89b26bdd2eca7160712efdd2daa4387e5c4aa94b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289658, "uuid": "925b617a-2de4-4ff9-9a94-5c8ab454478e", "value": "T139F4F244232EED02C5524BB40D71E7B917785E9CA921D3179EFEFEEBB83A6053804296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289658, "uuid": "68a3b02c-c009-4e52-814c-a3a5202b818b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289658, "uuid": "952feeb3-e6c8-4c49-af39-63807efa7d76", "value": "12288:hI7n4P0fxr0txXQlkd9abdljxEZZNiMbZC6vHDflzv7R//+jK66GAPFp3gn:cLoxV9GXiNiMEqHDfJN//UKeAtp3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791289658, "uuid": "9fd4d52e-61bc-4873-90f6-357e64b901a9", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791289658, "uuid": "620dc6cd-553f-482f-8584-f5961014aaa8", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289658, "uuid": "a232e5d6-674f-4b02-b5fe-b236d81f6ed6", "value": "Revised Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debc1e2f-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274004, "uuid": "ce59fb42-e016-4c4e-acde-0f40a3f37a05", "comment": "Malware payload", "value": "5c262b3084c4c7ffb73136614449ef43", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274004, "uuid": "e4b6ac11-2baf-4993-86d7-677b6f13e96b", "comment": "Malware payload", "value": "2471a013abebc725d68631da26452c85e872c93acfd920defb9aae90bf18bb62", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274004, "uuid": "ac9fa545-b758-4b39-b624-829813976697", "comment": "Malware payload", "value": "6d123881a0acc974db94a28946ddd7c9ba09ea94", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274004, "uuid": "8cdee2de-cc34-455c-978b-41b07c184414", "comment": "Malware payload", "value": "0a8dc3b56b8e25b771ed4900af102aa341185a4d41457d3650e25b6a5cc0a8aee6f61ae34d24d43a26024ce0718972b3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274004, "uuid": "1a9c99f6-e0f6-4c62-8126-f4cee7125152", "value": "T1C5C423195942D2CE83D43F7E8E80BBA03E7990EBEB0DFA0416DE35917C95251B3D492B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274004, "uuid": "51e3e1c5-114f-4143-a6b0-750aa13b9496", "value": "12288:EdevMEkFmHkX6wlOMWROC/FTeHo22Qm7NzofOrAHm3:QemX4MQOC/gHozN7NzomMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274004, "uuid": "8a7360ca-9817-4b18-b22a-89208789fc05", "value": 585382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274004, "uuid": "f858c9b0-c8b8-4906-afd6-5a4b8b54dcd7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274004, "uuid": "5162c2c6-d6c0-4470-972a-6738defff674", "value": "2471a013abebc725d68631da26452c85e872c93acfd920defb9aae90bf18bb62.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f5fdbb-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274694, "uuid": "242c1e21-7b8f-480c-9327-2fbf72e0a1da", "comment": "Malware payload", "value": "df1e7fe6fae1b1d042087f0c0327ee6a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274694, "uuid": "e94b8b0b-1e01-44cc-b08e-9bac6483bbb2", "comment": "Malware payload", "value": "24ac40277d0897784a5dbc5a3e35685081a7334b75e9fbd6c6bcb4ff0d08cf7d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274694, "uuid": "141a5684-366b-4af7-81f7-a6686e02c120", "comment": "Malware payload", "value": "5443d981c7e56c77258d6b769f6de2693238ef12", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274694, "uuid": "f8f34649-c67a-42d2-9d0a-d35237d634c5", "comment": "Malware payload", "value": "7987d82a84ead393ce67f7ace7bda7454d699cb887a5b0ade0030d909009ea9662ec987823a24eaadcea10655f1d1ded", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274694, "uuid": "c81cd778-2198-4c97-a456-51158be7ce0b", "value": "T127A4238274716D0AD096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274694, "uuid": "18a7fab7-462f-44c9-abaf-aee84aa1b7a8", "value": "12288:0r06yUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZY:0r06yUv4t1cNk/wjibhv4b2On+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274694, "uuid": "bb23303e-14c5-428c-8477-f16add5b96f0", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274694, "uuid": "ea58c791-85e3-46ab-8a88-202878de2518", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274694, "uuid": "09e370f8-fef7-4916-9847-f6d7b8dc0e89", "value": "24ac40277d0897784a5dbc5a3e35685081a7334b75e9fbd6c6bcb4ff0d08cf7d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e53ebb9-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273735, "uuid": "48cd85b9-d813-442f-829e-fe5047293e5f", "comment": "Malware payload", "value": "b09af2e27e09e656855dc56eada8b18c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273735, "uuid": "503d2ca1-0478-4e43-ac33-20fa6590f86a", "comment": "Malware payload", "value": "251b210353b0e75bb1aca1a876bae53e74ead7297f565ed9d82831bcd9c6e41a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273735, "uuid": "07d59232-00b1-4534-820b-b2ab897aaef9", "comment": "Malware payload", "value": "7099ded20b4bfe6efef2bc813cd39166cd86e9db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273735, "uuid": "b6209e63-0c46-4152-8ce9-3a7afa0e8208", "comment": "Malware payload", "value": "0ae9e9d1306df0bde3e04414587dbf335146096ee229e8aed2c962d2afccfbd455edd1bb0fd5c3333d1226fc01d538ee", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273735, "uuid": "ffcf1cb4-71b4-4b81-9848-be5e0fd556d4", "value": "T19EC423B7179AB4897503E3E4814C6D94C9AF20D957C3436ECA1E2693F5BE247FB2009E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273735, "uuid": "126785a6-e866-49bf-a02b-96220e80ee67", "value": "12288:VeElNtIBB2gX3U5gA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9N3ezw:VeSIBBfHym6Jj6ESfUxZ91kmY/9He0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273735, "uuid": "93a9f82e-ae19-461a-952b-00226e333a98", "value": 584435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273735, "uuid": "db6f811e-e7c4-4b9f-928f-e3bb88710319", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273735, "uuid": "dfbae0ca-467d-4a99-83be-266a5ffb6228", "value": "251b210353b0e75bb1aca1a876bae53e74ead7297f565ed9d82831bcd9c6e41a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee42431b-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274889, "uuid": "6b48aa63-4f59-4dca-90a1-045be0b3cad1", "comment": "Malware payload", "value": "7def0e38d2eeaadbed3693ca3aa07ada", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274889, "uuid": "6c939132-3b65-478a-9b24-3683519bdb99", "comment": "Malware payload", "value": "253ca948d8d5fbed5af5235db3085641a57cfb93726f4d1a784f9e9725755e0a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274889, "uuid": "7a2e303c-9c32-4b4e-85c0-b33888d1c115", "comment": "Malware payload", "value": "0bef27f46fb8e3be4ff6eaebd41a9bb6bd421988", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274889, "uuid": "ddae133f-a447-418c-b1c0-beeab6c1df3e", "comment": "Malware payload", "value": "d83e857ee6f84ae528afdb20b5059294114a1bcb6f47d736c4d325f0f91d7948d0a19fd8f3d5c6581f086850c5648811", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274889, "uuid": "32a81076-ca7f-416e-8fe6-c790cac81e35", "value": "T1B5C4238BA3FD845390BF1F58AA5BB48D091976F34722DC93146A3313D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274889, "uuid": "79a15182-30a6-404b-8c42-76314c355f1e", "value": "12288:f+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byVH9I1P0QKw6FEt:f+QqldA/TSO713u7xnVH9IaQKHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274889, "uuid": "043daf0a-39ed-4f04-b132-5f6c1a521e59", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274889, "uuid": "9b9c246b-0afa-4135-8333-9b5a58b0b8c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274889, "uuid": "fcdf2ca7-5fd6-42de-bf58-1c022236c052", "value": "253ca948d8d5fbed5af5235db3085641a57cfb93726f4d1a784f9e9725755e0a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fac523-c1ad-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791308778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791308778, "uuid": "abf78f57-ccfc-4ada-813b-bed1ba43a58f", "comment": "Malware payload", "value": "6d9a74f8ac9971b09e954f63de3fbaa1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791308778, "uuid": "86d88fed-3c36-45f0-b876-656e13291cb5", "comment": "Malware payload", "value": "265fb1b0dc44cfa05b94d2802189cf7aeb2a42905646f28453cf1e16941789dc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791308778, "uuid": "ede525f7-6c00-43be-b670-2c0e01e363ff", "comment": "Malware payload", "value": "df71bcb75d813edf075f39a4ca23855b22126265", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791308778, "uuid": "4d0b9ccf-67dd-4c6f-8133-43cee4487593", "comment": "Malware payload", "value": "9034d25592a0c68490f4086a8abc2c01085e1829031ee8d3f36121cac64626384ee1bb883f97425de7ebdc27eeedc956", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791308778, "uuid": "39d6e422-7d53-4617-8eba-a21c75168c70", "value": "T12176338359CBC11950B0B034A132262FF3C3A6CA739B895FFB74857A27594375A239F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791308778, "uuid": "7308886e-2c9e-4473-88bf-107d571c8d82", "value": "196608:iwV2AW2krnJW7fDIe1rbZTWXJ1QB28j+fpUpwuihcL4a3:72AW2+4XVXWXJ1Q9KfOp1KRa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791308778, "uuid": "4b86cde1-ade2-4cb8-ba06-351c87646284", "value": 7370875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791308778, "uuid": "8726cfef-4f63-4def-ba91-ed33776704f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791308778, "uuid": "af9d5f78-3278-4232-8cf7-e846dffceca1", "value": "MO_TA_VIEC_LAM_P5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697a8639-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270801, "uuid": "e71d1895-8dda-4567-aa24-a60ee7c846e5", "comment": "Malware payload", "value": "150a7a09450483b11cc2502c00fcac5b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270801, "uuid": "0559e352-8771-48d2-ad9b-d11810c37edd", "comment": "Malware payload", "value": "272664eccd3705b36826dd0c3d21191175c8e4df6a41b79e52cd8c463db9c3c0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270801, "uuid": "e0c2b3b7-58f8-4b1b-b2cb-8c7a9dbec987", "comment": "Malware payload", "value": "cac61231db204ac1f1f030d09f2c861fa444c72b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270801, "uuid": "2dd41cd2-197c-447e-a5fe-f2a63055e079", "comment": "Malware payload", "value": "810ceb1da19c0aa2fd061c0a50e4ccc070b0d1d7dd84b1ed3b53ad735a39510a61ad3613bcf962097c565d3750bd6e8d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270801, "uuid": "e0527496-1764-4162-bfca-845686fdc4ac", "value": "T1B1C4238BA3FE845390BF1F58AA57B48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270801, "uuid": "f7addaae-0e9f-40c1-a0ca-d41bb85422d5", "value": "12288:X+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byoH9I1P0QKw6FEu:X+QqldA/TSO713u7xnoH9IaQKHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270801, "uuid": "51a68efb-6d39-497b-ac12-b6966368d852", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270801, "uuid": "4bbbb689-5582-4e18-9ac3-4a0c276735c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270801, "uuid": "878ad893-00d2-4bd5-be99-678ccbc8738c", "value": "272664eccd3705b36826dd0c3d21191175c8e4df6a41b79e52cd8c463db9c3c0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9588e13e-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273452, "uuid": "6ce0da84-69e2-42f6-b249-7f7ef79882cf", "comment": "Malware payload", "value": "34b26206b7093f1789084ae40e4b3ad6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273452, "uuid": "8e18efd5-82d6-4f04-933c-484b955985c9", "comment": "Malware payload", "value": "2729e457255a463ca9b5a942928bc122e831c3d23669ca8b0424d158f1348d48", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273452, "uuid": "899892c0-2dc0-45a7-be1d-39e1f2fd82ba", "comment": "Malware payload", "value": "395d437cb3d55e1986f68a081923a8c016984cbf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273452, "uuid": "24362db9-232c-4cdb-b93a-b7704fe34342", "comment": "Malware payload", "value": "947d6749b15d7ae8df70c50d02295e3d3d70818f8735665be0bf0d37cfb735e010a69e590e2c8597adc537ef8e3f7114", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273452, "uuid": "37991528-d34f-4bbf-93da-3847eb7ac2f5", "value": "T173C423445C187B6C3AF6A0FD2AB65D83631E1DFAF0D23DBEA43484FE1C16264A18587D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273452, "uuid": "5d1b5f0d-6001-4c87-a777-3b33e644967b", "value": "12288:Ub7TqKR2IkSlQOALUMF2G5SLjrlFlU7ecTUNZhmbs2sYbl7h:a7fkSlQOAIMF2SSPrlFYTU3hVYbl7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273452, "uuid": "f8b8bbd2-e71a-4573-ab8e-94ef42724748", "value": 584990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273452, "uuid": "588ecf97-8bfb-4588-88c6-5358470d0523", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273452, "uuid": "751a4351-1401-4f14-b0b8-f0e796c1a546", "value": "2729e457255a463ca9b5a942928bc122e831c3d23669ca8b0424d158f1348d48.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4c657d-c152-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791269542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269542, "uuid": "00fcb4fd-4e30-471c-bb46-7612b23ffe23", "comment": "Malware payload (Mirai)", "value": "ace7ebe127bd0b056eed38ec034ccfcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269542, "uuid": "c8b96a0c-8a43-40f1-b7d2-24a2ff471093", "comment": "Malware payload (Mirai)", "value": "28b118cbb01f794509e1bd9af0cc62ea70c7cc71708f49817a3da4a0c27e6499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269542, "uuid": "a6f9ed2a-7ee9-43b7-9888-661b645d6d5e", "comment": "Malware payload (Mirai)", "value": "c18500df0e7edc05c8bc2d4dc204e475130c3f25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269542, "uuid": "ed8a0f91-768d-4486-9082-4e4df0f09a9b", "comment": "Malware payload (Mirai)", "value": "8a8dd9ad454c9b154f9b862f8b012e8c2b2a4588a5793299a29ebfeb0e129b9ef3e78fda02dae1f91faf7dd2a2707ce6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269542, "uuid": "45b693bd-ec11-4a96-ac4f-7bf34641c302", "value": "T1D1D33ADFDA1C0357C49B49B0EC6727F78768A9B11291D1C4A2CBEEC107726742126FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269542, "uuid": "5945e6ad-2a89-4e52-9f09-c86e192478c2", "value": "3072:CEwomT4xrdsi4+IjNl36Z9P9LZcYuR1aBprG+NJDdkJoYWU7hL95:JwomT4xxDIjNl36Z9PdZcLGbDdkJoYWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269542, "uuid": "4ef6aeba-4663-44cf-85fe-a1531815106e", "value": 139026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269542, "uuid": "fbf62dc7-7cdb-48fe-b4c4-36427d008614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269542, "uuid": "24db00cb-181b-48c6-b826-764031262f42", "value": "ext4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e607c2a-c18a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791293599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293599, "uuid": "13b4b2bc-910d-4539-8752-2ed07c2e24eb", "comment": "Malware payload (Mirai)", "value": "b0a4ec92f7f6806eceed7dab78bc64b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293599, "uuid": "6e4fd260-1798-4023-bb35-035caf2c8c9e", "comment": "Malware payload (Mirai)", "value": "2901abf9978f38f24b304ecd06c3130ade46aee16e43352f7eb5d52f1b0dba13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293599, "uuid": "22b2589c-723a-4482-960d-4f450132c4d3", "comment": "Malware payload (Mirai)", "value": "47c5886ac2c432520480c5ab736379de4c15a107", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293599, "uuid": "1f5012ce-c379-4e71-b88e-52322c63f0c2", "comment": "Malware payload (Mirai)", "value": "e63c4c7a0ffde0eed4f3599af89d9489ca23dba706423570eb77af735d0296a68ea92616dd20c798faade409ce4b04db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293599, "uuid": "d1885a2a-5d65-4018-9638-647714fbed8a", "value": "T163240B01A9114F53C5C72BBBBBDF429937326B2497EB3302EA15BFB42F4668D0E29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293599, "uuid": "5ebf5466-ae57-42d3-8433-a6b49107f2ac", "value": "6144:bv80YRvrNO84xtyQmGwUTw5o3xLfeAfCNSXjIjo+APPyVBOAmk:bvc5O84yITqo3xLiNSXjIjo+APPyVBOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791293599, "uuid": "6d2312d6-5db5-411f-a962-5c6a8243ff0b", "value": 214438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791293599, "uuid": "62d5cbf5-10fc-4ab8-be7e-fca6a7f5e663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293599, "uuid": "80979249-e9fb-4a6c-b585-c0e2568b283c", "value": "qv3.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03a1ce8-c19c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791301467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301467, "uuid": "f591545f-908f-4115-90e1-33eeb3d211d9", "comment": "Malware payload (Mirai)", "value": "4b183488ded7bb3c05c74211288a9107", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301467, "uuid": "c8288b1a-7668-4bab-813d-331f511842a9", "comment": "Malware payload (Mirai)", "value": "293ce0e434027f734a49f62c06bcb0f83c2549b39fc316ae8510386a0cf69a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301467, "uuid": "be01cf92-e039-4de8-8008-fcd6ce5c61bd", "comment": "Malware payload (Mirai)", "value": "511514701b11771630a615f66541d1dbfb8b0299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301467, "uuid": "b5462e42-2e95-4384-9d8e-2b9807d537d4", "comment": "Malware payload (Mirai)", "value": "f0b184ed3fd376d3dbd2d3a7f27223efa22113472f15157b47330b9f47eb2e23d03d92ff1f8ae1ecb73b559e1e40dc6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301467, "uuid": "e8b44a65-7e0b-465a-bcb2-bbb0684fe976", "value": "T1940474BDFA11BB6EE268873187F26FB2C39521B22691D341E1EED6185E7118C085F7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301467, "uuid": "6f483c5c-7f6b-4e94-bdd8-932a62cdba9a", "value": "3072:841/Wq0K/xbI8hUYrNcR1EEeJqJUx7DbpSIeZ8tjTl5:31us9BBBJqJMDbpSIeZ8tjTl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301467, "uuid": "56aecb32-096e-4d11-99a9-ec4a05da06f2", "value": 181798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301467, "uuid": "8e5300db-4adb-4704-a322-82ade252ddb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301467, "uuid": "8c619926-f7d9-4c9c-bf99-bc90ae4505ed", "value": "gnome", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbca3083-c140-11f1-927a-4201ac107004", "comment": "Malware payload (Tofsee)", "timestamp": 1791261973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261973, "uuid": "588280ed-a0d2-4bf6-b667-b248a66d13e8", "comment": "Malware payload (Tofsee)", "value": "7e3841913e2fd4e3ecf9d382dcd7becd", "object_relation": "md5", "Tag": [ { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261973, "uuid": "ce795937-c035-4aa4-bc47-e03e11cc7f3f", "comment": "Malware payload (Tofsee)", "value": "29792faf57cf4db368909f5675077599094a4fba753261f43b419c49621a4db8", "object_relation": "sha256", "Tag": [ { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261973, "uuid": "2b83230e-2a27-464a-95f1-911a632f4859", "comment": "Malware payload (Tofsee)", "value": "7466081bbe7d75d12a4f011e728be8aaf5a7fe7b", "object_relation": "sha1", "Tag": [ { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261973, "uuid": "1d0e383c-69f7-416a-83d5-00545d46e10b", "comment": "Malware payload (Tofsee)", "value": "c21afe9981daabebbd0a5bf964200bd7f31ee034582054118f7a84fa7d7e0dbc825c5bb014461f7f6c53707a043f5bea", "object_relation": "sha3-384", "Tag": [ { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261973, "uuid": "e04ab277-45db-49af-b45c-1bd3feca4ee3", "value": "T1B2E6013BA28B653EE06E5B367AB2A210543B7E6165524C46DEF0F44CCF3D1701E3E686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261973, "uuid": "7e422f04-c37e-48a5-b7d6-47044fceb723", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261973, "uuid": "d3d25218-6219-4aca-bd3e-cec1edc4c0d0", "value": "98304:55OhGa+gsPfX5ReT2vNnMiYY4PKQdJAmMeMHf:zBfX5RO2lMiYl3d7yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791261973, "uuid": "de013b9b-a5e5-43b7-bfaf-8b00b1a45e8f", "value": 14412799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791261973, "uuid": "bd22d01c-140d-401e-9f52-de604c03adf8", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261973, "uuid": "56da9180-58a9-4aec-9c7d-61b7445abff4", "value": "21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e668c8-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271283, "uuid": "7386dbf1-211f-4318-84a9-435e69fa0754", "comment": "Malware payload", "value": "1bd05d4593bfefc24760e9065d113941", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271283, "uuid": "c6c2f755-e8dd-4214-85dd-ad87bf3bb962", "comment": "Malware payload", "value": "29d7e72c95e01f5da25131d172f28cc6e0fec80869f1d24a20cb4b278c44735f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271283, "uuid": "833a659d-fcfc-45d6-8be3-b7a493b285ec", "comment": "Malware payload", "value": "96e680bafb94b5397b09dbbed8e475623871ca14", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271283, "uuid": "be236dc6-7370-4b36-bf3e-33e0ad396d40", "comment": "Malware payload", "value": "b332a98ddb7998d763a5b8eb2b573b1c9092e937b294ffae378f95430070d6011e5924f54562f99e64697099b8f44ef1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271283, "uuid": "4ec1fd7c-5932-4b10-a6c0-c673bc453810", "value": "T1ECC42304340641D5835A2B1EAEC4E7E1BEB560DBFA1CF940AADD7ED06DE92A173C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271283, "uuid": "29598182-fa62-4740-b481-bd9e16dd77f8", "value": "12288:36wlOMWROC/FTeHo22Qm7NzofOr68m1eA924EwCn:P4MQOC/gHozN7NzomW8DA9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271283, "uuid": "63afea08-a8d4-4ccf-a289-ee35b80438d8", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271283, "uuid": "7126527c-6ede-498f-a8a7-e18be9cfc4bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271283, "uuid": "5a620cbf-352d-49f8-9124-195da72fd4b0", "value": "29d7e72c95e01f5da25131d172f28cc6e0fec80869f1d24a20cb4b278c44735f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09114a0e-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274934, "uuid": "f2cbd5e3-2a0e-445e-8d6e-1d96455ee88d", "comment": "Malware payload", "value": "d392618727421ba181495e82dcd6e2ea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274934, "uuid": "19d0a102-1549-49dc-8ba5-529279321eec", "comment": "Malware payload", "value": "2b09b7f0fc24f694f8f1d9f6d171791cbc172c1147d3adadcf2a61b90205bbdf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274934, "uuid": "4f271aa0-bb2b-43bb-a596-47fbff075e75", "comment": "Malware payload", "value": "a43f69a113f4385e56085a4919cd16afa6d999cb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274934, "uuid": "551aeadd-6898-4883-b576-164fc4e015b0", "comment": "Malware payload", "value": "6493af9f8a271c27069f6ea703ae2bd2172f52bb47968f00b2813a4c04bcc7ae339990677fcb7a629089da6dcefe005f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274934, "uuid": "794ab660-10c7-452f-a73f-73bf39e847f8", "value": "T1F6A423A35293A2D7ABA19F74E40D93D1E2CFCB0D3D9AD2F423B6F904F6651C9444841B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274934, "uuid": "667bb4c2-9b59-4e39-b766-c58b91210951", "value": "12288:B1TGoqqMj4uEU5c1RIfMiZ5d6nfLGsjukmtrYFg:B1TGoOjrcEfMiZG4tcFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274934, "uuid": "951265f4-53b8-4586-9df2-ddf61bc2041f", "value": 491961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274934, "uuid": "19b7baf8-14e4-4dc7-9fdc-5547d7f0e1c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274934, "uuid": "e7df433c-c325-4eb7-9f89-bba770d160df", "value": "2b09b7f0fc24f694f8f1d9f6d171791cbc172c1147d3adadcf2a61b90205bbdf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9040b9b9-c151-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791269148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269148, "uuid": "bfc6d0ba-8a31-41c7-ac0c-127ec1be1464", "comment": "Malware payload (RemcosRAT)", "value": "bfc0848e67feb2b80c7bf5ba9c1efe27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269148, "uuid": "e20afc0b-c0d0-4970-8ba0-a8567bcfcdcd", "comment": "Malware payload (RemcosRAT)", "value": "2b0ca329e37f6cf14c33735d1c0d2e85d47354b9839798bfef7beb19df664975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269148, "uuid": "2f884f0e-4704-4fa2-9294-1a1c81a28f8e", "comment": "Malware payload (RemcosRAT)", "value": "eb71f02fb2de58cb0b68a868d06213620feb98c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269148, "uuid": "576f8cec-ad7e-4595-b8b4-1619144e1cd6", "comment": "Malware payload (RemcosRAT)", "value": "f3441034dd9beefeff1e1336e57c97cc9fade70a4e45ded00ca16a764e20ee6d595fd72f49a10491d893ac7712712382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269148, "uuid": "746a839a-de3f-449a-bf5a-163a22f35bc8", "value": "T1C6140202B1F4D4F7E6BE06304DB696BB1AE499221174A74F23A0EADD7C31742CD0B396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269148, "uuid": "45f73d24-d092-430a-9976-b14436a6699e", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269148, "uuid": "25067f3f-c23e-4bf6-b030-7ca22d68c089", "value": "3072:8DxaVzwmg4CSW8JSuP45ZQvCaScKE0SrUMy3cYiV9FpTR43LFfq69+peh6GtD8LG:iMm4CChAp3cWaE3WVdm3LFfq69+ESuvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269148, "uuid": "c24d86fc-4d1e-42ab-852e-8d1fdcce6d0d", "value": 193896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269148, "uuid": "77d3bcf4-93ac-4460-9e73-54fcfc4f7139", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269148, "uuid": "75ba49d1-c339-4b07-931b-704437780559", "value": "00245_00245_26009416_U5_001 - 4210962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e41a37-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274308, "uuid": "85f4c209-05f1-44bc-8c92-62fa3b563659", "comment": "Malware payload", "value": "9f575196f3130231e2d6dbfb73ea7c6c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274308, "uuid": "e7fde44e-1cab-4b1f-861a-fc513f04ac93", "comment": "Malware payload", "value": "2b40d4ed4c03d246221fb70217ca57994f1adc0a4ae3a82ecb598cc1426f6cbb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274308, "uuid": "1ca626bb-11a9-4997-8433-8bd4d9813108", "comment": "Malware payload", "value": "723be227f22abbf32e40f7111d59b8c0572335fe", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274308, "uuid": "6c13c918-2d8a-441f-8b2b-76708a3d3fd0", "comment": "Malware payload", "value": "855d3de76a3ba179fea14f142198be6e4a11738a31adbe54c134c7149cb075bddb8d3eb9b9b7d2afe84f2a42c348c373", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274308, "uuid": "807daf28-fbdc-4ce6-b438-21e61c104523", "value": "T11F55338AC17C1CC49F3E0A9779FF555CA2248EFC200208636B2A59A7253E74FC7B595A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274308, "uuid": "b392828c-bcfe-4419-9da8-7afb05308c64", "value": "24576:aPTJsZg55yoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR2:abJZ5yoZ9bq+MmMEL+hcjXHC/wnwd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274308, "uuid": "6936ef98-3a6e-42f5-9fb6-5eff7856f37f", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274308, "uuid": "d29dd555-3b64-4844-b420-c50741803c4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274308, "uuid": "2e3cf2c7-8520-4ed0-8c0f-fcff7b244109", "value": "2b40d4ed4c03d246221fb70217ca57994f1adc0a4ae3a82ecb598cc1426f6cbb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0b075d-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276150, "uuid": "50a5bf46-7cac-4f82-858c-d8ff3b4c04f7", "comment": "Malware payload", "value": "57e5141aa439a6c29477f69b79a5a52d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276150, "uuid": "fca605eb-0e10-426c-9ee8-a330095f5af0", "comment": "Malware payload", "value": "2bc67b8dd3a25fc91c2edd7b7ca9d946345a934ed3039cd232261f8b69e646cc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276150, "uuid": "ecf2ebfe-2211-4d09-97af-e5e25b0c2661", "comment": "Malware payload", "value": "f6575dab54442905650968e060718be45751b709", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276150, "uuid": "1bee4f9b-ac37-4ac3-b20d-3817cc5ff395", "comment": "Malware payload", "value": "d2bccacec4634bdf3744d8f4354e6cc0524628fc076be27ecfd98250e44af5c25834729ece517b2fb27ad7ee3d1860e7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276150, "uuid": "eec20517-9f23-45fb-941f-f84c2bd5aeef", "value": "T178A4232C59610F367DB7778089395F02472498073BDDABEAC70F3AA84DDEC909A66748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276150, "uuid": "6b10d69c-32de-4992-b4b3-4dacdc61cb78", "value": "12288:u/pj5tFltx5309/3zYfcEaN9B/Jm0LU0gM7aQ9:2jPFj30B0fclN9BhmSHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276150, "uuid": "25ea935b-4650-46cf-8e5b-e4f368dbc3e9", "value": 467527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276150, "uuid": "1ad0eb6f-afe4-434b-b778-674372d0b888", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276150, "uuid": "83385f54-2ce3-4d85-a853-12b8ce140f9c", "value": "2bc67b8dd3a25fc91c2edd7b7ca9d946345a934ed3039cd232261f8b69e646cc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf70c74-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274752, "uuid": "898b9279-74ef-440c-ad90-0cd7cc6cba6c", "comment": "Malware payload", "value": "cc46cda71d603bea0ec51c0dbe856266", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274752, "uuid": "2b0a9cca-3df7-4e37-9085-7d49cf6e07cd", "comment": "Malware payload", "value": "2c3c20b34122e9cc86585901bc5d153e9aa0c0b3bcbf8a2377f3e93c0129a3fd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274752, "uuid": "d4803c1f-3edc-4518-9e32-39fa79ea098d", "comment": "Malware payload", "value": "45261e613888d77c59e7517a2714fe3a3a027b63", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274752, "uuid": "20c8e81d-4522-44e7-911b-5790503d498f", "comment": "Malware payload", "value": "eaf4019cea1753af66b34e8be3af41753f31d184bad31bb780f63d7075c24e2010814283bd447291bbce444202bc1fd5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274752, "uuid": "2686dbb0-98e7-4007-a921-be886b582ff2", "value": "T120A4236D921554376D67B9C0AD1D2B020A70E18932DDDBD5CE0F38A08EFAC9C1EC65AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274752, "uuid": "7b063710-b799-4ad7-a247-e3e4d58a3eea", "value": "12288:MW+GusvMa+kzYfcEaN9B/Jm0LU0gM7aQW:MWF/vMawfclN9BhmSHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274752, "uuid": "12e4bc93-53cc-4102-a3a8-7defbec558dd", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274752, "uuid": "1c8e8486-f1ef-4142-a4f2-b49d27cc5bd2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274752, "uuid": "b56aebe7-a75e-46c9-a6fb-c80f48caf927", "value": "2c3c20b34122e9cc86585901bc5d153e9aa0c0b3bcbf8a2377f3e93c0129a3fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e48fcb-c18d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791294784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294784, "uuid": "b385eaa3-7bae-41af-a763-ff7290c90a51", "comment": "Malware payload", "value": "d49d0f2023b09fe73ef986f33f68dfc3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294784, "uuid": "2c3c01b2-b80d-4bd9-a8a1-62b3796cc97a", "comment": "Malware payload", "value": "2cabd1aa17478e3abf4b371584f39ae249b6adb5d2b8f5d29350c12b9760fdb4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294784, "uuid": "388d20e6-02f3-4b17-9c36-a0bb25c1dda0", "comment": "Malware payload", "value": "4116f5a36ae679ebf8db98843029c61e2a259602", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294784, "uuid": "ce469603-5262-46ce-9c1f-ef25137414f6", "comment": "Malware payload", "value": "8b3aee0f65480e8bf9102556c70deb032f20dc6dd99fa05acc58570239b0e1a18a13ccab872068067c931146ace3e739", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294784, "uuid": "ac27eb45-7a88-48e2-b02c-bc387e8c01ba", "value": "T1D627228BE7889416C4F2533785796A55054B8D929B43CFE32E98323904BB4D0BF9FEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294784, "uuid": "87cc66c8-362d-4e41-a9ff-4b656e35ba46", "value": "393216:OzSnDX/mhmUHiN7at5bHCnhN7E0Gc2ojXOwWDlNKb+lcTUJpliIh8:O2PCVswbiX7xGZOXpWDTqmiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791294784, "uuid": "27eefc93-1dbf-4da7-a128-88b501dc9218", "value": 21117754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791294784, "uuid": "192ecbac-7c6a-41d5-aef9-3ad35b541151", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294784, "uuid": "83da912d-0b57-4112-a309-eb4696634c0f", "value": "\u697d\u5929\u30a2\u30ab\u30a6\u30f3\u30c8\u4fdd\u8b77.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d8c874-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273346, "uuid": "46eb2b38-4d63-42fa-83d3-0e584d2fc21a", "comment": "Malware payload", "value": "2d2d3e95c9d333e8ceee6c8bf716a7ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273346, "uuid": "d0b37377-be99-4c2d-b04e-3527e034c05c", "comment": "Malware payload", "value": "2ceb2465c4ed33a6a830bcac2b301a769d583e63067af50dba2e5dab59fabae4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273346, "uuid": "2592fb02-ba7a-4a93-be73-876c09e28437", "comment": "Malware payload", "value": "e65add6d55f05ea792eda3236f993818a8f72de0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273346, "uuid": "9e56df12-f477-4ff4-a10f-6c935d62f7fa", "comment": "Malware payload", "value": "6c12df490cd8a1fa06cab28b2b79ba9415e744b5eafe6f8c30b30c74a18239004768679e58391370701ebd2dc1374053", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273346, "uuid": "244e0fbd-01c0-44b4-b184-3bf2a2d789b4", "value": "T112C2204009A178845333ABBFAB1798E8FB77056B01948447B86CB851AFF2D1CDEE4DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273346, "uuid": "06d0fc1d-8106-4b9f-8ee8-87e18270050d", "value": "768:PQ6B6RylvbRSXO1fl1HYwtzwwVeraTP7idghCPxm7ktjf1MPjXvcUsarQCP0sqWg:IIVZumjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273346, "uuid": "40025473-5bc3-4d23-b03e-15459b3e1361", "value": 25885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273346, "uuid": "63e858f3-e619-4124-96af-a80c1cf9c922", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273346, "uuid": "47612335-1084-4b80-b51a-7f23ff88b210", "value": "1C25TLN_00000055_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7416e566-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272536, "uuid": "d2ff22de-d2bf-427e-bb2c-3a8c9df3596f", "comment": "Malware payload", "value": "4ed5b394eb6974121bff65f0a8e3e31c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272536, "uuid": "b55723ea-b468-4b21-a20b-caffb97e7127", "comment": "Malware payload", "value": "2ced64206af37465119319d1de1d97e85fb8961901764fff8bb3be8fb2b8b32e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272536, "uuid": "f2e6a964-f9f0-4bef-9c04-8b10758da361", "comment": "Malware payload", "value": "50edfb2fb2a1c920074f993f89347eb3586929a6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272536, "uuid": "bb666032-5898-4904-83d7-ce50b1a36c0a", "comment": "Malware payload", "value": "b2fab89369b93772810ddc83af19ad03b086646becb97e1d73fe9801bc644ecb2ee74241d12c766483cae7efab11f183", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272536, "uuid": "0491e3f1-e6c0-44ab-bb91-1b331419be3c", "value": "T14AC42304340641D5835A2B1EAEC4E6E0BEB570DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272536, "uuid": "f088d978-0d70-446f-aed3-f1ad0ccd8e62", "value": "12288:D6wlOMWROC/FTeHo22Qm7NzofOr68mGeA924EwCM:74MQOC/gHozN7NzomW88A9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272536, "uuid": "c28849dd-5ce6-4fc1-a35a-9b0c4569f3ce", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272536, "uuid": "6a645c6a-18d9-44fd-bc2e-839a1a2f1fe3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272536, "uuid": "3df90f52-9df9-439a-9423-44e04d563c64", "value": "2ced64206af37465119319d1de1d97e85fb8961901764fff8bb3be8fb2b8b32e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472176c3-c11f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791247550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247550, "uuid": "3dfb4d13-e257-4173-b26c-1e4e2fa90af6", "comment": "Malware payload (Mirai)", "value": "8d0a23ff49421e5ac14b6d82ba0ae40f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247550, "uuid": "f1921c7a-8a12-4170-8cc1-94a60d6788a5", "comment": "Malware payload (Mirai)", "value": "2d3cc4221bee647e7889b0fc8b4244ff763c3a24dbf5d67fd4d676a60cf5b6ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247550, "uuid": "6db6be11-070f-4750-90c3-07d1edf03b1f", "comment": "Malware payload (Mirai)", "value": "66d65de2a90f93097407a090f2b759b6ff536537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247550, "uuid": "5a0b2e91-416c-4c99-9e3e-12aeb75fac2a", "comment": "Malware payload (Mirai)", "value": "4bacc0469aea20b67ec8366e33f3475639347acd286af1b4e6075d3d1f92b783f9738c941e3d77e8b582dae0c855b657", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247550, "uuid": "75033267-34db-40d7-aaf9-95794307d256", "value": "T1F2B49D07A6B7E8B1D4A142B1215557B99872D8B31577D88FEFE52CD0DE60280E32C3EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247550, "uuid": "c812b2d6-d520-4453-83e1-f9fa86f3d19b", "value": "6144:PwyB8aEyKLx9+tct6COol6guBIxU8fAnSCQjMkOw8eoWFZnuUkO3Qm9owpIo:1B8Z/ccF9dAtA8eoWFZnuzO3QmXIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791247550, "uuid": "542016c1-f609-4f46-8915-12ee458def2f", "value": 536108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791247550, "uuid": "c8ac478f-0c00-4b34-a6c7-656499afd6b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247550, "uuid": "310f55bd-6246-4f95-ad06-41699c9ed797", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6364b7-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276365, "uuid": "ea9ee71b-d8b4-4004-bb6f-81b8b30f1658", "comment": "Malware payload", "value": "854ce6f8b70816b195e4fd1877105849", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276365, "uuid": "1ebb4458-37e8-4c8c-8723-6bf69f029a8a", "comment": "Malware payload", "value": "2d4ba500b301a42e26351129a3995e13b706b20d361de7d10f830c900c60f816", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276365, "uuid": "b774b247-79dd-4e4a-b15c-5a22d56a82a4", "comment": "Malware payload", "value": "404f3844a425ffb8a737f8a64f085b774c98d448", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276365, "uuid": "6e08cbc6-2deb-4527-8800-9e1f51e252aa", "comment": "Malware payload", "value": "3375eb4dea41b052a0d05d2307da6f52480fb8067814f7a962320b7bda6f29c6b1a22a9996a7ee3b768ea8e110f0de21", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276365, "uuid": "24cf6102-e893-4df0-bdeb-b9e4903b1508", "value": "T1C055338AC17C1CC49F3E0A9779FF555CA2248EFC200208636B2A59A7253E74FC7B595B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276365, "uuid": "0a06a03e-5899-4ccd-ae99-a0c4e3cd7017", "value": "24576:2PTJsZg55XoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRn:2bJZ5XoZ9bq+MmMEL+hcjXHC/wnwdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276365, "uuid": "479fc4cf-7f72-40b2-bd79-74f363fdc958", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276365, "uuid": "5aadd936-61f1-42c3-a1df-3caf80cbce2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276365, "uuid": "25bb811e-5a6c-4a42-b737-50f8bc25e3ee", "value": "2d4ba500b301a42e26351129a3995e13b706b20d361de7d10f830c900c60f816.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188ad2b3-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263363, "uuid": "ffc786f1-2cbd-4853-bc61-3dca05a0e900", "comment": "Malware payload (Mirai)", "value": "d899a9c034976c6efde6d6f83fc7fb29", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263363, "uuid": "57ec5b47-dee5-48d2-8cda-ae742c425b4b", "comment": "Malware payload (Mirai)", "value": "2d536e73ce5be5ecf4eba0c94c14fe9ed7272eab92fea0f9948c113830ad9fc5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263363, "uuid": "819877e4-ee43-4a39-89aa-b4010e1777d5", "comment": "Malware payload (Mirai)", "value": "cc054a1cd6b05374fcbefe032caac8ac54ec5630", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263363, "uuid": "8232147c-946c-4e77-bb0b-1451918f4bab", "comment": "Malware payload (Mirai)", "value": "52c920ba0bd67c97911ef16ebaa5c883b611ed8cdac08117d3c2e511c6f3daa81545aab4164282fb5ef04a1e94dbc5b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263363, "uuid": "58ecc12b-c1f2-4199-8566-22181a4687a3", "value": "T1A931038D22B07E71CD4DCF0AB0E542D6A647D5C8A2930AF2E4C23CB179D9F80B855A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263363, "uuid": "6fca4a3c-fcff-4b6d-9105-0bda25247cc5", "value": "12:5kfH0dthNaKG6lODOmJGfaiK1/k1YTVbmVb1LB9N0XN0Kvth2e77ZLB0CXwlv+CX:+fEtFwDzJ+KJkkgz2X2MtJZhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263363, "uuid": "885a8c13-e585-4636-811e-6b66b1747bc6", "value": 1834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263363, "uuid": "3b262912-cba0-4ce8-8b97-f3aedc50b5c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263363, "uuid": "4f092730-f60e-476d-9bf3-e37a1fc112f9", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5103997b-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275055, "uuid": "ef967b6e-bb9a-4b89-b3ac-9d9354720b62", "comment": "Malware payload", "value": "4964e9cfbcc2778376eeff8119cab496", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275055, "uuid": "6108f4b2-c68d-4337-a0e3-9c2f7a05f3f3", "comment": "Malware payload", "value": "2d925d70a1ea0f0f9748556041e97a16f6696a1a2cce24ef420f1792e5f0098c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275055, "uuid": "9f2b4673-e0bf-4a67-b98b-20afaa558f9b", "comment": "Malware payload", "value": "46f92597b5f7247a85769ac2f616a20b5703eae8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275055, "uuid": "a4062cdb-baf2-46d0-bee8-47d8748a2f08", "comment": "Malware payload", "value": "00269e195d344f59646d2fe1c9883410cdf3ae1f4fdd67a1a7474ebebacc9fc17181a6880bc6c97dfd27a1b040ad3aa9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275055, "uuid": "9ed5d78e-2524-44b0-ae35-3a2a8e44c800", "value": "T16255338B413C28C44F7D0B63BFFF855CA2259DFC104208676A594996783E7AF8A7099F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275055, "uuid": "b4c8420b-69a7-442a-aec5-5332abbe39f3", "value": "24576:Tw0w5MeEoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRG:xw5MeEoZ9bq+MmMEL+hcjXHC/wnwdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275055, "uuid": "50aaa229-fa31-49e5-9c74-a5c06c1b633c", "value": 1397727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275055, "uuid": "0e6f40b5-2908-4c2e-a51b-7b6f8b20230c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275055, "uuid": "6b17d26d-84d6-4842-a20e-607d79ce93c5", "value": "2d925d70a1ea0f0f9748556041e97a16f6696a1a2cce24ef420f1792e5f0098c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5e1730-c197-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791299390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299390, "uuid": "d17c2e0e-9bc0-4ce8-a6d0-7b0743f07222", "comment": "Malware payload (Mirai)", "value": "079b6e248c88822fdcab1e3a44e887c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299390, "uuid": "93d96e0d-badc-4d92-bc98-939d06e1afaa", "comment": "Malware payload (Mirai)", "value": "2dbd3724d1916594b4e77c983474027fa4f629d8d6195e3b54cda76f534a6cda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299390, "uuid": "f2b7731b-e5fb-4a72-937a-4f3e8cd384de", "comment": "Malware payload (Mirai)", "value": "e282f9435facd36d81e5c0986b87c1cec80d61ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299390, "uuid": "997d4af3-7de3-43e5-a895-0e9b72816033", "comment": "Malware payload (Mirai)", "value": "ee816c324cba115fc6ce455704c1392fb009b6a80354bd835fafa1a459dcf7714d374e02a6e452087be6b3683e12ca97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299390, "uuid": "71a3ae19-f930-4fdd-8cd5-b9c15615b141", "value": "T1ACD308CFD8914EB6C145B975E9A62533071AF4344B0FDA8660FBEAB0424F4DE700E6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299390, "uuid": "0865f8b2-e865-4ccc-9360-9cbdf3204cb7", "value": "3072:Wu/gHjqeUV3hdrJod9+ubjf1ZImV/7UcKkDQJoYVfThLo5:OjqB3hVK+o/I0XKkDQJoYVfThLo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299390, "uuid": "7f0eed04-8cc4-439d-acdb-4a99ad4adce8", "value": 134939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299390, "uuid": "ec7ae440-822d-4230-9e3e-ba041b8753f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299390, "uuid": "fcc248ec-5b3a-42ed-b8e6-1cfc9b13a5db", "value": "watchdogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c992722-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275477, "uuid": "3afbbe2a-eec9-419a-80a0-1a595fca1098", "comment": "Malware payload", "value": "af7ef4eaebe0bc25dd88f80264c163f1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275477, "uuid": "e36b1ace-3422-47f7-948c-c43be6f0069a", "comment": "Malware payload", "value": "2dd65b7fe224b0d2572f723f76ade387154c89675ef80c3b20ab7ddcf2be3dd7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275477, "uuid": "f86e93db-0301-4b4e-bc6e-7761fff96c0e", "comment": "Malware payload", "value": "c4ba7ccc9f39df19d61e6f51c05d78f41b578635", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275477, "uuid": "c7e3aecb-4ea6-40d4-894b-946cc927ac4a", "comment": "Malware payload", "value": "052715e13ab61a94b33d3ca96dd3a8cf8a41f3ae6b6c4719dc3282bcdaac162e1febc81438ccf51288b123bdabeccd73", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275477, "uuid": "deba3a72-ebe3-4030-9df3-fdae54f9ac78", "value": "T192A4239581B987533484E3B5497B1AEA5F301CF28D3D674F88DAC5F80B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275477, "uuid": "03b5bc3d-0037-44fa-b64f-07e8b471eadd", "value": "12288:fcaSCDe0U+m1V6ECbniSPfS3e2R3feeintFckN:pDe0wUTiSWzeeiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275477, "uuid": "81577629-2928-4a5b-a488-710e9115b23f", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275477, "uuid": "75b90b8f-0723-4075-8dfa-e609052321a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275477, "uuid": "eac0a563-30ac-4fe2-ac99-08b8acd66464", "value": "2dd65b7fe224b0d2572f723f76ade387154c89675ef80c3b20ab7ddcf2be3dd7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898a200a-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303067, "uuid": "b1dde543-748c-4149-b516-bdf90177736c", "comment": "Malware payload (Mirai)", "value": "32deae7714a2924522b6a8a98b8d7d22", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303067, "uuid": "39b3bca0-e278-4165-bf13-51fe38fbc8d4", "comment": "Malware payload (Mirai)", "value": "2dd700a613cbb38742bdcd3e8c730e3a56986085a010e08949818179742c987c", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303067, "uuid": "dd1709e1-1e4d-405d-94e3-4d0a2525787e", "comment": "Malware payload (Mirai)", "value": "c9f7978915fcf2c37ffb545b2fd6d3f55dcb95a1", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303067, "uuid": "8428118b-b0ca-423f-a96a-42b344bb865e", "comment": "Malware payload (Mirai)", "value": "21c3aa78d7d4fe232f76204b5735e5dfc22837bc23440322272645393e5221f82ec6e3a8eb588466d54d6ebae8763ca6", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303067, "uuid": "b01656fa-ffb4-4462-beeb-18ac907a9ac1", "value": "T15BA312024982FCF8EA196533EA9542CDAED3A279904F0A6C9207C5514AD3056F2D9B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303067, "uuid": "fa564b4f-05ec-4bfd-8c40-83ab6e44cff5", "value": "1536:DFiWlhG8Qe/JmqjeI4x4Gxtq454tCeyqNGrXbHOfcttnEgaCj4SEr36QNv/GZ/jq:DrOBe/L14XAtt3zGrkU7+NhAbpvhhJ8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303067, "uuid": "56b53b68-70f9-481e-afdc-2cb6b52fe77d", "value": 97980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303067, "uuid": "ecc6c7de-327a-4d3d-81ea-6193dd671fe0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303067, "uuid": "0685d63b-7957-42df-86a5-2b06f157fb45", "value": "flutter.ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94613be9-c175-11f1-927a-4201ac107004", "comment": "Malware payload (ACRStealer)", "timestamp": 1791284616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284616, "uuid": "5267be9a-1467-4d29-95f3-ac4b24818069", "comment": "Malware payload (ACRStealer)", "value": "7f4c68c231b9470d423b5d1ae06b8a9f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284616, "uuid": "f237859b-230b-45e9-bf19-5c7b41cdde04", "comment": "Malware payload (ACRStealer)", "value": "2e216bdb002fd0f418f149a29c7d61e8ae3efcf79debd9b31f319b3906b8cc59", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284616, "uuid": "d3969ac7-ae83-4c74-994e-aab43ff294a9", "comment": "Malware payload (ACRStealer)", "value": "b4262a28ffe6454b44da536b95d124ae0e491cd2", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284616, "uuid": "f98b0921-7b11-47c3-bde6-8e9495984c2a", "comment": "Malware payload (ACRStealer)", "value": "7bf04c68896ea7be43ddabd2c91cf10bff556639188cf10361feb7c4dedd97f3dfb3bd81b82f2493cfcea8feb17ca692", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284616, "uuid": "7a82c588-af15-4650-a814-5874348f567d", "value": "T122F64A87E9A904E8C09EC77985B6A123BB313C49473173DB5B50FE242F36BD0AA79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284616, "uuid": "cb2acc12-e7b7-4f6e-b428-b523737b5831", "value": "38b89ec877d592ab1fce01c3e6419cf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284616, "uuid": "119a8932-90b5-439b-978b-df8bbdea8a11", "value": "98304:3RwqFlxRbyLTWvLWh0CsK3g/T+KBFER3E4fBus88xaXo2dFLKxhj:3tn2LTWa/jqWGCusmQxhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791284616, "uuid": "76324dee-a42a-4f13-b8ab-a1635fbc8def", "value": 16669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791284616, "uuid": "1704b8a0-4fea-4d98-9af0-d1485a0b8c9a", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284616, "uuid": "84e3448e-bf84-44d0-93fe-a8f1c55239cb", "value": "agent-1a79dc48.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd9347c-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245736, "uuid": "2458ac75-ec83-4fdd-88de-8aaba16b4a1a", "comment": "Malware payload (Mirai)", "value": "38af015512631081374e9adec06c237f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245736, "uuid": "26d0b20a-99f3-4c87-bdda-d126093a9d6e", "comment": "Malware payload (Mirai)", "value": "2e890cf52e64b43618b80ac13a6810bd3c9633575b165cc27e96e5ee4610429e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245736, "uuid": "e2e5192d-c904-42d9-8ff4-17d790cfe13a", "comment": "Malware payload (Mirai)", "value": "cc6351722c8769c1dbe049bd135d6f76c9858d88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245736, "uuid": "effa9f2c-967d-4438-aa3f-e3eee55cebb5", "comment": "Malware payload (Mirai)", "value": "1e126f11aa6a38f9e12fb7e59214ec652137472eee59be7916ec3b43adaacd5d4f8ec79850192a12b6cd3f0d2ad9cf1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245736, "uuid": "befdf51c-b51c-44f7-b56b-2bece2833085", "value": "T197C42966B8418B81D5C16ABEFF5E834933131F38E2DE72029D186F74A7D789A0F3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245736, "uuid": "9251229c-1b8a-4850-921a-f48fa64ebe1e", "value": "12288:Bz4DdmQfarFj0vqRXbfHFkM4AKQmfjG3DrWfrDwDayd07CCR:BzUjsQS+2qGXqcO7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245736, "uuid": "e0c0b1e8-e679-4a29-bdd7-e2b062c725f2", "value": 591104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245736, "uuid": "4319db56-37c2-4fe1-86bc-958ea8554ec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245736, "uuid": "289ab461-0c60-4535-9bc9-68e27d633713", "value": "eclipse.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b68979a-c11d-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246645, "uuid": "7fe25ff0-ef51-4e25-afd7-39f8123e79da", "comment": "Malware payload (Mirai)", "value": "e0632b2342b297bf5dbb3fdf36e4b61f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246645, "uuid": "996188a2-1a19-4060-beef-eb1287ba4f04", "comment": "Malware payload (Mirai)", "value": "2e9bbcc6339c8de2f332ba95031931eed3ec843f3869cdfedc3aacb2667120a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246645, "uuid": "78353610-e8e7-42c3-a215-2e4dceea119b", "comment": "Malware payload (Mirai)", "value": "63ed17029973f55a57a04215250c5fb32e76b4e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246645, "uuid": "21674ef9-e673-4e65-ad8a-9d9f4e9153f7", "comment": "Malware payload (Mirai)", "value": "f92dc33393c1d7d72fd5c65f5b2c492b16806c10c933d64f0f39a0633244fd462fbc5559bd9140c32d1d7d8d00eb5809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246645, "uuid": "a22f6d13-2c6e-4018-b5fe-cb91593b6117", "value": "T194C49E03AAB3EDB1C4A380B151526FBA5971D53615BBD84FEBD62D90EE105C0A31C3BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246645, "uuid": "9f04ad27-7528-468d-aa79-09862bb47b00", "value": "6144:+LqmLbQewwvxDP6DMpVi7WGA3hpk0wRbyojIaUvwAiHg9UN4HTqapJ8O:7mawvxDP6DMpViKGAzih+4uTqQ8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246645, "uuid": "d93f5ed1-66cc-471e-a5fd-cc3f0f6ed3d7", "value": 582552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246645, "uuid": "68595af6-31fe-4292-b3f0-3bd6b8de49b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246645, "uuid": "9a7a7af1-b3d1-4172-8234-ea86a1e3583c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af5cda2-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275125, "uuid": "a5342642-300e-48c5-a8ee-fe7e5bc76596", "comment": "Malware payload", "value": "474e91af18da37ddf4b10343dc8301f6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275125, "uuid": "cb2d7f91-7d30-4ff1-9289-4919b13d94e3", "comment": "Malware payload", "value": "2ff7da9d79d8494af6eeb7f4faab58dd5d20a1c473ffc4ddc9700fa221cdeb59", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275125, "uuid": "ae6f3e32-9874-486c-8fea-fed95536e602", "comment": "Malware payload", "value": "15660ac5948c18f08cdaf4094ece454a5dace5f2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275125, "uuid": "ec897e26-ec52-4a37-8b28-39fd68654778", "comment": "Malware payload", "value": "4c55f59f9f7da8ab15b10d5bdd007971bfb3b94ef022e1371f130ee0b9c5a78f3776c6723d895ccc3a58a46d5436cd9f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275125, "uuid": "f1d7da56-1464-4d3d-bf3b-e7caa975f0b9", "value": "T139C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275125, "uuid": "feb3bf73-09f9-4bc9-a57f-2b862ce13180", "value": "12288:r+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byeH9I1P0QKw6FEo:r+QqldA/TSO713u7xneH9IaQKHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275125, "uuid": "a3180ace-5335-49f5-8acd-9b8236fa6448", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275125, "uuid": "6454d7c8-fba0-4f0b-b26f-448a4fcea989", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275125, "uuid": "3db793a1-33d7-48e5-b1fc-4e6528ec5978", "value": "2ff7da9d79d8494af6eeb7f4faab58dd5d20a1c473ffc4ddc9700fa221cdeb59.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee21b4e9-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275748, "uuid": "a61e7cf3-ee08-4147-a16e-eac4eb106c69", "comment": "Malware payload", "value": "da4d3282d5d0a4f808f978ac17e993dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275748, "uuid": "2c5f2cce-7b39-4830-99bf-151b4c021adc", "comment": "Malware payload", "value": "303b85937c880811bb3e3689dd4cf6034bba0f13adcc332b36cf6c3a5d7a5e5c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275748, "uuid": "66524898-c224-4d00-91e5-797f3389b9e8", "comment": "Malware payload", "value": "ce3dc8401b4feaa3f33f8640f20623798092c07b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275748, "uuid": "dc87d8c6-15e2-4777-b1a3-20bf5c38ace2", "comment": "Malware payload", "value": "bc7149a6f475c93b6ea0f60ab3a2ecedb5bee81260e0f47323a3df3aca73386f946c569625ba90d0aa6ca3945f826e5d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275748, "uuid": "93a086b7-96d5-4c20-b991-979d01862423", "value": "T13BA42394C5B857962448E3F9017F19AE1F302CB6CA3DA78E941FC6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275748, "uuid": "a302bf1e-3e6e-48b4-8380-f9ded1d25f2c", "value": "12288:+SCDe0U+m1V6ECbniSPfS3e2R3feeintFck+TsuC8hHk:+De0wUTiSWzeeiGsP8dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275748, "uuid": "9036e377-f4e8-4d7c-b175-627459b38b61", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275748, "uuid": "577e8438-351f-432a-a15f-4244bb991966", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275748, "uuid": "ea7dbe8b-fae4-454d-bf36-fed38fb438dc", "value": "303b85937c880811bb3e3689dd4cf6034bba0f13adcc332b36cf6c3a5d7a5e5c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb7360e-c186-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791292068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292068, "uuid": "b67aa2f5-d17c-4ff4-8c8c-7cfdb60031d1", "comment": "Malware payload (Mirai)", "value": "c31f1fa318553966ee98a028859544d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292068, "uuid": "01b12d42-894b-4a7c-ac4f-d95def8fbd5e", "comment": "Malware payload (Mirai)", "value": "309d5b6fdf4fff06699f0c73c011b59533032095996ed11cedc2d4dfa4f2d457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292068, "uuid": "871156a6-ad22-4821-b2c2-a763ec44d635", "comment": "Malware payload (Mirai)", "value": "ddba6799d72c49414b3f322357de6531c78b180d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292068, "uuid": "ba2d5973-4447-42e1-8110-d2a68e2c1c6b", "comment": "Malware payload (Mirai)", "value": "397261460a4819cc113115471641199a752599344865f0a23eac050db73f20dbb2f81acbd52333319226fa3b85ffb8e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292068, "uuid": "cccd44c5-3c66-4611-ac52-e93fbfebb1a9", "value": "T13BF2E15568BE0ACEEAEF01B59BFB354F887087A991C46134C2582463FCA2C2D9D3D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292068, "uuid": "991589b4-f0f3-4f32-a7c1-d58e644aeab0", "value": "768:5CkGi0D/4BfI7dZrLSAfFdNi5Tidt1m4nbcuyD7UHQRjo:5BGbyqxLtf4edt1xnouy8Hy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791292068, "uuid": "3a1dd66a-28cc-4c2f-97c6-54655fbf1df1", "value": 34888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791292068, "uuid": "bc89ce65-8ef2-41d9-a32d-4597786f8ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292068, "uuid": "88e63983-b24c-4b1a-b0f9-209bda146c73", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263ed1d9-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791273265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273265, "uuid": "7bf94b7c-fc34-476f-87aa-20320d306992", "comment": "Malware payload (AgentTesla)", "value": "656911c02d0fee9be9b4c29ef78b4544", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273265, "uuid": "6f80ad5e-418c-43e7-b1c4-8d270256df69", "comment": "Malware payload (AgentTesla)", "value": "321df91cd89ca88fe863bcecb1723c683ac67b0d786037ac351528da89f9e131", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273265, "uuid": "7ebb6ffa-b5f4-406f-b02a-ff61bb7c2cb9", "comment": "Malware payload (AgentTesla)", "value": "22623d8e8da2a31a18dbecc84e5056c228871081", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273265, "uuid": "a374498a-59bc-4680-aedc-24ef46fa3ac9", "comment": "Malware payload (AgentTesla)", "value": "47d24ff14c334ce561f85e8a7b0e1f962fc176320a9e1575d0320697469748e67a5cbae06a1255508f1de3db4a1edf86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273265, "uuid": "dccc1073-bea5-43c9-bdae-99045834d6a2", "value": "T19CA2EB414881758253B37BBAA71AE8A5F77B1B6B01C44507B47CB840EFF2D08DEE49B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273265, "uuid": "f811a899-1685-4ba2-8d19-cc2f8915b388", "value": "384:CNC2dXZQ6vUcjgdnh3kvDaZ+fOn28K+y4jXiUb7OHIlngPwUo/qLzwEJ047OEzny:CNCYXZQ6UcjgdnBkvDa4fOn28K+y4jy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273265, "uuid": "417f8864-6d80-4cd3-aeac-20c294ede6ce", "value": 21565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273265, "uuid": "e959be2c-6287-4b77-86e4-24c0a003debb", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273265, "uuid": "08fd6c2f-b855-4f89-83df-df1fb4bed1ce", "value": "Formulario_Datos_Bancarios.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecb1c4b-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263884, "uuid": "d2fe5b1e-d180-4b19-a88c-9663e7be3227", "comment": "Malware payload (Mirai)", "value": "1511c9c7a59ad039a17a8bfc5c7baac0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263884, "uuid": "e674aaa5-dac1-4f90-8441-a22dc874a86f", "comment": "Malware payload (Mirai)", "value": "3291832e507b4845e4ba3a2ab7dd48d86f2e189173913e1e3b17dceb598b19f0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263884, "uuid": "f2e88033-1813-4a68-84c0-418c719631e8", "comment": "Malware payload (Mirai)", "value": "96d6cdec23ef1b6ab94769d3ae6fa7eb2579622f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263884, "uuid": "1951513c-3bf7-4279-9294-f303d3ce04e7", "comment": "Malware payload (Mirai)", "value": "dcb5e4bcf5f01c7ed907ec881a1f59413aaae82260079ef058a1226b74352cf3989fedb2794af5803c219e4905fd0a83", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263884, "uuid": "7622b41a-f7c2-498d-b189-1b6bde3d309f", "value": "T175D47D0779F094BEC8D6C0744B8B933A9D62F08A2239F58FB7C6AE817E19E50671D741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263884, "uuid": "1edab92d-fd7d-447e-aafc-2f94dfdd1480", "value": "12288:LQ9kwa5NHCG6nbSH7OuvzG7jJiU1OgvX0E:MGGcOgzw1V1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263884, "uuid": "502b563b-c824-4f72-bb8e-5e932bcc6b3d", "value": 625216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263884, "uuid": "16a97517-2dc6-4f9e-aa73-be317e5c5907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263884, "uuid": "182f1ed7-13da-40d6-9fcf-b557b58220fc", "value": "x86_64_dbg2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88979ba9-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273430, "uuid": "f46c96e4-db80-4b45-b011-0e5f96689638", "comment": "Malware payload", "value": "a9125747370d90db40defb300ddb76fe", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273430, "uuid": "33e3205f-b608-40d4-adc7-8e67684eb892", "comment": "Malware payload", "value": "33aacdb142f592373101ad0650d58bfb729d2b07b506c60942c4b41b68b07a43", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273430, "uuid": "8a0a0f0e-abd9-4e10-abdf-7543a7f86429", "comment": "Malware payload", "value": "4bdea8e76c09ffa71b6a8f5d18ed0537fa53072f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273430, "uuid": "2f6146ed-45a4-4fef-b51a-dbb941b6527d", "comment": "Malware payload", "value": "06b5406c944bfb627d885bf34d65718eec24803c47036a55b2be163e67b6240a8b358152ead485147a56089dcb57d9f6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273430, "uuid": "41125c80-1ffc-4a1d-8e67-c8804026c05f", "value": "T1F082D535AFD312D1784316BB545E4937883406F20B329C652BA8BC385E93FF6663D34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273430, "uuid": "22228a04-eea8-477d-b1a3-b5ef10209e41", "value": "384:kO7l64XMBNorQa24WTqfJcSmWVGj1hCdybit1BBmtRM3NZ:9uB2Ea2/Tqut7j1hCdybMBBmtRM3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273430, "uuid": "b445a912-fe82-48bc-aa51-17664ce4774d", "value": 19102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273430, "uuid": "99f22e13-43ec-473d-b2dc-50fc0bf20e6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273430, "uuid": "59b3aae1-6705-44b9-a711-f417fb32a6f3", "value": "PKL20261003 CVT-HA NAM OKOK.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848798e6-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791303058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303058, "uuid": "bf74492e-6d84-4f81-a113-67512daf3a74", "comment": "Malware payload", "value": "7b90e0b41f80bec37ca9f382f8d6d7ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303058, "uuid": "c287bbc8-1516-40b1-bbb8-68c77cc53de2", "comment": "Malware payload", "value": "3401bce769a3fb12c475bb554ce43b49072d0317292603fe350f3dc42133c300", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303058, "uuid": "4a26f090-5eb8-4601-b137-5b4efa1677dd", "comment": "Malware payload", "value": "687da311bfb7d7a56018b585c0e6feb7e5cbd049", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303058, "uuid": "d9f584b9-db31-423d-9bf9-cd305d34b32f", "comment": "Malware payload", "value": "02465f9dd4d58af58f3edbac45d0b3df865c742001d7bb54da4d2168f42900167b4748ff821a94218d452b091d1cbd1b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303058, "uuid": "eab4b69d-b4ed-487b-86a6-662c204fec27", "value": "T14D5111D5FAF2143331AA842D626CA09DB6470933021B6805B09DA434FF3A1BDF23A329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303058, "uuid": "e39d0063-a14d-42e3-a018-75e7b065aa72", "value": "48:fCXlc+71EmKVsbsLGyIhsRrPO2L8xAgFV5pAFVY8AFVIsoKFVZFVIlxAgFVXFV9z:fqAChsRrPO2LGWUiRe1ijL9iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303058, "uuid": "5a0dd623-3ea7-46d5-a39a-ec429d119c29", "value": 2752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303058, "uuid": "e04ca786-c493-4183-acee-e1383ebf3bcc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303058, "uuid": "8b18eaa6-01e7-4753-87a7-9f987af4118d", "value": "dl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c29d35c-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274187, "uuid": "dbf77185-3a12-434a-9b7b-ecd1c8e2d948", "comment": "Malware payload", "value": "bf68f67fab3b4f7e45c0d93527878131", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274187, "uuid": "aa09b0ed-ff74-4640-81b8-15a4a62f0128", "comment": "Malware payload", "value": "346cdfa14faf0cb690b6533bced6088e6f030ef69a736e6b61ef270b5b1e2399", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274187, "uuid": "f1488e65-d7b7-4670-a286-1d0d265740d1", "comment": "Malware payload", "value": "a7b5da242c3d2b2d644b1e255d7141edfba503da", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274187, "uuid": "dbe4781f-9e3a-44da-95eb-5d819b0cec36", "comment": "Malware payload", "value": "ffe3a057ffd896f9238e975175af41b048fbf34f9909c7dcf935003e0bea1e967021acd824c551c3853d06c40ab0c822", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274187, "uuid": "112fc6dc-8079-4c52-af90-8a7869c648ce", "value": "T1DCB423F5A7506BCC9D20522F2F4A2BCE19274B41B403C54A1AD2875A421F7FF4E7AD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274187, "uuid": "f5f2f648-5c4c-4cfd-b30e-327a61d3e2af", "value": "12288:kBRdpQ73iBVYWrCwvEXgbvM0a4OTHiQIIFzuK9Gd9IUw:kHUw2WG9XgbM0azTHiQIouDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274187, "uuid": "191fbc8d-edec-40ab-bfd6-d8ea42815b68", "value": 542317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274187, "uuid": "e2851151-944f-4642-b554-c7aa4c14645f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274187, "uuid": "5fd4d5cf-e3fd-47d8-a94f-1e579b7d47fb", "value": "346cdfa14faf0cb690b6533bced6088e6f030ef69a736e6b61ef270b5b1e2399.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed4938f-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791273413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273413, "uuid": "2bbb7100-3905-4171-adce-f883a983eea2", "comment": "Malware payload (LxBaseRAT)", "value": "5f98afddad6a8758c9d03fd6a86f9bbb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273413, "uuid": "6845025c-7d9b-46ce-a534-abcf8cf3e993", "comment": "Malware payload (LxBaseRAT)", "value": "34fa0fe3dbf98706f92ae133b37a0db4a1cbe9b91daaca07f32e5aa2fde94dc0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273413, "uuid": "1f939efc-568f-4e9d-b21e-658273eccc40", "comment": "Malware payload (LxBaseRAT)", "value": "d5b623ef2236d898041f6684e8da5efbfe7c62b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273413, "uuid": "7dbd4167-8c87-4d43-a5c0-731270ea321f", "comment": "Malware payload (LxBaseRAT)", "value": "cbfd11c29fd206658cd12e5912e1f37c051d7264d77092a4e9eea510124f4b2bb3d91347e34b3244ad3fcfecd87917ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273413, "uuid": "f500363b-331e-4f28-ae65-2d9c52516825", "value": "T151455A5303851BBDF68D0EC5C95B245B20F2E9677D241298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273413, "uuid": "a27e2ce3-dd8c-430b-8d44-99d09b88f519", "value": "1536:wZF3aH/8au1WTELo4hmTUzzA+rme0Um85fMPAkuDKNw6Jcf1m3a9cT7R36GUbsEa:dVQLo4tdZZBtDzabWDO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273413, "uuid": "e39e8e29-a087-4d4b-bfba-6a6d29da1f27", "value": 1270104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273413, "uuid": "b468c9ba-8f84-42fb-9884-7a0d4af07c90", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273413, "uuid": "e4443c29-567a-42e6-a8cb-e6d81642044d", "value": "RFQ-87654368RUS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb08e63-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274591, "uuid": "5d8acc92-02df-4d86-9ece-496fefb4ef3b", "comment": "Malware payload", "value": "7bd7f7129ee7a0f25c0a088e7b159fab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274591, "uuid": "e4553d70-6bda-4e69-a938-dde4f6b78e6f", "comment": "Malware payload", "value": "350cc9187b53145e84f3281d8975f84ba67ec04b3f2777e706098053f7496216", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274591, "uuid": "250bfa96-c11f-469d-be7d-8f748624e50c", "comment": "Malware payload", "value": "6a7f0084bdb5e3b062be8e52e47803241b3946b1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274591, "uuid": "422ec55e-a244-427b-9d56-b433af64e393", "comment": "Malware payload", "value": "3af176d6d7b2839cecb0ace78c428fc32e0cf094a9ab67391196cb3fd631db00c6164cae321f3a1708a7b473e9d836b4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274591, "uuid": "31af4536-3f39-4160-98d0-b78a358d1cb8", "value": "T122A4239581B983533484E3B5497B1AEA5F301CF28D3D674F88DAC5F81B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274591, "uuid": "1e5bdc78-3c79-4022-a478-c057c0543cb2", "value": "12288:jc1SCDe0U+m1V6ECbniSPfS3e2R3feeintFckY:ODe0wUTiSWzeeiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274591, "uuid": "6232a2e9-5396-468b-b41c-a9dc55273103", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274591, "uuid": "660caf29-e011-4a3d-a16a-8eb8bf70ef89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274591, "uuid": "ad58b231-1815-4be7-880d-69bb52e72fce", "value": "350cc9187b53145e84f3281d8975f84ba67ec04b3f2777e706098053f7496216.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd53025-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246035, "uuid": "36c93f87-cc72-409f-ac03-491a4430df24", "comment": "Malware payload (Mirai)", "value": "a4fd48c83fd4ae85dc68e2be6459c9ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246035, "uuid": "b26634e9-effb-4b5b-bedf-696b0c8e545d", "comment": "Malware payload (Mirai)", "value": "35abee6feac45863d560f2352631fc92bb0a4ca7c8054c8410505ece2c3904c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246035, "uuid": "ad218e5e-8af7-4bfd-b669-4f922f6f6cbc", "comment": "Malware payload (Mirai)", "value": "a1a6cf9d6a793ac1225d79d509bb0629e1c7c3fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246035, "uuid": "c110dac7-890b-4364-b9c7-063b1799302f", "comment": "Malware payload (Mirai)", "value": "5a30eded9d46614bed06152d5c939627196410df006f20dfacd6d47cdc62f2fa840441424798db1da49bdbf1d6b46ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246035, "uuid": "1adf0efd-d170-442b-8cfa-40c91b9cab03", "value": "T17CC43A52B9419F53C6C16ABBFF5E834833136B78D2EE710299156F74A3DB8860F3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246035, "uuid": "fb738ce7-535d-45da-800d-7ff3caab1a62", "value": "12288:YwGCb7jzq8JDTLfskxcWuUBc9mcYFjZrNrA6LHK7AIXR+Q:7O89UkaYFjZZLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246035, "uuid": "c0d2827b-92b7-486f-8ed7-2603ed6c8658", "value": 571472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246035, "uuid": "0058514a-6670-4138-8ba6-841a3939c147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246035, "uuid": "ec2255d9-6150-441b-95ff-7facae8a3531", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc44600-c143-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791263317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263317, "uuid": "70e885ce-ab13-4d82-a0a2-bb0e27cfd362", "comment": "Malware payload", "value": "33b1e34001d090e52f1c7ec298ed490a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263317, "uuid": "95f9142b-893d-4575-875d-5ed193aad5f0", "comment": "Malware payload", "value": "3636e185712543510af17ce5bce6c586fb2e6514a657111ef48b4df173724f26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263317, "uuid": "26e25a99-973c-445b-867f-b2f6fe26d37b", "comment": "Malware payload", "value": "8765416dabc24e29d05311da8fb479411ab3a573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263317, "uuid": "8a357233-2d5d-4982-a2dd-8b6523fe17af", "comment": "Malware payload", "value": "9029839c89e1c38f57c64da6de0483214eb4999f1eaabfe259f7e4f0b82e4c2489bc52225329b764e7e6a6191156c0cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263317, "uuid": "bff07369-7903-4c93-b50b-727ea9eaece6", "value": "T114C43A52B9419F53C6C16ABBFF5E834833136B78D2EE710299156F74A3DB8860F3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263317, "uuid": "0507e5dc-f402-48ac-94f7-09b8b9a60e37", "value": "12288:mwGCb7jzq8JDTLfskxcWuUBc9mcYFjZrNrA6LHK7AIXR+Q:VO89UkaYFjZZLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263317, "uuid": "0caae076-1ae9-4afe-b9e9-181fb5893e6c", "value": 571472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263317, "uuid": "b37037d0-2862-48d5-8214-726bd45a11df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263317, "uuid": "bb57e3c0-78d4-45bd-993d-511ee272fb7b", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044b6dc1-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275355, "uuid": "b0695dbf-0fa4-4486-98f9-c530c47d873f", "comment": "Malware payload", "value": "c5d18e3dfc173af0a8b0999108cd0fd5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275355, "uuid": "bc4dbd4e-690f-4914-b1e7-52b190b6acec", "comment": "Malware payload", "value": "37745d658a2716e3b0d2b6b12bb2348c3ede3ba55ea4cb281d524213e53546e9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275355, "uuid": "4da1091c-85fb-4b9c-bb6a-be0a94c65ecd", "comment": "Malware payload", "value": "eef6669e48a4912755e4d75a5c18b26b32671012", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275355, "uuid": "b7c6ee71-88a2-40d1-87a0-21ea80380b0a", "comment": "Malware payload", "value": "db88e0b19a46cfc5acfe1c55f7ee74c1f31e13165a1e503d7bb49e3c1ac777dd9a5c8272b0a52de65b7c67e6794d9aae", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275355, "uuid": "7f8b9b6d-164c-4d5f-a231-e16f526cd3d9", "value": "T1ADA4232C59610F367DB7778089395F02472498073BDDABEAC70F3AA84DDEC909A66748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275355, "uuid": "dd6092a0-5216-419d-b619-ba534fa5fee8", "value": "12288:A/pj5tFltx5309/1zYfcEaN9B/Jm0LU0gM7aQt:sjPFj30BqfclN9BhmSHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275355, "uuid": "6fb938e5-4dc7-4cd6-9dd3-9eb24f5bbcee", "value": 467527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275355, "uuid": "8204340f-d03b-4e0e-95c3-7abbb130cae4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275355, "uuid": "e7092ef1-0197-4bd8-8119-b88ff03648bb", "value": "37745d658a2716e3b0d2b6b12bb2348c3ede3ba55ea4cb281d524213e53546e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d801f117-c196-11f1-927a-4201ac107004", "comment": "Malware payload (KrasnyBanker)", "timestamp": 1791298903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298903, "uuid": "aa314f02-0785-4f8c-bce1-ef54cbf43d6f", "comment": "Malware payload (KrasnyBanker)", "value": "b5034e10e73388475cb3d383c2b3853a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KrasnyBanker", "colour": "#20741B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298903, "uuid": "6f33924d-8150-4bc8-923c-018226e2fca2", "comment": "Malware payload (KrasnyBanker)", "value": "3810dcbf520e708ced3f9de88308bcb270ba81f0bfeee13df59be681fb953559", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KrasnyBanker", "colour": "#20741B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298903, "uuid": "d80da933-7e1a-43c3-b29b-c69a9fb66a2f", "comment": "Malware payload (KrasnyBanker)", "value": "5cd7c1ec9d3408adfe55db39120f89cce4940225", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KrasnyBanker", "colour": "#20741B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298903, "uuid": "11a6cfcb-49cc-46c2-ae0b-2e780b32608e", "comment": "Malware payload (KrasnyBanker)", "value": "0bfb61ca7b737189cb7b108674e423ee4e2f7c0e8f372dd776d44e08c294e97cf15316a7d2c360cd90e8c0d4928a6201", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KrasnyBanker", "colour": "#20741B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298903, "uuid": "bbd9907c-ae08-4834-8f9d-188e562fe185", "value": "T191D449403BE88604F1FF0BB6A4B205814BF6F447AE76D39F199560992D72741EE60BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298903, "uuid": "b17f03d3-40e7-48dc-9798-7a7e9d185ebf", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298903, "uuid": "c42b1e2b-c5d2-4c0a-bba0-12a665461268", "value": "6144:c7d8FtqVJLSGchfyRBkkeB3BRRPX8B+nEA1/TotX4qYbBEl36FqHLlQB4v4YMO:dFAIaRakeVDR8B+n/64qqEl36Fqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298903, "uuid": "2332e5de-b042-425f-bc5f-c0d1544dd917", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298903, "uuid": "53633ab7-6ff1-4bc4-8a94-e3201cbc5c30", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298903, "uuid": "c395d8c0-ef6c-40ce-b94b-c3782173b989", "value": "3810dcbf520e708ced3f9de88308bcb270ba81f0bfeee13df59be681fb953559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c0df7d-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276450, "uuid": "424c1899-85f6-479a-8b77-8c7b49d33a20", "comment": "Malware payload", "value": "e2a2ac74df80f29361fe719ff60525c2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276450, "uuid": "00ae79d5-4833-4d54-bd71-0250d7a5deeb", "comment": "Malware payload", "value": "389a49fc8f1007c6b426bcdf32bb4c37b2c9780732f6143d62239ad3cecc2163", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276450, "uuid": "184d23f0-73ae-431c-8e85-f96b738583ef", "comment": "Malware payload", "value": "7cdde282d4b831e785d43bd0546873e0eec6a80d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276450, "uuid": "ec8511e6-b0ed-4f39-b269-3f4aafc0831e", "comment": "Malware payload", "value": "eaed0f81d95afd1389f1970edb0c89ddb770808f37ed714d36d498683fa2100feb96bd4f9f708fd94327d3521bc0085d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276450, "uuid": "7e44a7bd-a051-4593-b954-43caab474d79", "value": "T10DA4239C26D11A352CD7B294B9153F870770E71F37ECCAEBA60B39C46AADC30054665E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276450, "uuid": "764948f0-0e80-4b07-b04d-de97c80dddb5", "value": "12288:UJAjNngJOP1zYfcEaN9B/Jm0LU0gM7aQh:U+VgQSfclN9BhmSHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276450, "uuid": "3b07712b-1ef7-4fd5-9fee-703424ea83a6", "value": 467513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276450, "uuid": "b33e3135-1d13-41d1-afee-55bab42ec751", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276450, "uuid": "ba3598a5-f612-47db-aef2-1a7a9ad42384", "value": "389a49fc8f1007c6b426bcdf32bb4c37b2c9780732f6143d62239ad3cecc2163.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c78520-c149-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791265719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265719, "uuid": "6165303e-ce3b-43dc-8abe-4975141a1f5c", "comment": "Malware payload (Mirai)", "value": "3accdc63fc4ab2f3e84267da986083d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265719, "uuid": "3c5ddd38-aab5-48f1-9bbc-af1b75e80829", "comment": "Malware payload (Mirai)", "value": "38eef30c86f20c3edf76da715cea6028e01a29e47f614aadac0fff3e05a45804", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265719, "uuid": "c0f15870-7d0c-4fb6-b7eb-490fee1fda6f", "comment": "Malware payload (Mirai)", "value": "a198785ca78be625b51b19c3a77d1a88872fc0f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265719, "uuid": "04523aa0-c4fd-405c-ba36-a92af9af630a", "comment": "Malware payload (Mirai)", "value": "98e7c4fdc8daa2238839668f59e1dbaaaa832a2172c73df734c49d7a98d5c2dc71c72fc83a72adccd3201643844c5666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265719, "uuid": "69b48dcf-35e0-4810-89c3-860f41a867b6", "value": "T1ED1428CCEA50471BC5E323BAE68A428F33334B74A397F31559ABEBB027C27595D21191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265719, "uuid": "21063db5-3521-4014-bde3-1fa87579b02b", "value": "6144:SXbsMa7pvG8+2qJcumTdM/9xWmy3CwZU2Sk2:SAMa7pvG80m1q/3Wmy3CGU2Sk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791265719, "uuid": "77d14bb3-4f26-4e24-9773-84bdf8f46bf1", "value": 207319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791265719, "uuid": "fb7d066f-2f50-43b9-b9e2-aa231ded44a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265719, "uuid": "e512b371-cf91-4613-bd5c-d9a0fb0f7523", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a873cd-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275782, "uuid": "f7737763-76a5-4bdc-83bb-b61fa06871be", "comment": "Malware payload", "value": "32b56d58ac1ea216c6ad61da606e9613", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275782, "uuid": "2d2481cf-aeda-419d-bd11-4ecccd5bc058", "comment": "Malware payload", "value": "38f7c9ffddfa53c436e5a48fc0c29683487ba9d2fa2b549688c8884b35604f1b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275782, "uuid": "4245b4e2-8920-46b0-a1c5-b5156a27c6f9", "comment": "Malware payload", "value": "0a1cb21c120b0c4ef00014caa4aed175462a6b59", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275782, "uuid": "3f9d435a-2cff-4d37-affa-471b73774a0a", "comment": "Malware payload", "value": "5f016aa0c2bd69820ec27e0d162e66f23334c2a4815b2bf67a661f17e3feea903bf35344e1df01ea76df71dd935ab6c6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275782, "uuid": "683b5997-94d8-4724-819c-55595d3de3fa", "value": "T1715533C7813C2CC44F780A97ABEF855C61248EFC100218776F2685EB653F79F86B995A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275782, "uuid": "20729e92-9d0c-4697-bc89-8c877a3dee15", "value": "24576:gpjJAtUoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRb:g9GUoZ9bq+MmMEL+hcjXHC/wnwdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275782, "uuid": "2c9bbb30-18da-4427-8532-de8d7caa9aa9", "value": 1381514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275782, "uuid": "887f4bca-9f9e-402d-8af1-7dc3ea442ca8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275782, "uuid": "74400dc8-fd5a-4953-bb5b-f535d0c544df", "value": "38f7c9ffddfa53c436e5a48fc0c29683487ba9d2fa2b549688c8884b35604f1b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263449d4-c17b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791287009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287009, "uuid": "5f9efd46-25a5-4f2b-839a-efcfa8123e94", "comment": "Malware payload", "value": "044f1c1b3dbbb6a43e60ea5283f7ef8c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287009, "uuid": "0011d6bc-6d32-4d5f-a67c-961e4dc5b875", "comment": "Malware payload", "value": "38fc7910c4e49d6be701b7850ad3f00093735590d051bbeb1399ce149fc65b94", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287009, "uuid": "f695689e-ecbe-45ed-8ef4-34b8eb10fcfa", "comment": "Malware payload", "value": "577ae82e11f27b396eb56bb7f97e182a4299387d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287009, "uuid": "18093e2a-333b-4d71-8936-2867fbc03256", "comment": "Malware payload", "value": "4b1bab319432e864224f69d6382ae694d6cdb871de9815dc31427f05711cbecb75736a9a39dcbff0290f6c1c24b8f51f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287009, "uuid": "05f076bb-954a-42ba-acfe-eb5431ab7db0", "value": "T18C313A0179CC0C1A5A77D7D30962C35EE0FD9C23B33649EC4849A5DC759A06CE49B667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287009, "uuid": "d7eb0a2c-1ee1-4266-98dd-5d392c633143", "value": "24:Aq7QcCYcKYcMMQQck5KEQcLIs5KzYcKAB1Qc4IAB17Pa4B17S7KC0505aUHYcYci:y+G8HQYC2x9Ob4ByqEZ52xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287009, "uuid": "a2761041-7508-4a66-b7c1-2bbcb70eac89", "value": 1452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287009, "uuid": "02fc1be3-9bf3-4c60-a994-bdd05341aaf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287009, "uuid": "5e86a5c9-2d32-4b5e-acb8-e25f2f47b262", "value": "E001.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a4d9ed-c11f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791247548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247548, "uuid": "1e702249-5729-4d80-a6dd-a33d46cd56b7", "comment": "Malware payload", "value": "80cc2a3b39800328edb176a63aeeb043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247548, "uuid": "19f9748d-00a2-43cf-aec2-7daaa547823b", "comment": "Malware payload", "value": "3941a79f5d485652ff524485aca66a955392d565991015839979e23846ed7ff4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247548, "uuid": "e4c43cd9-6482-4515-96e9-86218292de28", "comment": "Malware payload", "value": "c323adc643312679ff9d3a82561907a6897c7c33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247548, "uuid": "e6fd0a6c-d78e-4f6b-b9c7-2f8c6eb6e403", "comment": "Malware payload", "value": "df588f56e1272a5dc7856cad76cd86435c50f5ac5bdbae8a1880b93c65803cd28159ce77e8c66470fa99b84b9a20fc05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247548, "uuid": "b22a2703-d8dc-4b47-afd7-204beaebf46a", "value": "T136664B537A78E70EE228213048B1CAC56B6D1C4641E6991BB391F31DE9F31AC4E6EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247548, "uuid": "81d0a156-615a-451f-96bc-1a541e8d739b", "value": "49152:zsojg9gV2IIIc70zBccoogCTXRovC/T7x+IwPDMQB3c0fWrb5elRok34ox9BOIh9:CJMgfokLaNn4jEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791247548, "uuid": "892c227a-6a60-4869-8ce2-6ad14efe1a0d", "value": 6947009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791247548, "uuid": "e15f0969-e7d7-4e31-8ab2-af72b73a8a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247548, "uuid": "5b4837bb-9609-4c49-83ba-d729e02b4bf2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80774f3c-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791273416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273416, "uuid": "a4cd4145-d10c-4017-b74f-abbf7b9f99eb", "comment": "Malware payload (Formbook)", "value": "08da4003dd5f6e84e190d0ce53364ddd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273416, "uuid": "a09c0442-8608-4eb6-91f4-82f058f5277a", "comment": "Malware payload (Formbook)", "value": "395db105e8ae64c257eb3752c9ad4b2f88439c3152e07614fd4ac7a64f43e13d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273416, "uuid": "c44218e5-990a-46da-be51-7037569c7431", "comment": "Malware payload (Formbook)", "value": "4e73e74bbc63ab1cfc08d3ba623f51a1e899f4a8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273416, "uuid": "4fef3720-de59-49ec-a8ec-81bccff0bfe4", "comment": "Malware payload (Formbook)", "value": "0d93c7da0de70f8f10bae367d5854a34e25a8946e2abf805fbacc6227228a99c7fc71a0b6079f162137abc6302fd52f7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273416, "uuid": "5ea346ba-03cd-4072-a2e5-b83f1f36aa59", "value": "T1E1D20CB6D6ECE0BD91F1E7002976ECA5086FA5412E116B8D1F6907C5C13AF30A92FB34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273416, "uuid": "1d96dc30-d7f2-4989-ac5a-9355f87413eb", "value": "192:wYFMS1x6iHw4Wem2pyedHFy/F2YtEel+YCYHy+eKw+34g4S8OqFBHby0vhDPedMY:wYk4WNj7I7b6VD959", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273416, "uuid": "4e6fc221-ee5f-4e35-bd66-39e0a6e4874f", "value": 29262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273416, "uuid": "be5993c6-7ab1-4632-8a94-ab2ddcd7b6a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273416, "uuid": "f8c65304-d157-462e-997c-4f682f15c078", "value": "Remittance Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd73be0f-c154-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270566, "uuid": "8bc0d85f-e62c-4b95-937e-3c850f957375", "comment": "Malware payload", "value": "2892e433d5163f9250768e1a1c595c46", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270566, "uuid": "4c0f3368-3401-4e8b-b26e-4c32d78ccc1b", "comment": "Malware payload", "value": "396cd3da28dfd0ef477c87568329c845f7de2c6c4815c80d4e921b3c49500cda", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270566, "uuid": "38f99a8d-a6bf-4a12-893b-01aa842ee007", "comment": "Malware payload", "value": "f0cfa126d20ef3b07108f4469095dad732ed5f07", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270566, "uuid": "e9167f40-dfe6-4211-858c-e728feafe8d9", "comment": "Malware payload", "value": "f47898a7fa527e80b5f6d4c6f6e5d0221b2342a26b7c02b0d46589ec00f71d803ff0271fb3ab99f4df190cfe4c89e7fa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270566, "uuid": "33a2f1e2-5dd3-413c-8988-0d6a84f44714", "value": "T1EBA4236D922554376D67B9C0AD1D2B020E70D18932DDDBD5CE0F38A08EFAC9C1EC61AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270566, "uuid": "0eb7306f-500e-4baa-8bce-734a2408257d", "value": "12288:9W+GusvMa+AzYfcEaN9B/Jm0LU0gM7aQr:9WF/vMacfclN9BhmSHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270566, "uuid": "358a67fd-1739-4cd4-ab76-b62659dbc6e2", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270566, "uuid": "98b84438-2ef0-4ea3-99a0-3ad335d5b236", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270566, "uuid": "47f486af-0bd2-4bc4-b48d-56e65b8b9040", "value": "396cd3da28dfd0ef477c87568329c845f7de2c6c4815c80d4e921b3c49500cda.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e19bde6-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263883, "uuid": "f69b3528-68dc-4e93-95fd-e110dfde586c", "comment": "Malware payload (Mirai)", "value": "7cf5d3297ad979790230e376e62fd51d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263883, "uuid": "70fc63ef-090b-40cd-b5ef-efaaa3286482", "comment": "Malware payload (Mirai)", "value": "398e7b898e5ab11fc20f375d59714256e901d9ee243987ee738394b7c7f31f9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263883, "uuid": "eb990b7b-6670-407c-b2e5-0e2b4b40bd6c", "comment": "Malware payload (Mirai)", "value": "cd03541e16bd1795ab643f562a0e55f04e2a0506", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263883, "uuid": "b1585652-92fd-471d-8e88-7b9a79428f97", "comment": "Malware payload (Mirai)", "value": "1293dc99578811c8e54b44f363ba6e0fb8383a3e23a3b594c6015ea6b8332b24715966a569bc5dad16eaa191090044ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263883, "uuid": "6de7ea2a-ab24-4798-a774-65daa76709ad", "value": "T1D054F7067B918EF7C89FCD3706F6861120CDF44721A5772B7678EB1CBA0A94F49938A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263883, "uuid": "4ff2d181-40f0-46bd-b512-c0f04e40ccf2", "value": "6144:NodlSwRLETQFuPYpDYANNFVFe+oOSongCzBYjAUW7gaQP:NWYUjYAHoOSongCzBYjAUW7gaQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263883, "uuid": "b1f8d454-fec8-4c9f-805c-97c313400d90", "value": 279644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263883, "uuid": "10753b1d-7922-4f12-8e2b-2156758e7e57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263883, "uuid": "e262497f-9638-4409-a3f1-99ac71727f5b", "value": "qv3.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76df50c0-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272541, "uuid": "c34be708-d0a2-4908-b928-3d79391b75b0", "comment": "Malware payload", "value": "0e27983a8e40f72ada58180d60c8aba8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272541, "uuid": "fba901ca-4e1e-4d6c-99d0-408aa8e2bc24", "comment": "Malware payload", "value": "399e565a5903bf72e8fbc67cd1ca7380c2015db3a02958709c11229a6188fe45", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272541, "uuid": "776684b0-f4d2-414e-ae3e-0255ae6ade4b", "comment": "Malware payload", "value": "93b955a3ce61a84d998f679ee4a9015441f6f567", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272541, "uuid": "86bfd26f-e233-4e21-bf04-756910f7cc64", "comment": "Malware payload", "value": "1c6eb1ae829f544167c07bc337b4bc61975d0509a4ae854d0ef18896bdfcb5cea592a560fa59f8552bcb01abc55b5476", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272541, "uuid": "d1812c4d-6d85-495e-9d3a-30f88863ddf3", "value": "T104C42304340641D5835A2B1EAEC4E7E0BEB560DBFA1CF940AADD7ED06DE96A177C1833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272541, "uuid": "effb6796-d6f9-41e2-9d7a-6deafa007de9", "value": "12288:j6wlOMWROC/FTeHo22Qm7NzofOr68mueA924EwC0:b4MQOC/gHozN7NzomW8UA9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272541, "uuid": "52456fac-8404-440a-a80f-5400786d08a3", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272541, "uuid": "416689e0-942c-46e2-a67a-3429a3ef2bbf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272541, "uuid": "74b9ca36-be52-4def-9098-4a87faeeec7f", "value": "399e565a5903bf72e8fbc67cd1ca7380c2015db3a02958709c11229a6188fe45.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b8e902-c19a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791300399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300399, "uuid": "fad79b18-55b9-43cc-8d50-4d77046e5222", "comment": "Malware payload", "value": "a837169cae5a4590d3c05f550a468868", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300399, "uuid": "7f5edc79-3f57-4a45-bcdf-434acf37343f", "comment": "Malware payload", "value": "3a441a4d4f9c44d7a4c965db9de14e8ebb5032c67a3f12bba80d6d39a9b23411", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300399, "uuid": "267d9277-46ae-45de-95ce-c0489c3a3198", "comment": "Malware payload", "value": "bb7192a139109f881d869a16e695dc5c339b7e7c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300399, "uuid": "4a204991-90ba-4a7f-afaa-ac423231cd40", "comment": "Malware payload", "value": "c927d20f49f23100547bd8db82dc4e27a38cacc82ea060a0697929e5b2d8d5d871cffa931762f11b70989f4bf33b4c95", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300399, "uuid": "bab612ed-344d-4f94-bd96-d8a62b9f422f", "value": "T15FF533A56D9E3CB1D473353CE5185DA22E338684811B9C37247CB3CB2C9AF6A1E0B756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300399, "uuid": "b8df6929-8a35-44d2-84ed-c4a0e595af25", "value": "98304:yGQ7eCUfCW7XUHeH5vk76u0VpbzV9wauaoEC5M:/a+HJs6z9k8Cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300399, "uuid": "fb29aa4a-4096-46d2-b03a-527032faa3a3", "value": 3644681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300399, "uuid": "2dd07ce8-20be-4fa9-83dc-03edf0bc1425", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300399, "uuid": "2b214fc0-3684-4233-a9ae-0a0577374d8c", "value": "Ikea_Client_Cracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f07887-c119-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245154, "uuid": "f95e0b47-4a67-4906-a7fd-ae36f8b84314", "comment": "Malware payload (Mirai)", "value": "8a7c0e23511eb94f4401f1ba5acff507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245154, "uuid": "7d0405fd-6624-40a8-b97b-ab50ad134290", "comment": "Malware payload (Mirai)", "value": "3abe9989884634b7937dc8d1903f861e0155def518e3384748f1b8618258a4fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245154, "uuid": "6370fdb8-3cda-4250-bcb6-8ef07244e218", "comment": "Malware payload (Mirai)", "value": "5a8eb4c0f6cc4a088a3a016654c8984ca50d0c1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245154, "uuid": "bf6c0eb6-9e9a-4a98-90b7-7b3f30be4c89", "comment": "Malware payload (Mirai)", "value": "5d035f277f806952cd595f990278ac6b38247a54fe68dcbab5485d375fccba420a397c34d2c5ed45707ab68556231ac0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245154, "uuid": "62206d81-6c89-48e6-80c1-8116c9330fb4", "value": "T17105A70A3E22DF7EF578873047F78634969936D62AE18585B19CD20C5F3028E591FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245154, "uuid": "c8514261-cd3b-4396-91f2-909f844608a0", "value": "6144:5AyFcEBJUxhS4kDqtuL30jka7GC4A/ZBI4/1BkXLSKVIyQQd3JfzEznPJxdTe21v:5wwD/pIBZ/Vsfolzl8ePCuqnLNb7iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245154, "uuid": "94d0cd94-a920-48ea-8f75-dea9b9900350", "value": 827328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245154, "uuid": "95487076-0af9-4d68-bf03-4e7934b98ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245154, "uuid": "874591e8-9cec-43f3-b193-29b869f5af29", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38344a22-c163-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276731, "uuid": "f6bdf51f-4a19-4aac-8d06-d0b72dca20cd", "comment": "Malware payload", "value": "6a0e6ff9860e0d5e272b985186203db3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276731, "uuid": "7c1f9049-2ef0-4fac-afa2-7100991123e2", "comment": "Malware payload", "value": "3aed1cc512c74bee2d494c7424f0211a53d1d87406ce61ec53619d8942d99135", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276731, "uuid": "36995690-1da6-4b75-a362-31eafa86f80c", "comment": "Malware payload", "value": "4491a5b4e821510b27d56d99a633b03af4a2ffcb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276731, "uuid": "619641c9-24cd-41d2-b829-22a27cc7fc4c", "comment": "Malware payload", "value": "ffccd13d1c656a5905a5f2d12779b9aeb0e5f66670ff6058d79a308483a11c50642ebd900a33d18318a007801ea06b09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276731, "uuid": "f0719c2b-528f-45c5-955c-088a32f5bdf8", "value": "T12505157782BD2E3EC4275959CE793C0C9CF054A20B4EF47AED3764C9E87CB9966A0160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276731, "uuid": "451d3612-ace1-42af-8b37-05ac3176f5d3", "value": "192:eqMvJgCDI32eY8e4dWgKsB4siIe4x9F+mQSxeT2hGxryAOXZtaIPZvtlqao8360v:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276731, "uuid": "858a08b9-a2ff-419d-8436-37be9b64a6d3", "value": 820487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276731, "uuid": "02b40f69-8030-4129-b76a-9faceb5aceec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276731, "uuid": "92e7c354-5d12-4fd4-b375-7e16d0d52f9d", "value": "RFQ-06-10-26-signed_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bf7500-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272090, "uuid": "046fab8e-82bd-4c15-a3ac-e554f1044b41", "comment": "Malware payload", "value": "6f1de84430eca5688411dea0569f5710", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272090, "uuid": "7cf90f49-e2dd-4329-b53f-92a300ddeb0d", "comment": "Malware payload", "value": "3b246d3c6b3223a6efdc73762f4bf76f73f76f59494a55ec587fe70c3da9ea2b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272090, "uuid": "dc0f36e8-a969-4a7c-9802-e1900396e8d7", "comment": "Malware payload", "value": "324f7e0979ef13961972814f578e6884c057a58f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272090, "uuid": "b5c8f08b-4070-4213-9e91-e929290fa2e2", "comment": "Malware payload", "value": "b8059ad427a38c53ad3bc48304becdc801f52539800500a24d7937347d898126b4c0ba1b650e628194c1fe8532f77724", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272090, "uuid": "dafbc1a4-8ff2-4dca-b1dc-d6b4a137b828", "value": "T1C5A4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272090, "uuid": "78805598-8374-436f-a089-7681b0f8ef69", "value": "12288:or06rUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZX:or06rUv4t1cNk/wjibhv4b2On1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272090, "uuid": "9bbfcc94-106b-4990-be73-f2a440bb3304", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272090, "uuid": "122cd536-98a2-4431-a93c-fc34a00cf265", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272090, "uuid": "80f29f1c-68eb-49f6-84ad-86d8351e1177", "value": "3b246d3c6b3223a6efdc73762f4bf76f73f76f59494a55ec587fe70c3da9ea2b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270b5793-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288299, "uuid": "4a001bf1-417f-460d-b2ce-8f24c49efee3", "comment": "Malware payload (Mirai)", "value": "1198c91c57c9ab592cae4d1fe4c1ad29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288299, "uuid": "c8c93b49-dc7a-4cc3-8d68-40bcd3023519", "comment": "Malware payload (Mirai)", "value": "3b30939a48042d62d0c611df34d146fc51f0df301454a63be46d54bfed69f4c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288299, "uuid": "0a229bd7-b065-4463-99c1-f603f7650192", "comment": "Malware payload (Mirai)", "value": "b0d406a4b53b1051f4f4f5f647a5a8d596379b0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288299, "uuid": "a65200f3-3568-49f7-96ef-8fba5a24b755", "comment": "Malware payload (Mirai)", "value": "1cb684b7088df4e0224c9af1ecce65be6f05ba68ecfa8a17a2db28dff9888daedb2324f85d06cc14f266cd8c4acf2362", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288299, "uuid": "dc33167c-ece6-41f1-a45d-ee0ad37c35ab", "value": "T191C48D06AAF7D8B6F4A240B1115227B54963D97625BBD84BDFD62C90DE301C0E32D3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288299, "uuid": "e0a87740-18ca-4982-a888-dba5746b772c", "value": "6144:9HvQGVHVdYf8PF9N31dUwcCPdqdN3uUKRKxmZAg1JY+:JvnV1dPFdNPd4EomZAwY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288299, "uuid": "590e05c8-59cc-41bf-8f6b-c28ed2da53d0", "value": 579576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288299, "uuid": "b36a8dc6-ddbc-4d9a-8533-ac2515477479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288299, "uuid": "dcb955b2-3eec-4e01-bb5a-67d66660161f", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96da78a9-c185-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791291493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291493, "uuid": "95cb9ba6-6c93-436d-8f9f-0329d6e5d05f", "comment": "Malware payload", "value": "13b6f37e067212a02c1291356d923a11", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291493, "uuid": "6f197ccb-4726-4bd7-94c1-71ea4051dcee", "comment": "Malware payload", "value": "3b744752cbf73041670a52f028475a15eee49f058270412e34045d1a957a2763", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291493, "uuid": "7611eb4e-48be-4c60-ada7-35ae963bc07f", "comment": "Malware payload", "value": "e46f88098ed34fba95185dfc94e341034ca133f5", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291493, "uuid": "12e019a2-dddd-4c7f-8481-491347b782f9", "comment": "Malware payload", "value": "7f3474ba5decb77b3be27ff5e14b0ae78f56305c28aa494a1a39db9d9a860c46b0892006ef98319ace8e30324f2de0ef", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291493, "uuid": "5f97e792-c1d1-4634-a4f7-78064d0e6553", "value": "T1BCA6C719BB21EDDCE53CD9F278DDD21582193C7984072D427F862B8E3997A34D48A32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291493, "uuid": "9b5075c2-70a0-46d5-bf7a-991877ee72b4", "value": "49152:mIKDpEzw7qTr/bbQPAhQx1FEP2rjB/IO:qW7FQGPjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791291493, "uuid": "de747a58-ca1a-44cc-990c-d9e6aaa323dd", "value": 9689088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791291493, "uuid": "9625622f-6267-4c14-8141-ba07f1f9a4d8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291493, "uuid": "46d30e68-71e0-4ced-9481-553699265620", "value": "No.0602026-3.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44db881-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273611, "uuid": "0681d986-510a-4dc5-9a19-d99cd8ecb2e2", "comment": "Malware payload", "value": "e3d5e7e3dad2e8cb5f282ba46407680d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273611, "uuid": "218f58b2-aa35-47e8-93c1-883089404f01", "comment": "Malware payload", "value": "3b96c60460502aca6aa486607224f13004f100085998851d48862dafb55c5d1e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273611, "uuid": "bdbae897-63e4-4958-9d81-1ab18759ef01", "comment": "Malware payload", "value": "6e9abd2982d4d921e83fd9359d225639a9b60b85", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273611, "uuid": "5a94ff0d-b92f-4ab7-a14c-0efa8fea521c", "comment": "Malware payload", "value": "b4ee4992caca0db15e0235edcd4426de57e1dcc5787c9e1d85c04a35fe5024c3a888f1d3f40984f950ae3b846d67386c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273611, "uuid": "453384f1-4542-47f3-95d2-7767247d87bf", "value": "T162B4230A85D01FFF8A9ECB9946D4A4672FF467952F93565BC0CD20700AEA203D6EFC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273611, "uuid": "5da68912-efd6-424b-8859-03c62210aeb7", "value": "12288:jvOi3UDYXndLQ/jJOjB89RitlR0XjuIkVp69d3iY829uhBYbY7vPpCkIO:jWiEGnlQ/jwyil0X7kWv3icYYb9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273611, "uuid": "e1825dbb-28e6-4c05-a201-0b5f6b063abe", "value": 540419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273611, "uuid": "8751048d-3b2e-4000-babb-23c1dee8f9ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273611, "uuid": "0a01dac8-ef2e-4fd6-b7a0-91328e2b3d25", "value": "3b96c60460502aca6aa486607224f13004f100085998851d48862dafb55c5d1e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e51a822-c143-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791262997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262997, "uuid": "5d8b0a43-adfa-4d01-830e-9eb0fc740c99", "comment": "Malware payload (Mirai)", "value": "c7f9cdf79bcb0d7770ae9f8ebe2698f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262997, "uuid": "7b183ebf-e9b9-428c-b786-fe703f66856a", "comment": "Malware payload (Mirai)", "value": "3c0ce274aea0d1a8ccb9e352fc281ef502e6078e4a6df7cf305b3c6e3b2e553b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262997, "uuid": "213c1c90-dca2-4818-8d88-82ba29283d10", "comment": "Malware payload (Mirai)", "value": "07c64f9fa41dde7c10cbb89d6c1252aa7663e8a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262997, "uuid": "c2ed627e-aacf-4c15-a22c-d755b3844265", "comment": "Malware payload (Mirai)", "value": "598f644336f9e56d1a5ad3175b74d951e86d936189b178f64f9577ea3afe94cbe3b7924b0a8f39cb4c65e238fa0c7f97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262997, "uuid": "383fee8a-ebf5-48dd-bb2b-a72f10cf5bd2", "value": "T1D6C41966B9419B41D5C12ABEFF5E834933131F78E2EE72019D146F34A7DB88A0F3A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262997, "uuid": "29ebe9e4-692d-4fb8-a3e9-cf16b0dd735d", "value": "12288:35UYwgZH1rFGJ2RegfQYWknAhbM9AFagbIqKhMp3B6Kao8+BhJ3fWP:35nZ6QJYvHbp/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262997, "uuid": "80aa1a04-198d-48ab-9f49-e562ba94c3e4", "value": 564764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262997, "uuid": "158a8b15-e554-43fa-970f-be86d6fe6cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262997, "uuid": "6a12cdb7-d07a-40c1-a9be-a120a419142c", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55537e8d-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274203, "uuid": "f9a57227-e932-4f8b-8b1e-63fcb49cc446", "comment": "Malware payload", "value": "22d53af515b747ae0e3220bee31f51b7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274203, "uuid": "556a1db7-7fda-4c9b-80d5-0692151dadd3", "comment": "Malware payload", "value": "3cc718a9c0e23a016fe63b9e4ca2c96ecae7e460094fc06a3d714e63536d4227", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274203, "uuid": "0a3f33b5-767e-4372-8c4a-e87630545a17", "comment": "Malware payload", "value": "a3d037b78a3a00dd14f406c839b7b1e912373ea8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274203, "uuid": "c861cf99-fb74-4232-aa70-659415c5c412", "comment": "Malware payload", "value": "27e6a541b7ac6f550a77f3a75fe9025acbb83fae4a21348e4b0f80413c289ad695be668492864f70a01ddb676168e760", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274203, "uuid": "58c4433a-c1b4-4631-8b7a-1b1430319435", "value": "T167A4239581B987533484E3B5497B1AEA5F301CF28D3D674F88DAC5F80B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274203, "uuid": "33775e60-a921-4617-b2ae-a177c9ecb56a", "value": "12288:3c4SCDe0U+m1V6ECbniSPfS3e2R3feeintFckz:LDe0wUTiSWzeeiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274203, "uuid": "4dcd8849-10d0-4942-ba89-457d77012e2b", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274203, "uuid": "6e0138f8-0cac-402f-a844-277cbbe94912", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274203, "uuid": "71030305-d5f0-4d74-ba7a-13d8888eb0b3", "value": "3cc718a9c0e23a016fe63b9e4ca2c96ecae7e460094fc06a3d714e63536d4227.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf46ad2-c13f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791261572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261572, "uuid": "b57e15cb-e326-4c4a-b22a-5f8498fd016a", "comment": "Malware payload (Mirai)", "value": "920e467bba1b7de0d7f1a9ae351a7553", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261572, "uuid": "3a687422-ddd7-48a0-8877-5a781c4e56d7", "comment": "Malware payload (Mirai)", "value": "3d3209f6ec6be23b20da485ec727a2af2d16ab20258a50f6d01cc43fec207b01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261572, "uuid": "ccb8acbe-4170-435f-a0d4-07e4bce33f10", "comment": "Malware payload (Mirai)", "value": "59be1f53025a67b2e18f44bb0ad9fbc2f61ee9f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261572, "uuid": "e251f1f2-ce39-4009-a604-9a16b5c77bfd", "comment": "Malware payload (Mirai)", "value": "f3823edea6cd0d298adda3bf1d34b3b058cb2894287a1236448bc77042daa1f700daf94a013366917e10ef5dd08a6ccc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261572, "uuid": "bad514fc-3d17-4933-97a5-f1a64038be59", "value": "T14C732A26B97A1E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261572, "uuid": "a091cbf4-e5fd-4051-841d-20a288877c4b", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9Wu:927jqCt8v3GI/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791261572, "uuid": "725afe7d-271d-4021-9046-c9144b03d1ec", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791261572, "uuid": "db0d3707-a802-407c-a961-fa97dd2bbd40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261572, "uuid": "89d4f0e7-3d2d-4cd3-b721-d30f1af82b5f", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6902bb3-c148-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791265346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265346, "uuid": "b0277674-1f72-46a2-b2d8-06f3ecd081c3", "comment": "Malware payload (RemcosRAT)", "value": "667411b8149c16741fc275199b41d598", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265346, "uuid": "5c158c4e-5e69-4937-8f6d-909abfd9befc", "comment": "Malware payload (RemcosRAT)", "value": "3d6225afcf027c87fafefe4cd2649d30da0da4eeef0a167309437a8ad11a765d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265346, "uuid": "a2115656-6d47-4f9c-bae3-39a8890a3e18", "comment": "Malware payload (RemcosRAT)", "value": "33b8ba84b3dd88df16d597eccc401a139d5a0791", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265346, "uuid": "4f645224-d352-438e-9d5c-4e19d0fb10a1", "comment": "Malware payload (RemcosRAT)", "value": "277bb3ba1b884bc19346bc1b7acea229b02694281ed837a075e8c48551085e7e44e738fd703d2bbbcb19c2c0294adb13", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265346, "uuid": "a3bac4e7-5972-499f-864c-1061e3be3678", "value": "T150622E7E4B70F88CC77255BD61C8263A40EB55BBE1C7160AF4DC1077A3A82AC2CB9206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265346, "uuid": "131280e4-e37d-4fd2-a047-2f103ef18d2b", "value": "48:3LbTci/k9bTciWNkdQT4d5gTc1Z8w/5bTcipqbTci06aR3kyRbTci/G:7bTci/6bTcisK5T5bTci8bTcicBbTciO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791265346, "uuid": "5286a1da-8630-4d25-8b55-e3a91cc21477", "value": 14749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791265346, "uuid": "06ba2469-2f43-481e-8897-269e4b3ca829", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265346, "uuid": "71110587-a506-41d0-8c5a-3e1b201e1d50", "value": "goodthingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a94501-c19a-11f1-927a-4201ac107004", "comment": "Malware payload (Phorpiex)", "timestamp": 1791300639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300639, "uuid": "8ad97951-f16f-421c-a23a-592e82372bad", "comment": "Malware payload (Phorpiex)", "value": "62fe42ce45fd48c9c492758f58e2763d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300639, "uuid": "68dd7c68-66a2-48c2-b396-2998e7b81d08", "comment": "Malware payload (Phorpiex)", "value": "3dbbd0d946ccb43a77198e3b863c8b3150f6f328ac7c7e196cc75cd2519755e3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300639, "uuid": "bb0ff579-f879-4753-a54c-c26d1d205e0d", "comment": "Malware payload (Phorpiex)", "value": "3011c30713720863d49fa99d729ef21fba91a26c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300639, "uuid": "85164a29-2b2a-4b8c-abe8-3f6a16be79c3", "comment": "Malware payload (Phorpiex)", "value": "05df5043cf967ad266e7f1040de66e2984e85e325f1b8f71ded96c474f82ee6b7a0b894db8af96f74c252aff50153200", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300639, "uuid": "1c53c697-b586-4f9c-825d-20b742030439", "value": "T13712290E3DC54061E1A108F067B5C78A0ABD21732785B2DFB7F7A65A0BB53D0E4196BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300639, "uuid": "03465927-294a-4a3a-967e-36a283611687", "value": "01b5d5afc66d059a23feb22d7bdd1c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300639, "uuid": "c16ad02b-aec4-46a0-adef-64901773a787", "value": "96:vdHHHqMR6Nvdh0dYDSYx+lNIfobSPtJvm0oPt9JxGE9Rh2qhpC7tCEf:vdHnqMR6dnx+MfxBYnJxTThthKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300639, "uuid": "4d9320e6-33ca-41df-bcfe-d641d19ce5a9", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300639, "uuid": "b332d3c6-68e7-403c-bb50-3456eada06bb", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300639, "uuid": "5107b81a-01e0-4d60-a37d-05a04c838dc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd833fba-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273626, "uuid": "bb225278-6696-45d1-9aa5-ce85df255212", "comment": "Malware payload", "value": "90c3b384fb1f21c8fcb8ef6b7e5126d7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273626, "uuid": "d4052a1e-4188-4cd5-842e-3c4f2e7e77cb", "comment": "Malware payload", "value": "3ddf2025198b0240f1aa71d5891e4f8e92ba9a448a394a171859788eb5687199", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273626, "uuid": "5340ef81-cd0e-41eb-b031-59b20ae0d32c", "comment": "Malware payload", "value": "5189cae52db88a7423e39c7602fc3f91e96085b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273626, "uuid": "f76cf6e5-d638-4542-8e5f-ef3d4ac1e846", "comment": "Malware payload", "value": "5541120a1ff1bd05b94b76acd248ff7a683002c00a02ec794f9ee6ce0a54b38c0dc62e08289c38f58e057b98eeccd759", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273626, "uuid": "1be501df-422b-4278-82cb-c8e6225ecf83", "value": "T138C423B7179AB0897503E3E4854C6D9489AF20D957C3436ECA1E2693F5BE147FB2009E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273626, "uuid": "65d6834c-2668-4a80-8e46-734fb3123d7c", "value": "12288:+eElNtIBB2gX3U5LA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9N3ezs:+eSIBBfHVm6Jj6ESfUxZ91kmY/9HeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273626, "uuid": "e790b065-5d86-4da5-9889-095e1a860384", "value": 584435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273626, "uuid": "2f063a93-c466-4983-8ee6-876b58e65f9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273626, "uuid": "8f47b129-f219-4768-9a66-94fcb483facb", "value": "3ddf2025198b0240f1aa71d5891e4f8e92ba9a448a394a171859788eb5687199.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d51308-c146-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791264317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264317, "uuid": "949eb456-7e0f-4354-937b-0c60c4469948", "comment": "Malware payload (Gafgyt)", "value": "b7b25f33ca094b83a5249d050d6e2cad", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264317, "uuid": "b8a0b168-1f31-4a95-9c7c-1a08e3abb7c0", "comment": "Malware payload (Gafgyt)", "value": "3e5586f6993bed97ae83472729a872385ddfde061e3c9eed7fbdeb401b738fde", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264317, "uuid": "a6c86653-e1e8-4a00-aeca-59a600a6fa3b", "comment": "Malware payload (Gafgyt)", "value": "951558a9aedae04f65f675806f49fa8fb1c02c8a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264317, "uuid": "96c0884b-a515-481b-8ff1-9e743e7fa46a", "comment": "Malware payload (Gafgyt)", "value": "eb721fbdc9995735dea20374c0943794590e3a85bad8eea008a86d2a80242a3f0373e5134ed11542317f27b377d1bad9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264317, "uuid": "4674a303-54aa-4ab6-8c53-8822a1d4bf65", "value": "T117E3E5CCFD64476FC2D223BAF74A428F37261A789797F32159A7E9B02BC17481D28191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264317, "uuid": "8988e818-1cf2-49af-af08-ef0ba133784b", "value": "3072:qklR8BGM3+mgYwGMyZRgi8KGqiPc+k3WL7tX8h3GbF2lLothTpKkxnwjUly8CTlj:xnaUszTAYoicnaFD6knQCquS5hA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264317, "uuid": "fc1a4938-723c-4974-9352-fc656f0f6d1e", "value": 147864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264317, "uuid": "e78960c8-0961-44b2-a35b-7f0e90a05c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264317, "uuid": "bbb8199a-ee61-42f8-b11e-919f0f6dd8f7", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564a02bb-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274634, "uuid": "72ff4056-f880-4826-a0aa-472b1881b8d4", "comment": "Malware payload", "value": "8bbbf62d1d3ef22d64234fb7f5c3999c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274634, "uuid": "e2f016ff-fb6e-41c2-8876-894bc4faa1e8", "comment": "Malware payload", "value": "3e69b464113cc426a315d90a4f6ed2859f1a6d01a357381cbad51d194edf4b2a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274634, "uuid": "5576caaf-1f39-4866-b8fa-b29ed984a9cd", "comment": "Malware payload", "value": "06aff40c9fa1ad6123ce7cc4a486c02f9fd4ff43", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274634, "uuid": "74cc9697-d61a-494b-9ca4-895d1f4dfb2b", "comment": "Malware payload", "value": "8d885e63952ee11b38479d2a0b80360a749f8dfafdb9dd04139f5ecb3f89fb3dad8156e19d8c2662dfb23a8b24ae1f80", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274634, "uuid": "b3a05f02-e415-4977-8d3e-b3669fd392be", "value": "T165A4238274716D0AD096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274634, "uuid": "d3d0e41b-8229-4768-ae4e-8a3e50ee4d91", "value": "12288:8r061Uv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZN:8r061Uv4t1cNk/wjibhv4b2On7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274634, "uuid": "c17c5bc9-2926-477e-9826-fb7bc9fe913c", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274634, "uuid": "3ff9596c-a6e4-43ab-b319-4d9180dd0705", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274634, "uuid": "d484e85b-9ec1-4202-adc1-ad4ff11ad7a7", "value": "3e69b464113cc426a315d90a4f6ed2859f1a6d01a357381cbad51d194edf4b2a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59994a82-c182-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290101, "uuid": "8698cd58-f196-410f-bcb1-a5794a7bac63", "comment": "Malware payload (Mirai)", "value": "8abac81c2823bb3ec28d6c2636b9702e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290101, "uuid": "7e5630dd-174c-45f9-9116-8999a58d93f2", "comment": "Malware payload (Mirai)", "value": "3ecb803d857410ee17b3296a92e4ea6a208bb7569f10eb68901fbb8a267dbb38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290101, "uuid": "ed1a5a0c-794a-47f3-9d9c-16ee78f97eb5", "comment": "Malware payload (Mirai)", "value": "0de9e7eff8f8ecd2bf67f3451f09d2d3662a2d2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290101, "uuid": "b0d4218d-4fb2-4005-96d7-355cb4fd3025", "comment": "Malware payload (Mirai)", "value": "1a856c37910de2ee7048eeebab0eab6fa6c93506dba7dbbeb7f339a39cef770a0c54196d6ec26b0b496f2269ce20afe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290101, "uuid": "202a01d8-ccf5-4f82-9afa-aa1bd94babc6", "value": "T126734C02B31C0A47C1635DB42A3F27E193BFA5E121F4FA89691E9B469275E331186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290101, "uuid": "c039f080-a033-4f45-a809-aa0408e1c180", "value": "1536:1g6zC6BwH04ipg1w9TEmQfncab0D22eI4y53wVDNJgEs/ncO:idHVIg6gcoJ2eID5ctO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290101, "uuid": "70abaaf2-ec30-4135-b6d9-6c8d91cb26b1", "value": 75492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290101, "uuid": "71af8fe5-2e73-4152-ab99-3d79923786cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290101, "uuid": "10c46832-d7d2-4189-aaac-be7f1f633364", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60b72cc-c17c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791287706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287706, "uuid": "78898e2a-0ace-4f68-bb71-7cbcf0043978", "comment": "Malware payload (Mirai)", "value": "eac686384c3bd7bd2e1169418c9479f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287706, "uuid": "450eaac7-e677-4b45-893b-e621cbaac954", "comment": "Malware payload (Mirai)", "value": "3ee7b995f8c1b60eeb4c2c200724d597d0be839ccf779f5a51c49df765bf2dd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287706, "uuid": "64a7d156-155e-4a9f-874e-9cffb792d410", "comment": "Malware payload (Mirai)", "value": "1972bc1a87936ef70b6ea7abe11bb1458fe7151d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287706, "uuid": "9b9c9123-af0f-4e84-b344-1072c619b000", "comment": "Malware payload (Mirai)", "value": "627cfb65fa2b6d3157cf420ee991e38bf6e97958c3a35639f9601a5d27ed6c53c64e33412ce877bdc44cf84eff12dc29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287706, "uuid": "2042f0b4-1c1b-46b6-913f-e7250fd5177e", "value": "T1DAD46C56BD919B91C6E24ABBFBAE4368731757BDD2FF7006CA005F9037DA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287706, "uuid": "15be2e3f-a47c-4b9e-b7d7-e7780d332a1f", "value": "12288:QYl6M3YjAKWQunF9slwVaEJPv6+GOv6tog4TAIPHvPSegRe:Q3M3YFMF9slwVaEJPveqgleg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287706, "uuid": "86ca3b87-d48b-472a-92ef-6844f8eec49b", "value": 625992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287706, "uuid": "aaa77fa5-608f-497b-b038-05bafa899c21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287706, "uuid": "fce6fc5f-e0b7-4a39-b34c-37c7a480ae3d", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7108335-c18d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791295090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295090, "uuid": "a1c20d9c-fe5f-494a-906b-9fb232cc539a", "comment": "Malware payload", "value": "b81afa97db0df7691158c7c4e1f7dbcd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295090, "uuid": "eb63fb8c-86ea-47c2-a4b1-c32ae687fe07", "comment": "Malware payload", "value": "3f17516cc8a591208afb7c49e156643dee6428a238b1d50a7be0443f4a866d24", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295090, "uuid": "6326028c-c016-4ada-b75a-1f4ef512ee17", "comment": "Malware payload", "value": "d2125699eefd5ca780784fa4998d9b65a9436e6a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295090, "uuid": "b74980e4-20a9-4f77-8d40-0ac663a0065d", "comment": "Malware payload", "value": "d123088750a9e6e0d6dc4f50702ccbf072de546950ccfb9ce7a6e0f5ae6baaed456fadf993e8bd8596c31dd95c71ad25", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295090, "uuid": "4e18339e-9c7c-4eb9-ba5c-0f017cdeb19c", "value": "T1CB5186F3F9BAD934368D106869DF46D2E54B863704643811F0CDA8643F288D4F1E9B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295090, "uuid": "33e9357c-29eb-4b4f-b84c-69e067aa9d54", "value": "48:Siv2bDqWhUEhcicHJOv6v/mGcbI2D1mSNOjhixeji5ogvK0C/0Ckd/f0CMYk:V2KpXJOy39P2D56ixeihvKn/nO3n3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295090, "uuid": "2f76e019-9c8b-44dd-b168-9cc02f1fb47b", "value": 2786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295090, "uuid": "c3ab977c-2372-4267-99ac-fc4486eaf0d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295090, "uuid": "c964934c-0ba8-481a-a212-1870a4855a2f", "value": "agent_i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc72cf0-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276445, "uuid": "13ca619e-f2a9-4e45-95ee-d0f50b62858a", "comment": "Malware payload", "value": "1ee3a0183ad7c56faef7ec07831afcb2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276445, "uuid": "98cce0d4-59fc-4807-95f2-12e42b2e0e00", "comment": "Malware payload", "value": "3f185ac223b1b5f65a66040c1eda41e1024a2dca2b414a91496b2e6686d8d028", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276445, "uuid": "d2e8b23d-92b1-4dcc-8855-3e6ce07d7c19", "comment": "Malware payload", "value": "daf33e3c1a93fcfd004466d09a395dd5c5165417", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276445, "uuid": "14b7215f-c183-4bf4-a0f6-8921b0f33cce", "comment": "Malware payload", "value": "9319ebdee3fd093e7bd742c93aed82ad72eecf611d120540ea369226bc81f0b99625159a3cb9899c8a8ae4d2c5ad0184", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276445, "uuid": "78537084-18cd-46aa-a7dd-f146282407e3", "value": "T1DFC42357226F72500DFE92ED8E4156146D3D8E322A00A6FE55D8C9CE8719F0ECE35E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276445, "uuid": "be27aa73-a554-4434-8713-1e7f3e8d9785", "value": "12288:qeCEhtV9qO3g/ALyYG0ZaDajTCXMO8xzDOeQakP:dtzA/f0Za6TCXKBxlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276445, "uuid": "8aba3ed0-dd31-42af-970b-31b845db5eea", "value": 546286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276445, "uuid": "d009d499-7f7c-4cb2-8e36-28f5293785a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276445, "uuid": "78995c55-1eea-4be0-854b-06cb4115923a", "value": "3f185ac223b1b5f65a66040c1eda41e1024a2dca2b414a91496b2e6686d8d028.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaa5dee-c18e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791295452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295452, "uuid": "5557ba04-134c-46cf-80c6-e89a4dd318b6", "comment": "Malware payload (Mirai)", "value": "fbcc816278a7bd0f0dfb5af6236d3b83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295452, "uuid": "27662893-8d83-4f01-990c-3141d11c13a1", "comment": "Malware payload (Mirai)", "value": "3fe43a346641c2b461278149714b0679fd7d9478ac38a6d1293d81cdecae755e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295452, "uuid": "ac282e10-7a5c-4673-855b-c87775199a81", "comment": "Malware payload (Mirai)", "value": "d6d697254de34c3f16e792c49e28c5cd27ce0f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295452, "uuid": "ea8a4286-3a55-41c4-b49c-7ace62b115ab", "comment": "Malware payload (Mirai)", "value": "22374fc6bd6663f6feb5c358dc7674b3649a8bcb97bc78d9f5d777f669076d453b8546e1f6607ba27a8cb140f8c69af3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295452, "uuid": "73d0cad9-3598-43ef-becd-1845de70f036", "value": "T14B44C91A3E21DFBFF569873047B38A3096D971962AE19746F25CD71C1F2028E680F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295452, "uuid": "b1122de9-f6c4-480e-afc6-ce705ee061ed", "value": "6144:ORxueBkSNILDEgxZC4AOjongCzBYjAUW7gaQP:mQSFDOjongCzBYjAUW7gaQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295452, "uuid": "9d64c0f4-956c-405e-bc49-c5ad78c980ce", "value": 277833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295452, "uuid": "37f17b8a-4768-4a3a-83e8-3e1abc89d6fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295452, "uuid": "027a96a8-2d6c-441c-8c0f-7410bb641323", "value": "qv3.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b056191-c1c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791318048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318048, "uuid": "cca90263-624b-493e-96b1-7ba6681ff1b4", "comment": "Malware payload (Mirai)", "value": "ab0922552200932a4b0e077903bd21e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318048, "uuid": "5b5424c4-b05c-4016-aee1-ea6209c84162", "comment": "Malware payload (Mirai)", "value": "3feed21d01cd1f34f6c9dec6e7115a94865e4e2dc76002c6ef2384e461993081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318048, "uuid": "f8fcc2a2-2b74-4132-ad2d-e652c376537d", "comment": "Malware payload (Mirai)", "value": "239ec64839984a8f1a0f2efe3bcddcc90d383967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318048, "uuid": "b85888c3-afc0-4094-b898-ef029d7448a2", "comment": "Malware payload (Mirai)", "value": "008c9221033f1b1afe62d126e3262c5f7c3578845a8fd389baddff7104a1cc4fb3b5a21274fac09a76230fa518c6dd15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318048, "uuid": "8991a632-1444-484b-ba91-ddf2d774b051", "value": "T15934A75F6E228F6EF369877487F34931A75823DA16E2D640E1ACD5101F242CE641FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318048, "uuid": "ffdadeba-abb5-4c10-be7a-0ef44b366dc1", "value": "3072:We8KmtZoiFjOiC3Rlw0y3ihi93Lqoi7jSr223t:WevuoiFje3ReSY2pjSa2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791318048, "uuid": "eab8b7d3-619c-4c19-be9b-67cd27cfd3b6", "value": 244888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791318048, "uuid": "f2ec5614-d6b8-4ace-aeb7-a56e8488e7c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318048, "uuid": "d227c1d5-be2f-4504-80db-48f8a23bb724", "value": "vcimanagement.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bea32a1-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273328, "uuid": "38c26e03-a109-49b9-9fde-1f7a2909bbf2", "comment": "Malware payload", "value": "07902ff08428e294082c3b0dbee30bf6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273328, "uuid": "3e4112a5-a1df-490d-9e23-6949a155365b", "comment": "Malware payload", "value": "4038f1c7025cd0c0cf7574ad0d3b3b238ecba36757440c401996393a6a2b7d1f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273328, "uuid": "e02246a8-b5a5-4324-9514-c1624982a9be", "comment": "Malware payload", "value": "4c0578056609e9662ba5bcb8d132d4fa18a0da6a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273328, "uuid": "2d9c2415-4975-4497-a0d9-aaaec86f5b95", "comment": "Malware payload", "value": "84aabe143bd1e80f590bb797b46abe7f14441dbf857c28b69853351e3845895336da60cc77e752f7fd12fa5416da6b9a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273328, "uuid": "0b3988a1-c7a2-4ecd-8d68-9d71f0a135cd", "value": "T1CC5533CA813C25844F3D0FD67AFF956C61248FF810411C676F1A98AB253E35F8275A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273328, "uuid": "c3c8450f-e387-454e-8f3a-6c3c47ca2bfc", "value": "24576:boZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRjBc640:boZ9bq+MmMEL+hcjXHC/wnwdjK65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273328, "uuid": "e95aff14-3efa-4c33-bf58-7794580c94cb", "value": 1380032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273328, "uuid": "da15af78-a345-47f6-92d4-d9723f695dc7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273328, "uuid": "c76f14d7-1c5e-4e32-9932-90ce0ce5647a", "value": "4038f1c7025cd0c0cf7574ad0d3b3b238ecba36757440c401996393a6a2b7d1f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d736e1b2-c160-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791275709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275709, "uuid": "1e495c23-329b-47e2-b18f-2122293e2d4a", "comment": "Malware payload (AsyncRAT)", "value": "31109bcf3e4ee351e53f68cb3033aa46", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275709, "uuid": "a122d92c-ff05-4ed8-aef5-459d2c35311d", "comment": "Malware payload (AsyncRAT)", "value": "40618793adac69df00e5fe836827e38c13c2f6452d42e881c8efd256d8bf0c63", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275709, "uuid": "84f2669a-d389-48cb-888c-518f21979414", "comment": "Malware payload (AsyncRAT)", "value": "69b9c1ce6241940fa7ab35caed2c105e1e1b8798", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275709, "uuid": "6c6d2963-6dfe-4a3d-b45e-a8fd45c52815", "comment": "Malware payload (AsyncRAT)", "value": "1e7286440c83c8e186f26c8b1c8cf5dc31cad320fe31fe30d3d50899c7354bd1081cc41397fe86b4859be748f3655956", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275709, "uuid": "fac60672-0804-4556-b5aa-9dd6ba84d064", "value": "T107C59E0B4CE62A3DA7D4220D50BFE64F1E9015B7AECC146FDA2529697DB794CC00F1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275709, "uuid": "f3b34ad2-fc38-46a1-98bb-16ee14f26e4a", "value": "24576:HUnET+fAEDgUdIYnqCrmEVWdn2jxZzebX9IhhDFfi/YuZcerQcTLVFg7pzUddE8h:tiZrEdnxMh7/Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275709, "uuid": "8801e527-92e5-4705-947a-eac1f276dc5a", "value": 2558792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275709, "uuid": "d341a6a0-50e5-4397-83d0-5d422d97467a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275709, "uuid": "af1713ec-2e0e-4b78-8e0c-3e4c3453d4e0", "value": "Overdue_Invoice.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2326181-c155-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791270896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270896, "uuid": "404a5794-98ad-411e-94a2-22084528a0d2", "comment": "Malware payload (Mirai)", "value": "b61aa73c533e62aca9307dd2c7cfe984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270896, "uuid": "abcb8c57-6ef7-42a9-abd7-1a9ec97dcb28", "comment": "Malware payload (Mirai)", "value": "4079145398fad617557fdc44e63c49edbaeafb3744f1804aec0e430214e397b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270896, "uuid": "d40b07da-cd09-423d-a096-08b35b44cbe9", "comment": "Malware payload (Mirai)", "value": "18c31ff74d6075b89fe8317bc975e829633d5d09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270896, "uuid": "e50d7062-47c0-4dd2-bf07-bcfdf1dfc782", "comment": "Malware payload (Mirai)", "value": "6236e8da99ba647c789005d1cb3dde6cac35a1c6aaa167708bf030211b101a8ea396c89c3c1d1c56d8e75c0d7791307b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270896, "uuid": "107bc352-6e32-40d0-aaa1-02909a714f71", "value": "T133E3E5CCFD54476FC2D223BAF75A42CF37261A789797B32159A7E9B02BC17481D281A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270896, "uuid": "72da9cf4-18f9-4171-9080-bc28f7895ae5", "value": "3072:PklRIBGM3+mgYwGMyMRgi8KGqiPc+k3WL7tX8h3GbF2lLothTpKkUiHbEBy84cdB:4i7EIxcDI995bInx0DhT0Qs8RT57g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270896, "uuid": "00c20af8-ee6d-48ae-b201-387ea0368d18", "value": 155410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270896, "uuid": "5c037d6a-633f-4bcb-a947-24fabf9616b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270896, "uuid": "d2588612-b929-4d2e-94b2-e286e55cbecd", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d97409a-c182-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290135, "uuid": "951cf5c2-7e8c-4286-9cfc-82fad0e22577", "comment": "Malware payload (Mirai)", "value": "054bb865f6f903414c2a920600cb6215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290135, "uuid": "4e281200-3146-40be-825e-ec1208c97aac", "comment": "Malware payload (Mirai)", "value": "40e22150e407a512d7f4ea50b86729e9e024ffe4cd86ef9ca1b56e4135da2b44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290135, "uuid": "46677716-7879-4207-a794-c6db9dc0a5f3", "comment": "Malware payload (Mirai)", "value": "563367aeb039c54afc2b4b7a2a385f9bf5ad57c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290135, "uuid": "ef35403f-ae42-4e2d-85b8-5a951138c626", "comment": "Malware payload (Mirai)", "value": "7d79f23c56069ff62d9c9923bdc3a52314a7f39eebea8cc5c3909ecb2ff0cfd0c01a47b5640ff1c0c9bb149cdfa6e5b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290135, "uuid": "e828fdcb-3b85-43bf-b054-f4dec25c008d", "value": "T164E32B46F6418B13C5D61777FAAF414A3322D794A3DB330699285BF43F86A9F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290135, "uuid": "c05c4220-926d-4d9c-935b-ddcdf24bd3fe", "value": "3072:5IvM9qqxuvV8yAzltJXu9CttQJ2Ed83zGCzkX0clM/9REw/kP:mvM9qqxuvV8yAzYaQJ2EduGPX0aM/9pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290135, "uuid": "7e266684-695a-4ff6-bb61-140c7d9f61b2", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290135, "uuid": "1174979f-d2e4-4370-9ac7-a80922c7074b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290135, "uuid": "fe5040ee-ec1c-4bf1-8c01-3e3775570c92", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a6d995-c149-11f1-927a-4201ac107004", "comment": "Malware payload (RustyStealer)", "timestamp": 1791265808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265808, "uuid": "42aab584-aec8-4774-99f0-3fcce068a97f", "comment": "Malware payload (RustyStealer)", "value": "06967803198f1be4c67fbfc2d5176ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustRegion", "colour": "#D0C9FA", "exportable": true, "hide_tag": false }, { "name": "RustyEtiquette", "colour": "#1AEDF6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265808, "uuid": "c220eae7-c93c-4036-9c38-528d57a2a1f2", "comment": "Malware payload (RustyStealer)", "value": "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustRegion", "colour": "#D0C9FA", "exportable": true, "hide_tag": false }, { "name": "RustyEtiquette", "colour": "#1AEDF6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265808, "uuid": "9c297689-ca70-4a58-8c1f-26a542ccba2f", "comment": "Malware payload (RustyStealer)", "value": "d5739e2d137f2e15b2cb2d28224adcb91127181a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustRegion", "colour": "#D0C9FA", "exportable": true, "hide_tag": false }, { "name": "RustyEtiquette", "colour": "#1AEDF6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265808, "uuid": "4bc26eb7-df2b-4785-83ee-a937c0c0b8c2", "comment": "Malware payload (RustyStealer)", "value": "e2aa54ba4ad7c933210b97d69b0d5406266aa7f421fe9d78b5bf2d2303baa7e36ded12bfe69ecdcea72876e2d5b26f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustRegion", "colour": "#D0C9FA", "exportable": true, "hide_tag": false }, { "name": "RustyEtiquette", "colour": "#1AEDF6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265808, "uuid": "bf7bc907-0da3-444d-af6d-8e2dc4b7e0a0", "value": "T134561816F25251EDC06DC174834A6232FA72BC8A47357AEF4BD08B212E65FE06F3D649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265808, "uuid": "6d7d7240-d429-459a-bbbb-c512d8ca38a0", "value": "d93e2fabf2d8511e8483c0fd42a95661", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265808, "uuid": "b38c5deb-7d18-486e-8518-939398ab2ae6", "value": "49152:cPCAHnZedWZ46DtXMjQVEmYEBcSD8Vdg1t7SV17Eq11Uc2iVCab4Gd+4lVB1w9ap:zSeMMjr7U+V191pnv4OHuI9z4+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791265808, "uuid": "a4f8217a-d452-45c9-8aa2-f79cca5a2bac", "value": 5940736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791265808, "uuid": "08fd1f15-d83a-4f9b-8cce-6801abe1f778", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265808, "uuid": "1c209418-cfda-4d45-8775-d05f9d6aeefb", "value": "2025-10-25_06967803198f1be4c67fbfc2d5176ce9_akira_luca-stealer_rusty-stealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd6ea3c-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273549, "uuid": "cfc41925-ba1a-48bd-b6c2-41f18f120507", "comment": "Malware payload", "value": "5e39df79a1f20ad687ab62f8432cec7d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273549, "uuid": "a9967b74-9d89-4954-bbd5-82268ec76bfa", "comment": "Malware payload", "value": "41e8ade79d5e436daa760a0363bf7f73749146a6115fa01a3a59f54bcb6e3f4f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273549, "uuid": "a6cf371c-1f76-43bf-b594-47e108bf034c", "comment": "Malware payload", "value": "fa2e3e37c9cd592e22aa992e94438bee83d73431", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273549, "uuid": "29c1d95c-a5b6-426e-892a-9f6f20c8d97e", "comment": "Malware payload", "value": "55049cc1e4b2497f375a48e4a8ff99aa0fad78ce84b14ee8140590e35b1b85f063b296eb9667fdeab9cc6751a85c02a1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273549, "uuid": "fde66514-87c9-47dd-bc48-40465621cf46", "value": "T1EDC423443901C1DDC74A6F3A9D944EB46E7D80E79A5A790027CEBD827D85AB033C9D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273549, "uuid": "deefb9c9-84a1-4bbc-ba13-d3c95445a715", "value": "12288:9qwEDcCCXG6wlOMWROC/FTeHo22Qm7NzofOr/mShe:qgCCu4MQOC/gHozN7NzomLm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273549, "uuid": "7fe87da6-93d5-472e-b8e7-6b19f0013737", "value": 578949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273549, "uuid": "2320bef9-324b-4e70-9a7c-be48efff7435", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273549, "uuid": "623616b4-9bd1-4253-983c-fcce537be9a2", "value": "41e8ade79d5e436daa760a0363bf7f73749146a6115fa01a3a59f54bcb6e3f4f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8198e1d-c1b2-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791310849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791310849, "uuid": "a45b091c-a4a5-43d9-a95a-c1e751ab2e68", "comment": "Malware payload", "value": "c39b90eec4c28c25cbda26a9a75f1baa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791310849, "uuid": "9c24b62d-d2c3-4ea6-ab74-22a88dac7501", "comment": "Malware payload", "value": "42b9903e577d1744e27310200b778f7dc008ae73b7a4715249c9183565788251", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791310849, "uuid": "6d3a8ac1-4deb-4827-a86c-d454b0998c7f", "comment": "Malware payload", "value": "a40a17c8b26c25b965793ccd4e7db24ccd38b72b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791310849, "uuid": "1e7908cc-cbc1-4185-a008-fc332a975ad6", "comment": "Malware payload", "value": "0e4474b98317d0853e8779fcda3c40730a287f4641b86dec6bd12713b73f56aeb8dd660426ea012d78dc350cd447e692", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791310849, "uuid": "10e0dfd0-3cc5-4c46-a5de-1b7f8ea21e17", "value": "T1C5829F3621F08B335A9065C4B3772BA54F769607456720A8B4FE1E359F5AB03B0FBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791310849, "uuid": "ce673400-c718-4991-a017-54482e359345", "value": "192:cCul4hvZ5m5FG4j4HKNphv4iKLMW6MN7molZi:a4hvZ5m5FGGoKNphv4iKLMW6MN7mom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791310849, "uuid": "8c3da8d7-a7bc-41dd-ab10-d84ee3d6f109", "value": 19264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791310849, "uuid": "aed8da28-5f7b-4ccf-b10c-e63fee7d9194", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791310849, "uuid": "0e8b3a4b-2ed6-477d-817e-4eb8d6a23a27", "value": "42b9903e577d1744e27310200b778f7dc008ae73b7a4715249c9183565788251.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dba1cc-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271633, "uuid": "24a99406-c0ab-40c1-9954-d7596954198f", "comment": "Malware payload", "value": "728ece3f692c1d0948666083659da489", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271633, "uuid": "93f75e93-8ab1-49a6-bf43-e0093ed14ee7", "comment": "Malware payload", "value": "43486e9fd514380468d67133345768b64e872bec9b9b916c43d5607c1abca572", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271633, "uuid": "e2814659-cc2f-43fd-a44e-cff9878c2809", "comment": "Malware payload", "value": "6e69260e1add95bf72391fce17d76953a83b638a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271633, "uuid": "eac25947-2850-4be4-b83f-a36279ccabc2", "comment": "Malware payload", "value": "2fddf864a2e6d8c9c67a72e19d873252e42584b40af8e5f9a0f8be18a23f2be1d1cd1ca18b17f26f95d715d65ab28cfe", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271633, "uuid": "451f0954-568e-48ec-ad20-509d306a479f", "value": "T104B423CCB6CB88CC55A63134E6A20B4154DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271633, "uuid": "f2575409-f8f7-48da-b55c-bdc9203a898f", "value": "12288:+wsK8MG1KnyC/G76u6M0gXar5qdu/ct2ien3P+beA:GKGcGmuwjXQen3PwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271633, "uuid": "7b90cf5d-ca23-442b-a499-cee237cf0107", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271633, "uuid": "ba13cb7c-fc49-4115-bd8f-0bc04b174ec3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271633, "uuid": "6ce05af7-9c63-4fa6-9e9c-7495aa816d7c", "value": "43486e9fd514380468d67133345768b64e872bec9b9b916c43d5607c1abca572.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7712de-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272472, "uuid": "ef7d72a5-f944-4d1e-909f-ad5bf5ba509c", "comment": "Malware payload", "value": "116951ff9e7082685dffcd1a72482942", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272472, "uuid": "7a3aaf2b-aa6b-427d-a7bd-b732da638b7f", "comment": "Malware payload", "value": "45309809452e4137295182f0873487b6f992364389280d80004c251e51b07972", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272472, "uuid": "5125d7af-f56d-4921-9640-84ea1b68310f", "comment": "Malware payload", "value": "674237b490e4d1c1269ddbca455eaa54aa609d98", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272472, "uuid": "6481d883-912f-419b-bbf2-cdf3b62e2f5d", "comment": "Malware payload", "value": "bf22427299f4a1573d80426dea515b22d3a14aaa3166907b8eb61525b0031dfe0b865c94a773a8ae64732d96db2c0b44", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272472, "uuid": "1459c3d5-7738-4fe7-9524-0972f73d821a", "value": "T195A4232CED518E3279E7B6B49E5C5E020170F6432B95DA768C2F32C8D96FC241DEA18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272472, "uuid": "add0daef-2def-4cac-8b7c-8812fbc18924", "value": "12288:XzYfcEaN9B/Jm0LU0gM7aQ3GmVCSkZ0HbJO:UfclN9BhmSHpGuFm+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272472, "uuid": "9d787c78-32d3-46ba-8d4d-109a321cb8d3", "value": 475735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272472, "uuid": "14d09695-c242-4676-a7e8-5551fb5aaa23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272472, "uuid": "3ab666cf-eb3e-41c1-b24f-698ff6ee6ad8", "value": "45309809452e4137295182f0873487b6f992364389280d80004c251e51b07972.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3bd68e-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271181, "uuid": "73232993-c66c-42c2-9622-2ef48a104dfe", "comment": "Malware payload", "value": "d171ac9ec6e9da3cb293bb20479e3089", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271181, "uuid": "cae70a85-ee9b-4e16-9e79-ab48bf5b4e54", "comment": "Malware payload", "value": "4533f42e34795e678d8f7f215d8fd6ad37dee5b3954b867fb7243ece6b3200a6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271181, "uuid": "f36bbcf1-358c-428b-b74f-9ec3a61e5fad", "comment": "Malware payload", "value": "b4e7c6a0e1443a8afca516e6ce9879865bf55caa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271181, "uuid": "1abc7383-bccd-4e48-9c25-be22ed808fa4", "comment": "Malware payload", "value": "34a144797010f4cb3d3acc62599740c5b0df7f3dfa0a0942343fb906f84a634d467b637b5edfdbc502437de2e142048f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271181, "uuid": "b108d436-c8f5-4411-9841-40df6cf306f2", "value": "T14CB423CCB6CB88CC55A63134E6A20B4154DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271181, "uuid": "4eff5f74-2904-4eaf-88a5-a356c2359179", "value": "12288:CwsK8MG1KnyC/G76u6M0gXar5qduvct2ien3P+bek:CKGcGmuwjHQen3Pwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271181, "uuid": "283a3e96-95fa-4dfb-8240-b0c3d9c5b432", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271181, "uuid": "dd8a449d-05a5-4956-bbae-ecb0eb04656b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271181, "uuid": "bb3ac538-d4cf-498c-8250-7d4264760340", "value": "4533f42e34795e678d8f7f215d8fd6ad37dee5b3954b867fb7243ece6b3200a6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c69c99-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274313, "uuid": "39d75946-da17-4e68-959f-a535749d4cc0", "comment": "Malware payload", "value": "c5514cddf5a8f7b5a9989d958dbd0f98", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274313, "uuid": "8a6a6597-fc7d-4366-ac09-7dfb5a7ffaf8", "comment": "Malware payload", "value": "458d7cb2b087c5e660a4e1029595e9e0a1645f9331889c52c47485eebad7bc2e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274313, "uuid": "d5f46238-4e4e-424a-87b1-78803e8e735e", "comment": "Malware payload", "value": "9966590fae6f304b86df0cad8f78a184e72a5ab6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274313, "uuid": "369c37ec-c875-415f-bfce-339ceb6de452", "comment": "Malware payload", "value": "1e22136c86544fb6d634fb501b6606f197d9a2fd1d4cc72a04cde9d04d59b4ddeb1dca314582afe9a2fbd52b87b6083b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274313, "uuid": "7794eb8e-b64c-4a9c-a4d8-33165d3334b1", "value": "T181A4239581B983533484E3B5497B1AEA5F301CF28D3D674F88DAC5F81B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274313, "uuid": "c1de1140-7400-4c5e-b289-2a3dcd1d6a0a", "value": "12288:3cNSCDe0U+m1V6ECbniSPfS3e2R3feeintFckg:qDe0wUTiSWzeeig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274313, "uuid": "10a21aad-492e-4320-b2e9-e0a0a578520f", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274313, "uuid": "4a6d1acc-7016-47f5-8bd8-0486d65eab2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274313, "uuid": "03014c15-9f96-4c05-92d0-fcc58b8784da", "value": "458d7cb2b087c5e660a4e1029595e9e0a1645f9331889c52c47485eebad7bc2e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193b6a1d-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263365, "uuid": "d4b65fd1-060d-466d-b029-e268f6c25e12", "comment": "Malware payload (Mirai)", "value": "852faedb0c41e199182939f654df20f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263365, "uuid": "5c4b1491-75dd-41ac-86f5-e554e73933e8", "comment": "Malware payload (Mirai)", "value": "45ac99a83d99879ba0cba10fce2f81f772f67e44ef3df726b4c074c2d7a5f230", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263365, "uuid": "12ddaa1b-2a6e-4f7e-b87c-bf29a8792cd8", "comment": "Malware payload (Mirai)", "value": "bf35efde7fae9705235bc2c86817874cd93dc9ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263365, "uuid": "f94841c8-c639-4b3d-b265-26c5cee4008c", "comment": "Malware payload (Mirai)", "value": "08e25dc2bb8915259ab3ad25eeb08ca53764ea9db93c8e256fea22237a0aa46596b0bb3d90826f12ee9d05672d0fa9b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263365, "uuid": "09d8c82a-b372-4bfc-9252-8d6b4288364a", "value": "T169F3AF67B34B5050C4E44AF41BCF5BAD292721008E7B99E77C6E723A6A775CB28073E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263365, "uuid": "87311918-738e-40a9-bb52-e7a8d7098025", "value": "3072:+xv5yfUhfN8RtoZnGhTNLhs7LTT+RCQX3XqbpygZCBrWOG4u5Ztq:+pEfUhfW3oMJLi7L+B3a9FCBrY4wtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263365, "uuid": "c71592ae-295a-4b4b-ba2a-85c4bd29c990", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263365, "uuid": "9dd8dfd2-c7bb-46e8-9591-30348eddd9c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263365, "uuid": "527efa87-6613-43a7-a2fe-92f868c61b8e", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce2bfec-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272336, "uuid": "76337550-446c-40bc-8f04-1f91f4cd35ea", "comment": "Malware payload", "value": "b7ee306a3f18db563a106220bcd20521", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272336, "uuid": "d5ed55e1-449c-4591-bdbc-12b93f15d9d6", "comment": "Malware payload", "value": "45b5bc3dfabad5bba576ddf30231ac974a8b26a415bea69054e80c55da7bdaa2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272336, "uuid": "dbb64e40-7092-4764-b496-a1ef032f8ea7", "comment": "Malware payload", "value": "68b2f37d716005e844aedf8b0c877f9b01901421", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272336, "uuid": "01feb7da-7359-43d1-96f7-b55ba3ce0e18", "comment": "Malware payload", "value": "132efee6b7f6ad6a9be9165d40ed010441a07b2eef619d2e4ebedf7cee0c962bb192a636aace0d1fc09b7f0112692f3b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272336, "uuid": "f18d2da1-5423-4346-8adf-81798ab31976", "value": "T19EC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272336, "uuid": "df04db46-88fd-45ac-9af7-7df21e222b33", "value": "12288:z+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2by0H9I1P0QKw6FEq:z+QqldA/TSO713u7xn0H9IaQKH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272336, "uuid": "f965adcd-9ece-4338-8c8d-9fe8f6be4686", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272336, "uuid": "0bccb9dd-ef77-4265-9a99-a6880c7ed69f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272336, "uuid": "df69601c-6fba-4cda-94a6-fda613e68531", "value": "45b5bc3dfabad5bba576ddf30231ac974a8b26a415bea69054e80c55da7bdaa2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dafea4d-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250594, "uuid": "ed18d582-4dfd-4842-aace-9755df866d8c", "comment": "Malware payload (Mirai)", "value": "5e13490160f547737a0d57d7094b9244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250594, "uuid": "f1363bf0-9860-4bb7-956f-61aa9902b093", "comment": "Malware payload (Mirai)", "value": "45c29c931bb5938438a6cbfe3440b1089cfd43934aaeb9afb0adeda3bb6793ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250594, "uuid": "9e3993d5-189f-4fda-b1a0-00ff2bd07a6f", "comment": "Malware payload (Mirai)", "value": "f67eb1d0411d8c19f3d88e6ee36ba52ba293e596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250594, "uuid": "35c1d08c-cda2-405f-8dca-ccd66fd11f2e", "comment": "Malware payload (Mirai)", "value": "52470b48e1f9c7c07c607d4a4fdcc6d4b6bbc96550a81dbfd6cce513af62bdb940f2dd1860e36263a22aed3b426c8046", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250594, "uuid": "4232f553-8db9-4565-9051-5531bcc711d0", "value": "T16E332949F647D6F0CC4305B0216EFB3BAD32B9A12324DDB7DBE4BA637CB16425416A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250594, "uuid": "2245cc77-1c7c-4c3f-89d0-df872559df5f", "value": "768:gY58yfPOf2uq9afucTuoRvR0sRlzhJdt9QgcpOypsp+FfiIvenKPyOehTdwas:oyfPOf2uq9afZ/Xko+FDOKvehZwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250594, "uuid": "0f33d45a-93dd-4c7c-93c8-fc6b49e7d5f2", "value": 54236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250594, "uuid": "59bdf9f1-81b8-454b-98f9-2e7cdbf79953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250594, "uuid": "801dede7-a030-4dc4-b55f-4df7b700235a", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175ad73c-c192-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791296862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296862, "uuid": "6342c587-3a74-463f-9ea4-8499661f6553", "comment": "Malware payload (Mirai)", "value": "c5aa27ba24ea6494a2d75fe633cc5c80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296862, "uuid": "d0cb8cac-1530-45d5-b367-7d8ee4df4a33", "comment": "Malware payload (Mirai)", "value": "45e809a22333e55823284d721b9eb8b494619fe6cfaafba4d934af3d4728e368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296862, "uuid": "2c673c78-189d-4aee-adf8-701e0931a536", "comment": "Malware payload (Mirai)", "value": "098c9e8a9b02c5a1e2fd23d055bae5891ada85ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296862, "uuid": "dc049290-3f58-4d8e-8d27-8cbf9276fb25", "comment": "Malware payload (Mirai)", "value": "844fc97d3bc745b893e081d7df81580d959e6970dae9bc391266da428f0b3c3fe4dd749b7ea74c50b840ee9e2c076b11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296862, "uuid": "f21ef56b-3179-4d9c-a5af-fe5d6a01015c", "value": "T146F35863DC266F96D613A1F0B1B28F786B53F8698A470AD6B076CAF44147DD8F4043B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296862, "uuid": "431c13ed-4368-4578-b10a-38184c64d213", "value": "3072:4QHBBbhS0UWvfGHT8XxEmFg0MYWG1EDwh:4QhBbo09fGHT8SV5BGawh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791296862, "uuid": "36d6cc32-0f51-4d50-a8aa-f3608ac8cea9", "value": 163908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791296862, "uuid": "e6081e20-1273-4a5d-a0c4-4f4fbbfa5654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296862, "uuid": "445c9a5b-f64c-41e1-b3ed-98db7175d8d4", "value": "vcimanagement.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad063260-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273920, "uuid": "539ba9c0-a89e-4200-a8dd-3de4593f2d94", "comment": "Malware payload", "value": "19595365ee29064b9190fa1cb227ae28", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273920, "uuid": "37fd3ca2-181f-4509-a41e-9dcc9e95cc01", "comment": "Malware payload", "value": "4682d4620982ca9227c48a45b7c0019bd7ca9ed6fc58c08f6b4ce5da5415ed38", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273920, "uuid": "a203425a-2103-4a2b-ae8e-f5aef0d65b8e", "comment": "Malware payload", "value": "2c336274d2592f5072821fb0fb2e66c448cd56b5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273920, "uuid": "d4375dab-d45b-4756-b739-a8becae82803", "comment": "Malware payload", "value": "b7e277a13edcddd97269c1049a391a014fe2bfc35461991b00c1998c5aee3db6de709a292214c4d0be9172055f0ed9f4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273920, "uuid": "3b2484a8-e309-4e6b-a736-f837526c6302", "value": "T137A42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273920, "uuid": "b7e0e9f2-11f5-4b1d-b772-6525cd908c8f", "value": "12288:OSCDe0U+m1V6ECbniSPfS3e2R3feeintFckCTsuC8hHU:ODe0wUTiSWzeeiisP8dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273920, "uuid": "afe510a6-3a0d-4dce-8902-5833c8155f05", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273920, "uuid": "d9bf1437-6e80-4ee0-87f8-c626bdff6868", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273920, "uuid": "373d71f0-53f9-47d6-bcda-593b6264d1dd", "value": "4682d4620982ca9227c48a45b7c0019bd7ca9ed6fc58c08f6b4ce5da5415ed38.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da7b062-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263882, "uuid": "29f9119e-5ad3-4fe3-b51c-efa3aa01e2bb", "comment": "Malware payload (Mirai)", "value": "eedbaef7b16d8b162776c069907a1a99", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263882, "uuid": "c9feaf9f-dc5e-4f19-b7c2-5405a48c02f1", "comment": "Malware payload (Mirai)", "value": "46834a2db453a397abc022e07ded5160d7025c6547306ad2fecbcf83d0b66da7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263882, "uuid": "0ef3ea65-79be-4501-88f4-5f1f4183556b", "comment": "Malware payload (Mirai)", "value": "43b16e27c8c2c331494e14e53e54714dbfbd6d0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263882, "uuid": "04fd810f-b841-487e-a9b9-9bd53889b19b", "comment": "Malware payload (Mirai)", "value": "5b5e4c229aa2592eec1f3732e91efa8d72a30eb21726d4c9e76a166ec8f0fa4ec05dce198086f4419ddd7089d5d856ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263882, "uuid": "cf087d17-ee76-4bd8-b71c-bdb18d179843", "value": "T19744C91A3A21DFBFF568873047B38A3096D9769626E19746F25CD71C1F2028E680F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263882, "uuid": "f497843b-7fbe-42d6-83ae-d637dbd27e5c", "value": "6144:iDuSW6cT61w/vgtNweuBOjongCzBYjAUW7gaQP:Xv63EOjongCzBYjAUW7gaQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263882, "uuid": "dcd757bc-b168-496a-b80b-c5d2762b65ac", "value": 277869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263882, "uuid": "cf34d8d0-37eb-49a8-9b44-b39da0046bad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263882, "uuid": "7e09a2cf-7504-4d66-87c7-c7c1c26bbe0c", "value": "qv3.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1ee774-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290429, "uuid": "1feace37-a546-41a4-956b-83e6d6eefa82", "comment": "Malware payload (Mirai)", "value": "82513d56d1e85fca2965dbdbc01294d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290429, "uuid": "d2f943d2-42af-4fef-a1a4-076c17dfedd1", "comment": "Malware payload (Mirai)", "value": "46ebda3fe719dccee53c92c85ac50542222516580d156bebe9465d56a48f137b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290429, "uuid": "559557be-69ec-42ca-86e3-92b036594965", "comment": "Malware payload (Mirai)", "value": "30c009c6fc3abdbc9d3477b41dbe7876ce3e086d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290429, "uuid": "6847e145-7a57-487a-a20d-dbf9d6ceb5b9", "comment": "Malware payload (Mirai)", "value": "4e0cd15a43ff3e90a5c40fa6e3fed38b8341cf5d0faa31047dc2e0dbca6de87704f51986979e1b0d0a3c6afba182f5ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290429, "uuid": "996bebbe-6ca5-41f0-bad9-7790ddc62368", "value": "T18BC2E16350F6CE03C8F2837B6A3C59A621605435A34EEE2D77694BC477460E4657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290429, "uuid": "15479ff8-4465-4a6d-8395-e98594320451", "value": "768:Y5+Kcrb9VDJee2KTgdTHOBcK5ZCAyIAjO:nlrb9veKTg9QB5VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290429, "uuid": "2bfa71e2-604b-478d-96a2-7e44ac6e2f23", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290429, "uuid": "345a036e-b746-40e8-b78c-8c933b969dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290429, "uuid": "19780748-6e91-4e86-a6d2-3cfe54785b55", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f410689-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274944, "uuid": "6e7c004c-6af3-43d6-aedb-d4fd6f567b59", "comment": "Malware payload", "value": "bb7d81e0530507d359355a8c552495a9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274944, "uuid": "5745d7e4-4e8c-485b-b9dd-53319444fff2", "comment": "Malware payload", "value": "4728c03683dfbab4d00a22c62fa0e0e7aff743f192d541890f33c85be95aaabf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274944, "uuid": "ea91cf9f-340e-41ca-806d-3a0ee51daa4d", "comment": "Malware payload", "value": "3f0b604d6a17b0849c903d21ef3272d77e6e0fed", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274944, "uuid": "db7dcb10-8a0f-4355-84bc-ea1c4e0496e1", "comment": "Malware payload", "value": "5035ec0d318eb5ac6c6514f2f618a2d410893124046e6e357e2f4c5ef708d2db7965a975f158dd60df423028df137965", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274944, "uuid": "36bff4ec-b109-42cd-b25b-70f0c2a7fb2a", "value": "T1AFC42359B2B7498EF261A0E5A8CFBFB8A2E7CD55EE4BDCC477C052D41221701389075B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274944, "uuid": "6b7d5e10-8e3b-41d8-9582-f69750aa3092", "value": "12288:+M+Lkjyqu1SXyFf7onLGbQUsANywcFhG57yuiX:Qtqu1BFf7miQUrNEgyu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274944, "uuid": "98418819-8e7c-4f2f-b514-2155cf0ea7ef", "value": 548743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274944, "uuid": "037b18b8-e5ee-449b-a65d-1f656ef6e525", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274944, "uuid": "f9d2803f-8f63-4138-9c89-5b7a26086be5", "value": "4728c03683dfbab4d00a22c62fa0e0e7aff743f192d541890f33c85be95aaabf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b940d31e-c151-11f1-927a-4201ac107004", "comment": "Malware payload (CoinMiner)", "timestamp": 1791269216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269216, "uuid": "113eca30-b87c-4723-b203-87d4772e23a0", "comment": "Malware payload (CoinMiner)", "value": "665fd4258e22790b9b934d0d3a5d4eb5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269216, "uuid": "f811d9d4-e92a-444c-9b45-82217a8d60f8", "comment": "Malware payload (CoinMiner)", "value": "4741fe9894bbe49d6014cec8d30993f7ff77326938315c5515f6923be9f75375", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269216, "uuid": "00084257-b717-47c2-b0a7-5c58fd7e124e", "comment": "Malware payload (CoinMiner)", "value": "ae4c8f54e367cffc6e896177a54a8735216f2f98", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269216, "uuid": "5fd4096f-baed-4a10-b37a-7ba12f79b920", "comment": "Malware payload (CoinMiner)", "value": "b9de26d8e639edb516b913333f69d1614c649963cf844ee932cf38bbda54f3cb06af39186fcec10ca4550d88ba9a40f6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269216, "uuid": "e7772e40-15a0-48eb-9009-eeeb3b5cf26b", "value": "T158018C8C730177766BC69F68F7686054B5025FF35E6C68F0F101787A305508CB93AA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269216, "uuid": "b63e1234-20f4-42d6-bfde-f44fb5b4f69b", "value": "12:+Cm+OuyLCEUavo0MFMDlMFhu7XHbrXHbSuXHZpdUHo+4k/uyXHbrXHbSuXHZpdU5:lmGWlvcJWHbrH3H+Ho+qeHbrH3H+H0cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269216, "uuid": "62da20d6-5fc9-483e-b119-044192680da4", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269216, "uuid": "2a42cae5-1f8d-4692-9d44-207b97d0ceb6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269216, "uuid": "72c2eb92-7c82-4566-ab1b-123c24ed867a", "value": "ce.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4530c475-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273317, "uuid": "05644994-9a00-44ac-b947-e37cdd353e55", "comment": "Malware payload", "value": "46dca7b3abc171cfe3dd1ba3c54d0e3f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273317, "uuid": "afd681dd-ebe4-48d2-aadd-4a4b8ecc650b", "comment": "Malware payload", "value": "4799d225834cecb3310914b369833f6e69c51babc9448adf418f8965e0b65332", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273317, "uuid": "5582c9a0-b09b-44ec-8f5e-fa21348dabeb", "comment": "Malware payload", "value": "6f86a9959ab839ca9bc321e102835b3eb7ec8926", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273317, "uuid": "07b4697c-95bb-4844-aae2-ff06d274d8fa", "comment": "Malware payload", "value": "bf0d8c3aef166c58fcbd3c96a8610a751e1105ba39202d788b0d8db43baba3f7a435e712a373b8bd82183c019db06dd5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273317, "uuid": "8586a76b-0e39-490e-a1bf-9ce178f248ad", "value": "T152B4230A85D01FFF899ECB9946D4A4672FF467952F93565BC0CD20B00AEA203D6EFC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273317, "uuid": "d90170a6-cd77-4367-84ee-f7e6e8b44681", "value": "12288:DvOi3UDYXndLQ/jJOjB89RitlR0XjuIkVp69d3iY829uhBrbY7vPpCkIL:DWiEGnlQ/jwyil0X7kWv3icYrb9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273317, "uuid": "e6aaa51b-e651-4a3f-a9c5-c897e0ef1e5a", "value": 540419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273317, "uuid": "be80aa16-f4b4-4372-9260-62b6d74c1d4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273317, "uuid": "1151e528-ece6-418d-9a4c-6fa1eeab9e1d", "value": "4799d225834cecb3310914b369833f6e69c51babc9448adf418f8965e0b65332.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151b8a78-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263358, "uuid": "dea69533-d919-4e7b-86da-bfbe1768657d", "comment": "Malware payload (Mirai)", "value": "2fcd9362dba6897f1cc497b5b0c45997", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263358, "uuid": "41eee3af-fdbb-44c1-a06f-20848edec032", "comment": "Malware payload (Mirai)", "value": "47ae5b0371a638ce7dddcbec7869fc6fa2e67e546bb1e814f19e87a518233461", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263358, "uuid": "61a8e1bc-ba1e-4a61-8235-66271fb80f9d", "comment": "Malware payload (Mirai)", "value": "63b33b09589101a34fddfde7b4fda44fd61e3f79", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263358, "uuid": "afd187c8-524a-45bd-909f-6762b9c90d1d", "comment": "Malware payload (Mirai)", "value": "96ee1f39f3b931979f7e0c910a09fef417bad0b530ec3594bad5f1814dc97101c699a4f8692da4e253d792eefedd7adf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263358, "uuid": "4fc67c9b-d3a2-4731-808b-1ea5d47fa47b", "value": "T19024955E6A328F7DF368873447B74A35975D22D627E1DA84E2ACC1041F2434E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263358, "uuid": "0b282721-cab5-467e-be69-01fd3947abec", "value": "3072:sPvQ7inW06qBVrDuQ5SPkCekMcJXs9op/rziTKom:sw7inW06I1DA81qJQ2/r4Kom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263358, "uuid": "f89cfe4b-7f4a-47f8-a964-c50fe432c189", "value": 209376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263358, "uuid": "62c00163-e1ff-4177-9a48-01ac8cb83450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263358, "uuid": "0d87d227-c0b1-4a7d-8328-78a5bc4c3310", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2024e855-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276261, "uuid": "d60b938b-6fe5-427b-a967-f9968d725d9f", "comment": "Malware payload", "value": "52a309370b10e239466a0674631bd7f5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276261, "uuid": "d739e6af-8fb2-46f7-9d7e-e9388867a602", "comment": "Malware payload", "value": "47b5ef54fbc20c8f9a61fc83ff8a7fbbdb555a8c409154277bab6138324fa933", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276261, "uuid": "193e8c36-0c83-4357-83e6-842d4486aa72", "comment": "Malware payload", "value": "d863ca933fd82a6b7c8f25a237458413970e6ba8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276261, "uuid": "90038b58-b7dc-4d21-b78c-8894af2431b3", "comment": "Malware payload", "value": "38c546766ad5893c5c920dec254b551c405e21367f71a8c755869305f3068688b2e94b38152f9ce39539aad2e2e503ad", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276261, "uuid": "cddd1170-738b-4263-868b-4a8ca1959463", "value": "T184A4239CAC901E565C9637905E3EDF130BB0E81B32EDCE79970B36A0D8F9D8456D824E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276261, "uuid": "4cdc0565-a097-43ae-9cf8-d9bee54ede45", "value": "12288:/zYfcEaN9B/Jm0LU0gM7aQwF/KBrh6OF8uRNiwowhL:8fclN9BhmSHuKD/qWnogL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276261, "uuid": "c956fe7d-822a-4390-9fdf-c91c6090af56", "value": 467813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276261, "uuid": "7dcc3874-ddef-4438-9fb1-725e82fd70c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276261, "uuid": "738ff555-9378-4c0c-a3f7-81423def4048", "value": "47b5ef54fbc20c8f9a61fc83ff8a7fbbdb555a8c409154277bab6138324fa933.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09425b71-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791273216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273216, "uuid": "7c57237f-8caa-4792-b7ce-b2d2002bb5ee", "comment": "Malware payload (MassLogger)", "value": "97e2f2a7b791d86c0e4dcfd88fb87d97", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273216, "uuid": "9f9a9198-e531-44a3-9666-1609390a903f", "comment": "Malware payload (MassLogger)", "value": "47de71ab776c75778e8ed1c9cf891479ee080029a736c2c1e3df5fdf4537bac2", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273216, "uuid": "0b4218e5-1fae-4a48-830b-6e65746aaaf5", "comment": "Malware payload (MassLogger)", "value": "4b460979a91944b6ec0ff7fc6a1fc6b19999c386", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273216, "uuid": "448a764e-ca37-4833-96af-19bd6eff35a6", "comment": "Malware payload (MassLogger)", "value": "946e9687047e314b95d1279f913220c614271e508dd08fa607adc3f6ef49439406bbd9f136da68b13ad57954c62af113", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273216, "uuid": "fd78cde1-c36d-4676-acae-99bd2d1b430d", "value": "T1E5452319D19D43EF090065B66B087CC4768A529B0DC3127723BCC73937F56E6AAA3CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273216, "uuid": "c48e1024-4585-423c-977f-78bf662a580a", "value": "24576:yfFFu3Y8+2gdPoFSU7C2oVLFeFaDN8PEaUpWpXuOKz6zd:yoJgdAZmR/WP+WbDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273216, "uuid": "b59d528c-cefc-479d-9be4-82d5ae808489", "value": 1216679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273216, "uuid": "d481d761-451e-48cf-a546-0cdc11081fe7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273216, "uuid": "8f19038a-ebb0-4b3e-b437-27b24d1424ea", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f5f7dc-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274506, "uuid": "33ea4ff6-3271-44b0-bd85-f95f7c5d6d1b", "comment": "Malware payload", "value": "4e9691a5a090b6206d5db1c159bc14b8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274506, "uuid": "c1fb17c5-08ec-416b-bfd0-63000db41f41", "comment": "Malware payload", "value": "480466782889caf62fbb4d79fb5440b3561be7b762e29322fe2c76047e0c62f1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274506, "uuid": "dec8bb0e-e970-4b9d-b2f7-16c285ec7fdc", "comment": "Malware payload", "value": "8e1809809f72be948aba06bd73be6f3cd84a519c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274506, "uuid": "a716e1d8-7b07-4c41-ac20-405f46f04688", "comment": "Malware payload", "value": "71fbda092a15392681d529ae66d44a9ec29aaaa364f9f1d75e29721f175d0d69f73bec9eed10e16c95f40abb0a966147", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274506, "uuid": "f1783449-835b-4062-b80d-64e64c7d8f01", "value": "T1E4C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274506, "uuid": "45b2f8d8-32c5-43d2-a421-29e1758e4887", "value": "12288:r+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byGH9I1P0QKw6FEA:r+QqldA/TSO713u7xnGH9IaQKHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274506, "uuid": "38e3b908-9383-4256-9a1e-6a717c8ca33e", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274506, "uuid": "31963091-5b72-4fae-8753-cbbc3ba3b2f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274506, "uuid": "bced080e-1ce8-4934-81a2-f8ca6e882aee", "value": "480466782889caf62fbb4d79fb5440b3561be7b762e29322fe2c76047e0c62f1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c25190-c16a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791279765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791279765, "uuid": "3261e7bb-6a3d-4fac-a58f-af18f47057fd", "comment": "Malware payload (Mirai)", "value": "5eb33f2fcca54be88cbc3aac798d8491", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791279765, "uuid": "89e18376-46b7-4ae4-92f5-025155b098a7", "comment": "Malware payload (Mirai)", "value": "48a3ab9bf04d71ff1afd9def8ff23204c4e7771b860d69daec52182944a01b85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791279765, "uuid": "be256f95-ff0e-4cf4-9ee4-332fad34cf32", "comment": "Malware payload (Mirai)", "value": "de75d530cd5f1978fb746b15157bf65c708405e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791279765, "uuid": "24832bb0-3a70-4a6b-b4e9-6e45587cde82", "comment": "Malware payload (Mirai)", "value": "6faff180cfc0e7d96dc28fefaad2b60c536d7fb8cce2fe14c5a94b348c61b2d373285a0591b2035c575d8795bbef2e33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791279765, "uuid": "9e0544cf-dff0-493d-8ff4-c697648a97fb", "value": "T17FC418A6FD41D991C0D42ABEFB1EC2C833070379C3EA71029D16D72569DF59A0E3EA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791279765, "uuid": "ab5cf575-267b-426c-8780-1e743e1fcb6a", "value": "12288:4yIWWvMqYpM+ovFO3Pq0eHyp05NpK8TmRWeZ6O6iViiCox/I:XZOTgYUwO6MA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791279765, "uuid": "af448450-eaa6-49e9-a098-abebb7ce5b88", "value": 574308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791279765, "uuid": "cca26537-12ba-4601-afe4-cedd55df4b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791279765, "uuid": "b16ac18c-9065-4c86-a3ba-077baa9478c8", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2788663-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270977, "uuid": "cfea8876-05ae-4eef-ada9-ccc2898674a0", "comment": "Malware payload", "value": "a56c76cc6dd1c60038ba402c2e271fea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270977, "uuid": "3822b24d-592c-484a-b3bb-37cb1c61e126", "comment": "Malware payload", "value": "48d48e4d7e78b136188ef4c8d562cdeebc6a1692e3b039a83665b1f4235de865", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270977, "uuid": "d42813c0-a58b-4b2c-b0af-e71cf1617127", "comment": "Malware payload", "value": "3bc9d64ebd79221d0bc50282e4958c7a3bd0a5b4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270977, "uuid": "96e29d52-2ed9-4a9f-a769-c6644f483f42", "comment": "Malware payload", "value": "c15a659b55c60ef3595ed30eb68182c546ecdcc2a890cad96deea8c291a1a3c250a52296e62f35a2e6a47666e21d09cd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270977, "uuid": "8bfe96e8-b822-4264-82a1-ae3476fcc47a", "value": "T169B4237B0A7F70D00C6A43BA8B468611A43D9D621628AFBD47DCE6CC8D0E51EBF14E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270977, "uuid": "805b76ec-513d-4326-bf62-783138baf72c", "value": "12288:R4lhhLoVDI2FLmMJKfeqO3g/ALyYG0ZaDajTCXMO8xzDOeDBV:uxopIAmMJbA/f0Za6TCXKBxFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270977, "uuid": "cbb8a793-e7c0-40c5-a17d-8dcdfd9a1a79", "value": 541353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270977, "uuid": "c2ed9510-1049-4ab9-bb15-358cf02beb65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270977, "uuid": "3b255676-f623-41e5-95db-4316ff44fa97", "value": "48d48e4d7e78b136188ef4c8d562cdeebc6a1692e3b039a83665b1f4235de865.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb463c44-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274884, "uuid": "a771f1a1-9469-4149-bca6-a344b0eb830f", "comment": "Malware payload", "value": "de956ca4db1252c1680712c6a33d235b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274884, "uuid": "0918f5c0-cf8a-40d1-8941-f55c1cc99855", "comment": "Malware payload", "value": "48fd49859ab67fecee9f2df7f99488d9638206a8998856eb86c635c0ec833100", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274884, "uuid": "36c876ae-61e6-45fc-94ac-78865abee0b9", "comment": "Malware payload", "value": "c4e88acb7c802a76cda6d855a95b681b7a416e24", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274884, "uuid": "6090f4a5-bd3e-4bbb-b54d-176b135f0453", "comment": "Malware payload", "value": "211348f1fb309e92581c6466511a169ef41e07bdcf2dabff3b34b65006b0298c59d8248c7e133d1e9a95653f27ac5265", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274884, "uuid": "2554f1a4-1cc4-4d64-a3bb-ff21ff77fbb0", "value": "T1C1B4237B0A7F70D00C6A43BA8B468611A43D9D621628AFBD47DCE6CC8D0E51EBF14E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274884, "uuid": "d03b53b4-3306-4938-bd00-53b251d1ee28", "value": "12288:14lhhLoVDI2FLmMJKUeqO3g/ALyYG0ZaDajTCXMO8xzDOeDBA:ixopIAmMJQA/f0Za6TCXKBxFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274884, "uuid": "ea7c22fc-54a3-4e02-9866-a31d6d0df553", "value": 541353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274884, "uuid": "107296ea-3430-40ef-ac0c-e7fef21d8d8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274884, "uuid": "1f361c8f-1e8c-456d-8786-cc2384a04a77", "value": "48fd49859ab67fecee9f2df7f99488d9638206a8998856eb86c635c0ec833100.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db4fbb8-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263882, "uuid": "9d671ff3-61e6-4213-a4d5-dad01192c72d", "comment": "Malware payload (Mirai)", "value": "bc1b47b9fe768d59b0cb8b93278484d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263882, "uuid": "a855babb-5bde-4db4-91aa-7c56ba72d319", "comment": "Malware payload (Mirai)", "value": "49353d406e1278fc08df5287398e4370d61df6702ce1920bf93633157caa0d02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263882, "uuid": "7e7fc8f9-f24d-4b9f-81ff-48612e39f4d9", "comment": "Malware payload (Mirai)", "value": "1c3474c953cc49ffb22cbcb05d4e5700c85776e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263882, "uuid": "439ca425-3ae9-4696-80c2-7bc1e441f89b", "comment": "Malware payload (Mirai)", "value": "e1e7407d614f8cac1ff709970d2f1fabf717d74ea6fbdd330180b0f2d46a08b33f25c805366899127c758d85c3b6c38a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263882, "uuid": "471f35cd-12bd-4dfd-a55b-3e89613b0d8d", "value": "T158144B02771C0F43D1572DF02AF727F183EBE9512AA2A644F61EFE845372AB16449F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263882, "uuid": "1c944021-ff01-4c3e-a7b5-4d981f3e20b9", "value": "6144:kAWKe8yxer7zm4xplZT3NfM6IXUtj/3EXPtlr4uvk:Yr8PLx3ZT326IXUtj/3EXPtlr4uvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263882, "uuid": "9a296b41-b2cc-4652-886d-fdc74b8bf08d", "value": 208699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263882, "uuid": "30ef9029-2716-4132-954a-8c2758d1c2f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263882, "uuid": "6c73d450-7457-4a57-8725-839b1f6d121e", "value": "qv3.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623dd4e1-c163-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791276801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276801, "uuid": "864b9b17-5781-4262-aad2-0d68b463f1c7", "comment": "Malware payload (AgentTesla)", "value": "9f78995780f0969578e016239a6e841e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276801, "uuid": "3419451d-75aa-44cc-9e16-83dbc274e45d", "comment": "Malware payload (AgentTesla)", "value": "49565c6e04fbffadc9138c1203b18a88bf3bf497167df4a5c6a00cf7f5f4188d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276801, "uuid": "663afaae-3a07-4ced-b8f8-c653fc325fbe", "comment": "Malware payload (AgentTesla)", "value": "e090f782ff6bf7761e339d9b12dde8e4b11fcbe1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276801, "uuid": "754946b0-154e-4901-aa4f-287ff07fed86", "comment": "Malware payload (AgentTesla)", "value": "ce14a0cf4216c1b81aa797eae5b75b308607ffd7953d1037e4ef9bc6ee7809be3966f3c39b23ed96c385bcf9c26e7826", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276801, "uuid": "4b9b4b72-cf24-4755-ad4c-38517e98714c", "value": "T13635233C4D4683DF0912AAFABE217801BA94124749861723B3FCC6157BBD9A0DE33D67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276801, "uuid": "f65f37b2-5fe5-4854-ba1c-c84f28418a1e", "value": "24576:w4z3PhkCsMlW/e3glN2ws9iMpg+L/c0QY01CUzIeHHQ:wQ6flNP+j+AALHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276801, "uuid": "51344077-beeb-41e0-943d-7dd728b2f0b7", "value": 1093085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276801, "uuid": "49bfe355-09f9-4c3e-8514-806ee462c14c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276801, "uuid": "6f1b3fb4-4250-4141-83d1-8b28845e086b", "value": "steinn.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a550b18-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303068, "uuid": "073e58ac-437a-404f-b535-376065dab83b", "comment": "Malware payload (Mirai)", "value": "38f50ac572c68ae752b3c49afb365434", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303068, "uuid": "b3de1ebf-b565-41a8-b469-16fc77fb3ad6", "comment": "Malware payload (Mirai)", "value": "4a0eb6f71a5cb1019477dbdbba239dfa095a8bbfa30315878a835936fe307e73", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303068, "uuid": "92d66997-c7ed-44b7-b167-6118df243bef", "comment": "Malware payload (Mirai)", "value": "19c73f9b59f05ed79e50dac0a3695c2bc8849a50", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303068, "uuid": "a3a9a757-3518-4776-8c04-876b58d966ab", "comment": "Malware payload (Mirai)", "value": "446af624d2b02451f4637fa8139cef1d2cec52f9661f75bed16d2a70d37993349b577f63bd33de39a2ba2ff9ee1dfcd7", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303068, "uuid": "1a839d8f-27bd-4e24-aadc-e8a5a9275cb3", "value": "T129930205CCA3483FE8B7EB77674C7517E840A1FE4B640BC0D890518FBD05AA796D2D66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303068, "uuid": "5841b1a0-d186-4402-890a-6610f5464a39", "value": "1536:dUmltFmoKQlccpTmFNu1LLJBj8XOzNHWDGZSX6TZjI9sFCCxUnsd9JhA2:PzgjQykTwwxEXOJHWr2jI9sFCSUn29rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303068, "uuid": "64b12816-b61d-4d21-ba2e-12176e53ee7f", "value": 92864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303068, "uuid": "686ab2c0-1530-49e3-856f-81d88afba555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303068, "uuid": "e6c03542-a96c-4a09-8deb-87651017c4f0", "value": "flutter.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40f7af4-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272644, "uuid": "d0c64c81-f114-4664-be3a-2fb465103d07", "comment": "Malware payload", "value": "f38b12af7bcdcb7b099a766a3374f658", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272644, "uuid": "df75e416-f2eb-4a7f-8ab7-6e6b58832a17", "comment": "Malware payload", "value": "4ad0ed92b214c1948df6c648e59d0d5656031932b2a69f2bd09521b3a23b34af", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272644, "uuid": "6ee7849a-ce8a-4a87-9897-48f5bd82201b", "comment": "Malware payload", "value": "956015b8b2515c62ac122144c2f1ab1257ca5838", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272644, "uuid": "1df0224d-a114-4ae7-a4e0-74e085f25d49", "comment": "Malware payload", "value": "ad1e6d00b742a52c294f306b7f998b73bfd208a1b94d2225c5fd6d4c42a545d7423e6bf8437002382fcf174fbe36a4d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272644, "uuid": "76b6d8cf-1bf5-48cb-89f8-46003df08b7d", "value": "T18BC4231DA0547B51F64B6A78B323CDB09B29D03FD219C388A0840B399B5BE5769CD376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272644, "uuid": "3f717f9f-7c76-43f0-b8d0-8b6b03814a44", "value": "12288:mMU+0xq75aS9iYIp6cP/G2Bku6zXLDHXP427ba:W+J71vI/GzXnftHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272644, "uuid": "c5a7c2a1-cb12-4257-868b-7cf61ed1d7ce", "value": 587431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272644, "uuid": "b2a5a43e-30c9-4714-ae56-193fdc0dbeae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272644, "uuid": "c9e63f31-89ad-4f52-b4f9-63b468dc6f7b", "value": "4ad0ed92b214c1948df6c648e59d0d5656031932b2a69f2bd09521b3a23b34af.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc799a0f-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272282, "uuid": "478a1c99-4cfc-4b71-b00f-dbb05ff68426", "comment": "Malware payload", "value": "5d466d0fe0c76de2e0ffd51b1474c889", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272282, "uuid": "db25ffd3-0a64-4584-b953-3265250b91a9", "comment": "Malware payload", "value": "4aef07a734f0e6fdefa6713db3cc72f9abb030575b7e0ba297d9a983d694d6f7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272282, "uuid": "4c9aae35-1981-4c2c-876d-d762e9813c50", "comment": "Malware payload", "value": "c6a0d870c406efcde3e903a016aad2ef8e8565bb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272282, "uuid": "bedbac6c-f784-4795-b043-0ec9e9da46b7", "comment": "Malware payload", "value": "659d1b1d3dc3bfdc4f5274c171764eec4e5a39ddc586a6cd8a78be4ebb877b208929a1e7e54cb845a9ec28e86dffe8cb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272282, "uuid": "e84bdf83-e557-4d42-973a-ed190c44cd1f", "value": "T1605533CA813C25844F3D0FD67AFF966C61248FF810411C676F1A98AB253E35F8275A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272282, "uuid": "69181384-7174-4f6d-a06b-f295b6dd0476", "value": "24576:zoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR3Bc64I:zoZ9bq+MmMEL+hcjXHC/wnwd3K6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272282, "uuid": "63ede7ba-7dd0-470d-a0e2-3010a77a4c03", "value": 1380032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272282, "uuid": "ca4ea4cc-e790-4bd5-9212-4ea690d2dffc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272282, "uuid": "659269c3-0c22-474e-a00b-0303d2bfdee6", "value": "4aef07a734f0e6fdefa6713db3cc72f9abb030575b7e0ba297d9a983d694d6f7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332d73fe-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271139, "uuid": "02a50397-f493-48b6-8bdd-cebdc8b08b35", "comment": "Malware payload", "value": "ef5bcb768117953cb9d351ae20c44f70", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271139, "uuid": "68d1820d-c18b-46b8-a046-36bb85fe3152", "comment": "Malware payload", "value": "4af2f3bd88adee84540c252f7236f82488c3c41203408c9a53a834e8029a5a3d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271139, "uuid": "a00afa04-8ae4-4899-93b6-f00d0b66f83f", "comment": "Malware payload", "value": "5c76474f40b0e2e85c6bdbb336b680c1d37eaa5b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271139, "uuid": "9b1fdee1-3e4d-4215-9cd8-495ce12d2920", "comment": "Malware payload", "value": "7e1636e31fc7bbb2eb555737cae2ad6cbaaac02bbfb489a5941cb62e16564dcf3f5c754a91948d58f1829fb505421044", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271139, "uuid": "631b82ed-e999-4268-bcd9-21994335128d", "value": "T1A131AC085BC80214E2F38E3664FBE301E9757892FD43DF6D0180528C2551150F8B6F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271139, "uuid": "c8c431bd-a7ae-461f-8cbf-e1d2f583504c", "value": "12:8N0m/3BVSXzvK0xMnS2u+fIlVlDmo0I6iNL4t2YqlWUe2ZIjdx:8NJ/BOKwh+fk4o0a5/u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271139, "uuid": "ff584581-0d3f-4dfb-a4d2-685773b0862e", "value": 1524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271139, "uuid": "2634b280-b7f4-467e-b0ef-c22c1f06f5ac", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271139, "uuid": "8af8047b-fab6-4330-9af5-4a72df418258", "value": "live.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdec978-c11f-11f1-927a-4201ac107004", "comment": "Malware payload (NanoCore)", "timestamp": 1791247806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247806, "uuid": "dd11f0b8-56c1-4f61-8114-ec10d089e7d7", "comment": "Malware payload (NanoCore)", "value": "6baea71e36ded632af5dd706a7bafa25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247806, "uuid": "c4406641-9cfa-4da3-83f0-47a6a8f90026", "comment": "Malware payload (NanoCore)", "value": "4b204193a8b7165f99a401a2ab33505c5f3af565ec3a8340cbcbda15b1a2bb53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247806, "uuid": "fabcb529-b557-44ea-8ae1-6dea6174f91b", "comment": "Malware payload (NanoCore)", "value": "bcfc4ce5e26061b3076f8d74d800c5372aa7f87b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247806, "uuid": "5eada9b4-4a0c-46a3-8700-bfebd6f87c98", "comment": "Malware payload (NanoCore)", "value": "b62128382fb3db291d83a7b848ab99d4907692a7e6ba7d22a9f658ff4b7858e1886c6125d1cc04f3e19befac875b4f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247806, "uuid": "666ff37d-cb24-42f3-8b9f-e4c2e990d9e1", "value": "T13814C01677A84A2FE2DE86B9A12212139378C2E7D8C3F3DE18D415B78F267E546071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247806, "uuid": "22ce0a0b-2cca-43c4-9146-bf0b3d23ebcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247806, "uuid": "428362e9-98d2-4363-9cea-1a23d504a9a3", "value": "6144:MLV6Bta6dtJmakIM5hc0kTgdXi6Wv7zoEW:MLV6Btpmkec1cXNYAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791247806, "uuid": "db652c9a-4361-4889-bdd6-854236c889da", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791247806, "uuid": "508e3cd6-e318-47f2-8260-64fb1b5a1a58", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247806, "uuid": "433e29f0-96e6-425a-95de-b88ad3155ca4", "value": "6BAEA71E36DED632AF5DD706A7BAFA25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae671e76-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275641, "uuid": "7202f84e-d3a6-4b4b-8d59-61111211c309", "comment": "Malware payload", "value": "03800f85684fd5ff440e1b50aca6902a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275641, "uuid": "d01f0934-81d1-47d3-975b-7a80cf573edf", "comment": "Malware payload", "value": "4ba005ca00f8d0fab74e0383704ff5cd6d0562e252510bc674c97fd03e70b25b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275641, "uuid": "1424ecf6-2029-4848-963c-c5a395a20dd9", "comment": "Malware payload", "value": "73161f3d0d36272de075e2cca868dcbef17cb65c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275641, "uuid": "91287fb5-5503-4033-8b20-d7797e6c683c", "comment": "Malware payload", "value": "ec3ec447a6c7b6d0db04327a3b2be7169a617bfc0146c791471e6e779af5f3c704415beb17414880561d3b154d3d2e56", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275641, "uuid": "e952a1d1-b623-4ddb-8ceb-1e84e09eb3a1", "value": "T1C5553387813C29884F3D0BB367FF955CA2248EFC100309675E2A9857363F79F866599B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275641, "uuid": "167eaff1-903e-44a6-8e40-71e67042d5eb", "value": "24576:ajqZmcpuioZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRG:CioZ9bq+MmMEL+hcjXHC/wnwdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275641, "uuid": "3999529c-81ef-45b8-8b75-c7e9df0abda5", "value": 1394887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275641, "uuid": "e36a7773-22f5-4a29-901c-e0a09d6f4973", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275641, "uuid": "20c910b1-1135-4fd4-b877-3f9962828eb4", "value": "4ba005ca00f8d0fab74e0383704ff5cd6d0562e252510bc674c97fd03e70b25b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c95fa2-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276079, "uuid": "bc062253-3b43-4f2e-8035-1358af2b6c53", "comment": "Malware payload", "value": "4f1a49d10d76ea7dad93b2bbfca37c83", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276079, "uuid": "a213e53b-2d1e-4e62-a383-797b61fbcd3f", "comment": "Malware payload", "value": "4bd31446cdd01a5d028d51f86786447c13efd388e8421902aeae1bacfcc504e4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276079, "uuid": "e5fa0287-86d6-4109-b6ae-1a6651f173cf", "comment": "Malware payload", "value": "70540a395236d6ca9c2fb97c5294bdb11f62a4ac", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276079, "uuid": "689cafb5-9938-4b50-9336-1aefb78fcf9a", "comment": "Malware payload", "value": "601a88aef1f679f57e163debac40cb4b7a96b464239e439a14883c3593d59bda831d9f641395e711701757aefb4b9674", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276079, "uuid": "d4310b86-4324-4e6d-8648-cdd35fc6a252", "value": "T1C0553387413C18C44F3D066767AF996CA2259AFC20031C777766446B353F3AF8AB998E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276079, "uuid": "3b7090f2-fe07-4fdc-acaf-6435c745364c", "value": "24576:4oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRHMU94:4oZ9bq+MmMEL+hcjXHC/wnwdHMUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276079, "uuid": "fbf3683f-6cbc-4017-bca5-f93c5e6e083a", "value": 1387699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276079, "uuid": "a6505571-d74b-42a2-9d54-ac536be905ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276079, "uuid": "0f1e2ecd-31ad-4a4e-a8af-05f31257609e", "value": "4bd31446cdd01a5d028d51f86786447c13efd388e8421902aeae1bacfcc504e4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29082473-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270692, "uuid": "7b584175-73fa-4eca-a8bf-89f30d514a3c", "comment": "Malware payload", "value": "9373909b6ac26f6a342433a4b4785c6f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270692, "uuid": "889c4e11-9312-4a6a-8410-d54f169cdee6", "comment": "Malware payload", "value": "4c3b9789ab65332405ed348096380a3f8bece4c2156b9da5319bd7697e8afcf9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270692, "uuid": "bc569226-f384-43aa-a49d-daf6b184f627", "comment": "Malware payload", "value": "bbbd8adfd4b01bd5b00cfcf2dfb1b92a037e283d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270692, "uuid": "7a1f1ea9-9b6f-4c4c-93c2-62ef1ffc73a0", "comment": "Malware payload", "value": "83a6612653fbac5631bd27f491e9b784a5f2830112b6b227ff4d7346beaf2887f10805bb732e06a944add7f2e2e2fe7d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270692, "uuid": "433b1c2f-c7c3-49cd-884c-eaf6a47f8a23", "value": "T1C2B423F5AC68621A276F9D13E762EBD03B7DC3AC265313C42527A2CC404B96B116E3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270692, "uuid": "c7301dcb-ea53-42cb-9f61-f2eb51ac66f0", "value": "12288:brLZ+vPYN9Vr64fQ/IPI2si0Ndq8r04rxkF56zm5vf:PLZ+vwN9Z6qQQAHi05gUmNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270692, "uuid": "aae01dae-828d-4b7f-bcb0-a8216b44878e", "value": 538362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270692, "uuid": "9db72ed6-18ef-4767-80e5-611277df1562", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270692, "uuid": "87212f5d-c142-4c15-9486-4327e64fc7e8", "value": "4c3b9789ab65332405ed348096380a3f8bece4c2156b9da5319bd7697e8afcf9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128b37d3-c144-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791263353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263353, "uuid": "9fe45a0d-6ce5-4057-aac5-1cc15e5e92e5", "comment": "Malware payload", "value": "e2764c614e18921b1be36505386aa8fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263353, "uuid": "20f6090d-5c53-4c57-8b42-58209e2fb400", "comment": "Malware payload", "value": "4c9b06eee97e5d2776529a4df589821d977990946ae28027c87ef67c02a40112", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263353, "uuid": "ffaf4064-d49d-4c78-bc7a-52d16bef6986", "comment": "Malware payload", "value": "da69d97ea1c326839321d5bbc650312be80fd1ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263353, "uuid": "ced2fe81-e718-496c-854a-e6704722ee40", "comment": "Malware payload", "value": "bafcb9a05cff5610496d038299380cc28d5f0ab04e534bc13f2585fbad99238c5713e23b9bc24f8a6d45db0ba0b03a17", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263353, "uuid": "b8b1bfdf-ceeb-42a6-af9f-47fca937ce6d", "value": "T15CF2870FF291DA3CC4C3E2346ACBA570A570B474AF32610F369523BB25A57984E79F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263353, "uuid": "6c399611-667f-44c8-a0b0-11010ae5f262", "value": "768:RWpU3VLD7zrjbTLD7zrjbTLD7zrjOm+WuGe2Om+WuGe2Om+WuGe2Om+WuGe25Bpg:R0dP0oDMee3TQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263353, "uuid": "12b40e6d-f919-4e83-b844-5b74152c6e2a", "value": 36144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263353, "uuid": "b5e2bf37-9a91-404b-a546-a2baa272f4e6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263353, "uuid": "4533a16c-17dc-4195-b26c-0331b09cd9ae", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdf540a-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271456, "uuid": "8dd0ff5e-71c7-4835-885c-31f18034e05c", "comment": "Malware payload", "value": "23324b2bd2cda369b51b0a34d15c99b4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271456, "uuid": "8444bf40-0eee-4ebf-b2a5-ffb8166f4e7b", "comment": "Malware payload", "value": "4d00bb086743546c31cfef1815f4e15b13559537699af7ac8ec64db3815a7404", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271456, "uuid": "9f045543-042c-4dfe-ac35-c3399330da90", "comment": "Malware payload", "value": "403d5f55e7fef94500009e60599c65118a3a87b3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271456, "uuid": "52f91f40-8bc0-410b-b248-42f92e71b940", "comment": "Malware payload", "value": "48f14354f6ba90fe4e32b7e2cc25ce0df4e1c5e5ff88d35ca9574e9379c606ac2cfb25d6733f96ef4b6333bb7396dc36", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271456, "uuid": "22a6fb79-8f42-46ce-b942-834e12fd3ef1", "value": "T19B753306AA6CE413FCA342B4878DB3BAC5C570570E848E7B5E7592218D5FFD40F28A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271456, "uuid": "9f822e92-a087-4f93-84b9-2e74488a6bc8", "value": "24576:e7+ZbyADoAUja4Fz6EGE5KKox5tPTcm/0c/7n2U3W/bKkdJQlI5zfPR33FZUoWc5:5WAMAUjamzvEhTV/0M2Um/TdGC913Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271456, "uuid": "a389edd7-7f47-460d-bc79-df9b3782bdd1", "value": 1584465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271456, "uuid": "fde65703-a16d-4323-9b45-8406caad5528", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271456, "uuid": "28659d88-5b7d-4924-aabc-f6d8700fb59e", "value": "4d00bb086743546c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d5e0ab-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "cdb4fba3-1f8f-4d82-b9e3-3416147b0d13", "comment": "Malware payload (Mirai)", "value": "2be8d6396c1563f1e61f8a8e6107581f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "79a576ca-9d7e-4776-b58a-574e2a5067bc", "comment": "Malware payload (Mirai)", "value": "4d980590fdc794458e66ecde82b683e0b2b057811de970befa53c8ccb5c44b05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "ec3f984a-e14c-4f8c-9d2f-46cedbdbea89", "comment": "Malware payload (Mirai)", "value": "c3dad37d3b2336e8b800d5a3f373d7604a97352b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "f08c0a24-a892-4669-aec5-ebb4d2d5b87f", "comment": "Malware payload (Mirai)", "value": "7c19f3b5879e4c5d6f4f3e30d9cc5c9f61efce7fc620800cb83fb9f5a8a9389e5856bd21b8fc94f7f2e80e7df1776386", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "15a20603-1225-4be4-8399-ef52d2216473", "value": "T1A5F33B06B30D0947E2672EF43B3B27D1D3DF9A9121F4E744251FAA8A9172D32158ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "68d1d13f-c488-4843-8da3-4daa00beec2d", "value": "3072:0v9PHxzwpHQxWFrctE3u6LVFq3tpvx6GIW:01PHkQxArcmu6LV03XwGIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263361, "uuid": "1c464b11-8dd3-4add-b850-a13d73a7d18c", "value": 158956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263361, "uuid": "97ad1ed7-ed70-443e-8e1d-87ba3da32298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "bd25e94d-3781-432e-9e78-af2b8e77bc23", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878a409c-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303063, "uuid": "10e1ce2a-3a73-48a7-bc49-4411b6d40927", "comment": "Malware payload (Mirai)", "value": "ebc8c23c4c47ba90b59fac9769bb63c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303063, "uuid": "8bb13ab8-d7d8-4d0c-b5a0-18533cb40a0d", "comment": "Malware payload (Mirai)", "value": "4dca20379700bb17721e30754df5b742aa56681b476959e126d3d87f18feddb7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303063, "uuid": "34263cdb-10a4-437c-b675-420136fd4db2", "comment": "Malware payload (Mirai)", "value": "9980328513edae1e9d085ff224b94885862bad95", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303063, "uuid": "fe7cd76d-2b0c-4b32-9f36-e8b5f0ccbd40", "comment": "Malware payload (Mirai)", "value": "623f1a74e3caa4d57a4aadfa7c8291878694f6d8809a6be57faf2dda9ba601072878f269546aa69c91bf1e0ac95baeda", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303063, "uuid": "70fd561b-e32f-4799-962d-1e0889c78639", "value": "T1D4F37CC5B2083D6FD5933F3EC50D16179D0C8F57A8838A1280AAFA875BB39971F3654A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303063, "uuid": "6e3bb1a4-52e9-4218-bd0e-1ea497a5b86c", "value": "3072:OJ1ccUINFTv5GcvIkItddYoeL1TFv8ro3DvXn+MavvIoeMn:u1TU4Fr5voddYHL1TV2uvX+VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303063, "uuid": "e909ee70-b106-4682-81ee-eb100cc4e61e", "value": 166740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303063, "uuid": "5633a30d-e640-4653-a669-fb5a406df1df", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303063, "uuid": "31eea544-5c7b-4912-8cb6-f206c996c821", "value": "flutter.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf308b6-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275690, "uuid": "3dc5c30c-ce6d-41e1-b7ad-dc3bf16990f5", "comment": "Malware payload", "value": "c82d207db0112fc03d15a2a2bd406622", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275690, "uuid": "3da3f11f-ca3e-449f-8679-bb5232345ffa", "comment": "Malware payload", "value": "507553046422acd58596a363c6c1adc1ad806f80da5655cd6236af7598fc9049", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275690, "uuid": "54aa429f-61ee-41b7-991a-33bff0ac4d5c", "comment": "Malware payload", "value": "fe0ce42f54f20c274ebd6b975d67008e86c3587b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275690, "uuid": "d4f419ff-22cf-4028-8e7e-24f881174acf", "comment": "Malware payload", "value": "46fea34bb9096a164ec03a717e54975945c49fbd34490fdc77e797504bb62f3d37498de7a5e0486edc12e8fa0027b4fb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275690, "uuid": "c5d208cf-587e-49cc-9614-ce920aacb7c3", "value": "T166C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275690, "uuid": "d3580d83-42b6-4e63-b9cc-f0f2b44d95e1", "value": "12288:n+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byoH9I1P0QKw6FE6:n+QqldA/TSO713u7xnoH9IaQKHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275690, "uuid": "9c92155f-82d3-4a5d-9bc3-381d1e41a933", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275690, "uuid": "7eeb634c-f200-4503-bb0b-e5ef7f59b61e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275690, "uuid": "aa13e3a0-35d9-4e21-9024-d90097fe7b93", "value": "507553046422acd58596a363c6c1adc1ad806f80da5655cd6236af7598fc9049.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533e4958-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274629, "uuid": "d29fa40d-119a-4d51-a2e3-59d1b713ce93", "comment": "Malware payload", "value": "61f21b78a1211e6b264e5597901b6c23", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274629, "uuid": "8caa624a-2f50-4850-a4b1-39b77ca5f31d", "comment": "Malware payload", "value": "508108c225684ce628266a2f56267f84353d3fbad72fcbfb7966ddaeedddd988", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274629, "uuid": "93a8d48c-e008-4dfd-a5bf-7bc0ac3f2937", "comment": "Malware payload", "value": "3e47264b2dbcb97e38af7255a1933ad02168da87", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274629, "uuid": "bbc09644-585b-4e79-b642-440012579107", "comment": "Malware payload", "value": "cfccf79e940a6464ba0a87c75062028c7da11f04c59b3922044ccb6f83205806274ab2bce59f00848bed2e0aa333cdd3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274629, "uuid": "4a55f03a-ee1c-4ae1-8561-129d7ddf508b", "value": "T148B423CD64BED4A87B658DDA9FDCBFD30CFC0036AD7526F2A51C1A13A1C400B64E958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274629, "uuid": "58c3bb1a-bf43-437b-95ff-ce9facc264d9", "value": "12288:VB/e4pqNFTFbEXkLDoGbDDGIabs/7iiEVwYg2l3/2Nyn:VBm4pgTJoGTabs/7iiWw0Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274629, "uuid": "ef8b5abf-f403-4097-807e-ab9b8d2dd1da", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274629, "uuid": "66bcedd5-e4a7-4ad6-803d-a7ab6c746dfc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274629, "uuid": "24f73895-b138-447f-b972-84d58f47445d", "value": "508108c225684ce628266a2f56267f84353d3fbad72fcbfb7966ddaeedddd988.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce0a19e-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791273383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273383, "uuid": "ed91126a-2940-44ce-b5f8-c75888f5bbde", "comment": "Malware payload (AgentTesla)", "value": "5ff00af980c7ad3130ee2056335b2a49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273383, "uuid": "7b5cf374-e25c-442c-a93c-5a3332e4e8e8", "comment": "Malware payload (AgentTesla)", "value": "51629d832832833363650fee28d130f0299c65bbe9f00b1a7be1cd91e3f3e33e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273383, "uuid": "83260096-06ef-4c55-b32c-30da3858228e", "comment": "Malware payload (AgentTesla)", "value": "a8a76dfeab6064e3f53a303016fa9427788e1110", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273383, "uuid": "838815ff-e9ee-4d19-97b3-822a55990fd4", "comment": "Malware payload (AgentTesla)", "value": "93e3a440fa4e7f9a447880841d20d4c17a4585fef770a53acd8eb18760214d5e0a51d0491b5d4a9800fe96e67b04d6ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273383, "uuid": "fa22d57a-6253-4d2c-8219-d255cbf7833d", "value": "T15BE4E0E49AC268D30EEC5B245BDBAD260EB777E514BE86F4E1258788A350D00DDF9C4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273383, "uuid": "0deadd58-3230-44c0-a9b5-f12908b2670a", "value": "12288:7uHEZsVl8vfbNjUU+CWFj+KNTvy9kV4hlxCPFCx8EyyvWy+ChP8uglQZd0:7mEZ24D+CWFRx8G41cW8IvWykugiZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273383, "uuid": "ef263d07-7c8c-41e0-9444-e5a4fbadf891", "value": 705990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273383, "uuid": "541049b8-c8b2-46a1-b673-03abd44e2f44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273383, "uuid": "169901e5-472d-49ce-9e74-65b190b8f2f9", "value": "PRE-ALERT HCC2025122601.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0330b305-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274924, "uuid": "38fbc673-234a-4f8b-8460-47f48034548b", "comment": "Malware payload", "value": "40c9bb75f41885fd1e3d13a8f078f1e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274924, "uuid": "6d48478f-35f4-405b-81ec-eed9da5ee4b4", "comment": "Malware payload", "value": "5167a762c4feacf0acf0f9565cbe2c5b44576df381364965b7b3f509270ea2c9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274924, "uuid": "13dbe74b-3b7f-4e5b-99a5-f713e1e83e70", "comment": "Malware payload", "value": "32838df296fb9ca8d1e4f02c3569e561b22436c6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274924, "uuid": "ddeb8f08-9cc3-4c4f-91dc-d27a79157390", "comment": "Malware payload", "value": "8547c95d13f46f17b0b2f4dfd0eb4c365493ac441e98b3c6d80897eddb05fb4a639f70a561024a0db03bee1a0a42c318", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274924, "uuid": "c255466e-dc90-43a7-940c-47e5f05df728", "value": "T18EB423CCB6CB88CC55A63134E6A20B4154DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274924, "uuid": "439059e5-c766-4540-af46-e4b5acc29ac9", "value": "12288:KwsK8MG1KnyC/G76u6M0gXar5qduvct2ien3P+beU:KKGcGmuwjnQen3Pw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274924, "uuid": "74f0da2c-3156-4e5b-9843-00e147b904bd", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274924, "uuid": "ea86c889-b83e-435e-b904-e45a6d622d19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274924, "uuid": "51bfcb42-d97f-426c-8822-0881d2d9aa4f", "value": "5167a762c4feacf0acf0f9565cbe2c5b44576df381364965b7b3f509270ea2c9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fadd38d-c11c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791246330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246330, "uuid": "ba1652cf-d621-4482-8c96-67253337308b", "comment": "Malware payload", "value": "7a4d70b7fdb9cdfdc3abd36609228336", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246330, "uuid": "a2de57d2-1e6e-43ac-9f74-cb933f164f18", "comment": "Malware payload", "value": "518b2458cd4750cd6111032b8758029bfb1000187e04e28bd273f5be8c15c16f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246330, "uuid": "ff1aeb43-d21e-4ea0-8e5f-0a880be6bdb8", "comment": "Malware payload", "value": "9a5552c0ca7219b67bd835c3345790dbeb62f0d7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246330, "uuid": "c03630c3-4b88-4675-9506-b8658dbe2378", "comment": "Malware payload", "value": "0f24b0dfa712d520cd749b4de81aa31802a6e0b14146569bb35aaf4bdbb4812dc744f66cb90d4f46521302f17b07ccc7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246330, "uuid": "e20bb1d8-8b95-4cc0-9834-ad23c012cfe3", "value": "T12D753317A668B803EC730375478D62ED89C9B0170E949EAB5E7943208D5FFD84D2CDBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246330, "uuid": "619b5673-2771-4004-9441-69345e41c5d6", "value": "24576:pw8LxU0DqGW1sKFTwE0kJKEYpZLrh8i/0cdHT0Q3gfXa2dtoHUlzfPZ53bFmOWd:pFe0+GW1ssT3evh5/0CIQwfdda0J33a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246330, "uuid": "3913a800-b0b8-4566-99bd-9428a9adc73c", "value": 1566735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246330, "uuid": "f80ddf0e-2cd6-4511-8cf5-c475816eb34f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246330, "uuid": "8986ccf4-c543-496d-b1e1-fc96841f614a", "value": "518b2458cd4750cd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9eef312-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271338, "uuid": "1f02754d-a959-419d-b9e1-213a05ea3bd2", "comment": "Malware payload", "value": "006259c19b2e18a60b71f688b7391183", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271338, "uuid": "611e95fa-9e31-4d74-909a-d864564d5c2b", "comment": "Malware payload", "value": "51baf6510ac1b91c66c43803baf5a1318e7205a8cc82f92e68191c2990b45b95", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271338, "uuid": "b424f19e-9b32-44fe-908c-e44cdb638986", "comment": "Malware payload", "value": "0dc1d90130de5120d70b0fe8ac81d5c2b14ef00c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271338, "uuid": "44e63b1c-0666-4c24-9671-cae0e8f93ad6", "comment": "Malware payload", "value": "cd5289346ba9c736f0f1a4e29dd59d9863de13528a2b6721929e6f4255d809a6e6a797268f08167214c19b15ba21e444", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271338, "uuid": "c4e8ad0a-b8ed-49dc-bc42-e7d2820d6893", "value": "T146C42304340641D5835A2B1EAEC4E6F0BEB560DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271338, "uuid": "c973834a-91bc-4e18-8ab9-7ab443bd1272", "value": "12288:z6wlOMWROC/FTeHo22Qm7NzofOr68m/eA924EwCZ:r4MQOC/gHozN7NzomW85A9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271338, "uuid": "8057deaa-d89d-4df7-833d-2b290ac614c5", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271338, "uuid": "8ca47315-4253-4d62-9704-a703300b9d78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271338, "uuid": "75da9a9a-e3ab-4582-9b84-7b4cb7080e18", "value": "51baf6510ac1b91c66c43803baf5a1318e7205a8cc82f92e68191c2990b45b95.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b1b5fa-c153-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791270175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270175, "uuid": "00380c3f-834c-47fd-98ff-96a31c1399cc", "comment": "Malware payload (Gafgyt)", "value": "0dcb5587c380ac6ea19a286effc2f2d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270175, "uuid": "9bb1ecf4-a04c-4d9a-b945-1c27b4086443", "comment": "Malware payload (Gafgyt)", "value": "51caf63a51a28343a2766566ece2c8d83725de5000c5420ccf491bb5bf2ebe39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270175, "uuid": "d985f3ce-772a-4b94-9837-52fb1fb5bd21", "comment": "Malware payload (Gafgyt)", "value": "0a1fa288ab1ccb793d42a6f776b74a764f847c24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270175, "uuid": "0923d2da-5343-4203-8bad-ea28199f6464", "comment": "Malware payload (Gafgyt)", "value": "1788b20d62475d5f897cd916567789a6adf04612313dc2fd893de435175223b4d6b0446abb98f104c402a1a15ecefd59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270175, "uuid": "18e7aa5a-a5a2-4a9c-b433-444453611c22", "value": "T165E3E5CCFD54476FC2D223BAF74A428F37261A789397B32159A7E9B02BC57582D38190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270175, "uuid": "48cd9911-a8c4-4abc-be98-8bb24f4a668d", "value": "3072:FklRIBGM3+mgYwGMyDRgi8KGqiPc+k3WL7tX8h3GbF2lLothTpKkTbb3BoyehLTH:qf3B7ILLlA95bIn+nDhT0Qs8RT57g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270175, "uuid": "5fc1fc92-a914-4a51-8470-0beb063f39b4", "value": 155413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270175, "uuid": "62859c4e-f773-45b6-bb5a-d93fe7d2ff2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270175, "uuid": "7971dd01-5212-4643-9bbc-fa363edce91b", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfc7cc0-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271905, "uuid": "6454c829-91eb-4616-8ac3-094d44569262", "comment": "Malware payload", "value": "7b78e65e45c33540c6610329c4c1cfee", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271905, "uuid": "1470284c-a5c9-4343-830d-9b88f4544e61", "comment": "Malware payload", "value": "51dc44cf9c3fdb45f40d654ad8136e7c32d2fd7f87ef03938c82209719bc3d5a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271905, "uuid": "987ffd7d-d952-41c1-bff5-79826cfc0240", "comment": "Malware payload", "value": "92cf0f2c69bb95897aa909e8a14e31d1a814a127", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271905, "uuid": "03b80217-e034-4b84-82ae-e2bf75a231de", "comment": "Malware payload", "value": "b54e5da2975eb65b60686352b959e664a9ea422ba322f038714c300b3cf02f54a6372549303019c1be880f4461c153f3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271905, "uuid": "b19b27f4-6266-4df8-a180-cf0d63b31397", "value": "T1BD55334B813C2DC89F3D0A57B6FF446C62148EFC21421C371B26589B753EBAB867894B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271905, "uuid": "c87e973c-ec1a-4579-92e9-732a3924c998", "value": "24576:6oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR2t60BwgS:6oZ9bq+MmMEL+hcjXHC/wnwdD0BDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271905, "uuid": "90814786-6c76-4eb6-9c66-5d0089067d17", "value": 1394759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271905, "uuid": "b6f49d57-0bd0-4b9d-bcb2-d29d0b48db5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271905, "uuid": "8309b266-30c6-40ea-85ef-dab32d0cdc6d", "value": "51dc44cf9c3fdb45f40d654ad8136e7c32d2fd7f87ef03938c82209719bc3d5a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9da333-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273004, "uuid": "1df5f6ab-987c-4452-abc9-05fe1aba613c", "comment": "Malware payload", "value": "9465a67b7e77289826a57ae354d43f12", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273004, "uuid": "f037bbc6-9a7b-4f24-b390-801eaadc4808", "comment": "Malware payload", "value": "51debfdf7332f1a00089109518975fdf53e3a4f32abbe9a7bf5496f71e68a163", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273004, "uuid": "52516ae8-879a-4f56-a944-8d1cf5f25c74", "comment": "Malware payload", "value": "43b961857bdd6c126ddce836b23e28cc53cb2623", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273004, "uuid": "22dff000-628b-471d-910d-d3d5553b82fb", "comment": "Malware payload", "value": "677b8f9e038022f1470bcb956f361c711d4cca6bafcfdf36cc1508cbf249dea16eef2249175ab4e18ea74b9f36baac00", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273004, "uuid": "42f8ba2e-bdf6-4468-b9ee-b74d38b02f76", "value": "T11DB42369227F71900C7543A94B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB195638E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273004, "uuid": "d50e59ef-8eee-417e-9b7f-81ddc9255d78", "value": "12288:A7JZAaFperqO3g/ALyYG0ZaDajTCXMO8xzDOe3Wk:cLpevA/f0Za6TCXKBxmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273004, "uuid": "8a391ab0-3f5d-4c63-96f3-fba797e6a4ee", "value": 542164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273004, "uuid": "8f19c617-e1f0-4fdd-bcae-f6e520b87c39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273004, "uuid": "cdcc4b8b-2699-4c20-b8d0-905db0ca8348", "value": "51debfdf7332f1a00089109518975fdf53e3a4f32abbe9a7bf5496f71e68a163.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acde28d-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271528, "uuid": "b1af0647-208b-4c3f-b1bb-8aaf602f5bf2", "comment": "Malware payload", "value": "4316416aec9f66d165fb73889120e45a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271528, "uuid": "86313b7d-778c-41e2-8ae6-1ff2972418a6", "comment": "Malware payload", "value": "51fd868c203c25ef86f6ae36f76304a252b8bb6d7633084e615bca6e08bd12cb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271528, "uuid": "eb132889-7495-40ad-8420-77950c89b1a9", "comment": "Malware payload", "value": "62286459448fb07ebd0dfd29be775e97710984b9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271528, "uuid": "40458fdf-6036-428c-b6a1-83a2ab81b887", "comment": "Malware payload", "value": "329248b1802c54ebbf8c1e2b6e9493959b58b71314e3b7242ad5e8cdf65e70660559bce9a742fd8075f0c2ff929624a1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271528, "uuid": "666bea80-a01a-4933-b3ad-5ee74de668ec", "value": "T1A655338AC17C1CC49F3E0A9779FF555CA2248EFC200208636B2A59A7253E74FC7B595A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271528, "uuid": "0fd87b8e-ba66-4713-b93e-6fbd1f26f536", "value": "24576:KPTJsZg55voZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRr:KbJZ5voZ9bq+MmMEL+hcjXHC/wnwdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271528, "uuid": "457cf759-ae0e-4476-abe6-b2e626f7ebd0", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271528, "uuid": "0f357137-0bd2-445b-aae5-b38f9ef5fcf8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271528, "uuid": "ca07a4b6-1bc0-4a2e-9675-efe39c57aab1", "value": "51fd868c203c25ef86f6ae36f76304a252b8bb6d7633084e615bca6e08bd12cb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5496ba-c1c3-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791318109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318109, "uuid": "b53e9f3d-6dcf-453e-9abd-d42de5a769f5", "comment": "Malware payload (AgentTesla)", "value": "ab5104c9f3af73c6f0f2032a2c893a40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318109, "uuid": "079828e0-d35b-49f7-af2a-522a605bca57", "comment": "Malware payload (AgentTesla)", "value": "5209aa6242215875f7f9bccfca412a72d0fd99db10e87ee7eab113cf88628d0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318109, "uuid": "0a26dfe3-629e-489f-bc4c-586305a0f2ed", "comment": "Malware payload (AgentTesla)", "value": "599aa90d8dbdf7da51ed512ed43456f2be1d49bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318109, "uuid": "12cad361-72ca-4838-9e80-5025d46b6ac9", "comment": "Malware payload (AgentTesla)", "value": "d1c1591e4579988a713df576c24ebfc72cdfe5c06daf90595ef566a3fa3afb1d926302da7b903bbc2992005a641bc31b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318109, "uuid": "6c2d3a88-9322-489c-b3bd-5ed338443fdd", "value": "T165E4DF454A01DD90EA6AF7224B7B763F23B0C241458BD298938CC381367BB50E3BAF56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318109, "uuid": "4533eb56-f569-43bd-98bf-daad15acabd0", "value": "12288:v8gHYHOgUQePy8FEK4+bCKnUiQeWXaA5nbUdiFuS/H2+qY826fgF5nYD:vL2ODQePyiRbR6eHAS2uSg4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791318109, "uuid": "485e0bf5-49f9-4da1-83b1-a07bbcba1aae", "value": 706749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791318109, "uuid": "5737daf5-9d21-418b-b85f-d899b8103c10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318109, "uuid": "d58cdbaf-8bbc-4b17-aadb-77f28311d817", "value": "SKM_7209435700.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60071e2b-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275080, "uuid": "a934c3c4-4057-47d2-88d5-3cc2f7f94f32", "comment": "Malware payload", "value": "5c7dd6e88bec175ec8165cb8063cbdf2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275080, "uuid": "96f65fff-f8bd-491b-a291-bc5cc34eff7a", "comment": "Malware payload", "value": "524384603f152f14822f5afa04b5e4eaf7c336289f7097d00ee1b0519a3a03b2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275080, "uuid": "fd6b7d74-5299-4a98-9466-6bda5050ccd9", "comment": "Malware payload", "value": "7c056f2df9054169010519a61ef3b289bf467238", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275080, "uuid": "a36916c3-324c-48d9-8c53-dd5e23c16b6a", "comment": "Malware payload", "value": "b611917f4b9310cb985d79e6ceca59a4750d1f43a49af2aabae3dddd044b465c82b66f6b2ec6b6368f8b5ee7c1a7cbf2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275080, "uuid": "f4b3775f-fa35-49e4-81a8-00075d7a4add", "value": "T146C42304340641D5839A2B1EAEC4A6E0BEB560DBFA1CF940AADD7ED06DE96A173C1533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275080, "uuid": "d0067cd1-2f54-405f-8678-6218ce6c0033", "value": "12288:L6wlOMWROC/FTeHo22Qm7NzofOr68mfeA924EwCp:z4MQOC/gHozN7NzomW81A9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275080, "uuid": "c25b11dd-469b-486f-9d4b-6ed8fee541b4", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275080, "uuid": "257af094-9962-46cf-b107-0056993f410a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275080, "uuid": "0ba5aa5d-0d57-4e71-9c14-c9cb8da6f12f", "value": "524384603f152f14822f5afa04b5e4eaf7c336289f7097d00ee1b0519a3a03b2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640c4354-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273368, "uuid": "5aed0626-cabe-4f22-b8bc-7caf361c04c1", "comment": "Malware payload", "value": "7061562d12103129fb03b62a273bc7e5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273368, "uuid": "d36ed38f-dfa6-4a56-9347-87311ae8ca7a", "comment": "Malware payload", "value": "5270fa0778cdcc5d35e01fe38be7c8fe373e4456d656a6564165d5b997b98dbc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273368, "uuid": "ec4b6ba7-6bef-4181-a725-657ba0a6c367", "comment": "Malware payload", "value": "0265c9212374b85cd74922d2cdc3e9350afefcbc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273368, "uuid": "66144855-1109-4ef8-bbdd-57cbb753c500", "comment": "Malware payload", "value": "37af070bb6a5f30b0e8dacff97707adcdde3557dd490d28223d2e1f1fc74497638cb96ca3e6776ebd27ac6e8d05d1b07", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273368, "uuid": "648e31e4-60bd-4edf-b674-bf5afb0aae74", "value": "T1C0C4331605CD4AE1C0D782FA175746F5049A4E38EF929A3EC43C34C9E340D79FB296AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273368, "uuid": "593e236c-739f-45b7-8b47-b2c1d758e8a8", "value": "12288:f56zQTBL8mLpPmA4C+9NgOZTUqnMmzDF+nuwsQab/YpUiyCs6ZHfipRwSb1eBb:MMTBL8SpB8NQqMm3FSuvdiyCJiMSb1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273368, "uuid": "3dd02805-f69d-4a2d-a450-38d234d09019", "value": 579945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273368, "uuid": "d7a2a679-9916-4cb4-bf32-726ac342aad3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273368, "uuid": "764fb60e-9346-4448-a284-8c616bb48639", "value": "5270fa0778cdcc5d35e01fe38be7c8fe373e4456d656a6564165d5b997b98dbc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d12ec7-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274259, "uuid": "51d4ea2b-5c14-4c14-b9e6-a296e54644cf", "comment": "Malware payload", "value": "dbcf390d61785d87d8e7ab808ceb377a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274259, "uuid": "42b07709-eaa4-4239-b122-4644898644d7", "comment": "Malware payload", "value": "52bc7b5568552f96f038b89af063739acac801e5063d8cce87f926fe0bbe5742", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274259, "uuid": "4e40e290-3b1b-44da-a2c6-12ee829c1969", "comment": "Malware payload", "value": "3620950cf8dbe2c85d16482d0f5aa327b167564c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274259, "uuid": "e02155b5-fc2b-4b28-9180-f1f7feff3dc6", "comment": "Malware payload", "value": "58edbf25c27485a24c42cccd690b4e46b9af57ce478dcdda767054fb33055e837860e4bda92e78bd28aa0568c96a3d17", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274259, "uuid": "0b2ba5b1-2834-4938-a61b-df5ebf1f18eb", "value": "T19BA4238274716D06D096CFBDD4C1AACAD06E023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274259, "uuid": "52f336eb-42e1-4ba2-866f-10e457fe11db", "value": "12288:Er06lUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZd:Er06lUv4t1cNk/wjibhv4b2OnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274259, "uuid": "18f18f23-41bf-4754-8f6f-4379e11e676d", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274259, "uuid": "37c9609f-66a0-4a11-bd7c-f83d6bb506c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274259, "uuid": "36e72601-9028-4097-a132-e9d160b97b01", "value": "52bc7b5568552f96f038b89af063739acac801e5063d8cce87f926fe0bbe5742.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2115c08-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271406, "uuid": "5e9d31be-2a5d-489b-acad-637cb2265232", "comment": "Malware payload", "value": "ae2b07ce5785f35c0a4517be9f8c6518", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271406, "uuid": "b1842c21-36f3-4256-9241-1dec8b89c0da", "comment": "Malware payload", "value": "52d7933859800ae43fbbd77ae20e8eaf957579c5bf533c03cbc0c9bfdeee03e7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271406, "uuid": "95020d1f-934f-4004-b83d-b27bf9763ba2", "comment": "Malware payload", "value": "e0811c033091c1d0a29cab4fcb0156838773e5fd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271406, "uuid": "2411c04d-4a51-4714-aa5a-8f4b656877c7", "comment": "Malware payload", "value": "8a5c15b4bf24b545a2ed5a6b7e7841868511e4e2e57f3f107a0036aa3f664f4fe48b816352d8b6d08419b993388e8786", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271406, "uuid": "4afc9fe8-8597-4230-bf49-869d617fe616", "value": "T1DAB423CCB6CB88CC55A63134E6A20B4154DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271406, "uuid": "10ae1443-16d0-46c2-837f-3bbb7186dd56", "value": "12288:kwsK8MG1KnyC/G76u6M0gXar5qdurct2ien3P+be2:MKGcGmuwjDQen3Pwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271406, "uuid": "47e5fbcf-6765-442d-b728-9a5968c52092", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271406, "uuid": "caa87822-1d1c-413b-8c42-7c3fcccd4971", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271406, "uuid": "78813a7c-f49a-4583-acae-efd551168f77", "value": "52d7933859800ae43fbbd77ae20e8eaf957579c5bf533c03cbc0c9bfdeee03e7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff42e237-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271911, "uuid": "d698027c-d319-4397-a905-d81119890b0e", "comment": "Malware payload", "value": "fc75216cc1108d996e03c66aff7b335a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271911, "uuid": "3b642fe8-172b-4fcf-872a-48059a835fda", "comment": "Malware payload", "value": "52e4fad5747cd4129ee012c0d85a0b8af3a1dfe844b0733838f9a3465c6504d1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271911, "uuid": "bb389e0b-4229-4276-ae10-262a64df6c75", "comment": "Malware payload", "value": "84a90448826a7a3a1769c552d4f8324102d63e82", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271911, "uuid": "7eadf8a0-8e1a-492b-b2a8-f14170f2607e", "comment": "Malware payload", "value": "b0e56bf54771184b0b367875314408bb4c8a0f281cf7771d18998a2e6728212b05ca9159c40ac8da7595d2234023fcd8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271911, "uuid": "23b5fd03-6334-4a51-876e-5913323ffeb1", "value": "T1925533D7813C28C49F3E0A6767BF851C62188DFC204308B76B5A49A7663F39F876495B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271911, "uuid": "f412a564-982c-49be-97c4-6f21e2e5cc3d", "value": "24576:3oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRKX0nv9Abd2:3oZ9bq+MmMEL+hcjXHC/wnwd3Kbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271911, "uuid": "b1f881f3-71ee-4a5e-bfbc-79f386936e0c", "value": 1386685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271911, "uuid": "728338d4-ec25-4b05-883d-cec860be4867", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271911, "uuid": "4e7d4168-bf5d-4914-9b7b-9bdecc95e3ed", "value": "52e4fad5747cd4129ee012c0d85a0b8af3a1dfe844b0733838f9a3465c6504d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ed2f32-c190-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791296142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296142, "uuid": "7e8a6909-180e-417c-9664-b8f389786463", "comment": "Malware payload (Mirai)", "value": "4b24aaa399fccc96d6ebcbf61f127c2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296142, "uuid": "d2b04bca-2038-4e60-825c-1703f5b52ff4", "comment": "Malware payload (Mirai)", "value": "5335c14095d94e0e58371cae68111b481c379e5ac8cf894606dcbb500ae88eb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296142, "uuid": "e76ec0a8-b181-4dc3-9f56-420bb543a484", "comment": "Malware payload (Mirai)", "value": "4594ee0f844a30148f77873fb944a3e3779ffff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296142, "uuid": "6e6d1148-e0a9-4443-b9ba-f4c9e8aab433", "comment": "Malware payload (Mirai)", "value": "de29731d636241c8fd4c758cc75b59eaa66f2a2562d038354bdb66f63e4dbac787bc14bda009575b6041c6eb44c093bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296142, "uuid": "19c65542-e29c-40a5-93ee-115cca3af70e", "value": "T12AD46C16BD919B91C6E24ABBFB9E4368731757BDD2FF7006CA045F903BDA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296142, "uuid": "248580fd-7752-47c7-a944-f63064e8975c", "value": "12288:IBnLK7rqpQf0H4l93asJfv4uG3sMzkmASAsoItLPmae:+LKa20H4l93asJfv40m/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791296142, "uuid": "a145330e-06ff-405a-b5f5-71ba1781a7b3", "value": 626312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791296142, "uuid": "826f2028-924f-4d88-ac56-e313bcbbf8d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296142, "uuid": "d4579b47-1e20-45c9-aedf-c4bfe23ce31c", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bd1ef8-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274769, "uuid": "8e0640e0-12e7-4122-9b72-e3ab8fae2c05", "comment": "Malware payload", "value": "182ca20fa81a6200d118cd57adbc5830", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274769, "uuid": "45f206a9-04b1-4655-b5db-7a6e7c7424d5", "comment": "Malware payload", "value": "53d2f2b630914f1d4f6dcb915eb77154e216d8b30b58ff4717167783ebc38b60", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274769, "uuid": "81014ed4-2541-468c-899c-d78826d4c194", "comment": "Malware payload", "value": "9ed05935b6f2c1d90dd2ba6abb8b545787040d18", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274769, "uuid": "091a06e5-767f-4f68-8ff5-811764aea72e", "comment": "Malware payload", "value": "647add5ebcb6618c13b51187fc4e76d74e985e0a0394fc374e79cf5d8c45b8f095ea9d8da8bf4d07293f5156c417048b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274769, "uuid": "2528351e-3a74-41b0-a124-58eb5cf9e1be", "value": "T14DA423EC4DA10A22AC6BB604290C5F430B65D44F3BDD8DE91A0F3EA4CAD7C544AC92ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274769, "uuid": "ac474e86-dcb0-4e42-b2d3-db5389e0439f", "value": "12288:czYfcEaN9B/Jm0LU0gM7aQISDbvyiXKkFfaKn:TfclN9BhmSHzaCKkxaKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274769, "uuid": "b1aa295e-07a9-4585-bf63-ad3429435e40", "value": 462519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274769, "uuid": "c04c7fe5-196c-4048-88f6-07ae509a9f50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274769, "uuid": "49422d49-e629-48f2-bb58-b3b5f12010ad", "value": "53d2f2b630914f1d4f6dcb915eb77154e216d8b30b58ff4717167783ebc38b60.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df02da2-c176-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791284981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284981, "uuid": "21f69df1-47f4-4ab8-bba4-e104b6bb501b", "comment": "Malware payload (Mirai)", "value": "50427eb681f3d2a0c0eddacbcb6f9bc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284981, "uuid": "0fb117e9-0ff8-4349-b488-b6a4736cbd85", "comment": "Malware payload (Mirai)", "value": "53dc6f13630a0f8c5a0159fccb6f98cc28ace7719dbe639f7e522dd0398a3281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284981, "uuid": "9ffcfdb8-1df0-4132-8d29-062dc6ea04f0", "comment": "Malware payload (Mirai)", "value": "27dd9c0f9980b0c0b44709507a0b07a1bdac5709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284981, "uuid": "5f11639e-eaf9-4428-963e-89eedd03121f", "comment": "Malware payload (Mirai)", "value": "c510a45cc53ab7ea6afdec12f41398cb479c3fe6d0236b019bc415a59446a40a7865ada85f71cf6cb1d275886ed9e293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284981, "uuid": "d5517efc-fbe9-40ed-bb66-b9fb72585110", "value": "T116341A0295518E53C1C71B7ABB9F865537336B74D3DB3302AA18BFB42F466AE0E2E111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284981, "uuid": "6a2ddc99-bbdc-42aa-a612-ce56a30f950e", "value": "6144:Rvh11MxQCX09u+ainuIaYRJgoMeAYfy4myVOAZ7ZQu6aRqh:R51i2CXV+ainMQJgoMBImyVOAZ7ZQu6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791284981, "uuid": "6bbdc38e-0108-47f3-81ee-6e12cb20fddc", "value": 236426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791284981, "uuid": "22392d5a-bbfb-4f6d-b84a-d8c921cfb99f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284981, "uuid": "03da55ab-6674-4c85-9dfd-4dac7326fcd4", "value": "qv3.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653cb8ce-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271223, "uuid": "37fb73ee-94c6-4b2e-95b6-9ce9bd868340", "comment": "Malware payload", "value": "817b8bb2a058ff33c208d47a54e31d5a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271223, "uuid": "904f9f41-4922-4b92-a9b4-a5311c369b20", "comment": "Malware payload", "value": "5405bc75c56c8d4a723af59a28a388395705512a6cdad8061f83265d0d116e00", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271223, "uuid": "99a52250-55fd-40b9-961c-9d16fcebacd1", "comment": "Malware payload", "value": "1c4fd3a00995414ff423177afef5bdba6c2916b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271223, "uuid": "b7caade9-d15b-49cc-a26c-6fd6a96a2bf9", "comment": "Malware payload", "value": "13220ab0fbddc7bc3a65c403e7fa8f2c991c332d2f47b879b3864c16bf28c071f70b74bde042be9f3652db31e2284cd1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271223, "uuid": "c28d681b-f226-4832-b63c-2552acee3ab3", "value": "T101C4236D7018EB38E507A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271223, "uuid": "456d8805-602b-4dcd-93da-fdd5e64fed41", "value": "12288:lMU+0xq75aS9iYIp6cP/G2Bku8OtNvC28c5/VTUPkYyX:x+J71vI/GUYc5/p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271223, "uuid": "4e078d13-46c6-4199-998c-e3fdf43fb57c", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271223, "uuid": "b1c86e33-8283-4746-93af-ce47eecafdaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271223, "uuid": "96562d0b-0faa-4d75-ab21-4eb56870eb4c", "value": "5405bc75c56c8d4a723af59a28a388395705512a6cdad8061f83265d0d116e00.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48368804-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273322, "uuid": "05acc8ce-da8b-474a-8e0e-03efa12dbfee", "comment": "Malware payload", "value": "e8eaae08fe2894002bd895746ac96401", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273322, "uuid": "3429af67-d502-413b-913b-f55160b3fbce", "comment": "Malware payload", "value": "5436714088737f2bb7964f21b363bca9ae058dd7d2ef54fbf1f3faa04aa70970", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273322, "uuid": "4d7c6d50-1545-4242-8349-90f5d95bdd1f", "comment": "Malware payload", "value": "294b51398f628b3a08e9cb2a3931b0ce5d45f4c1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273322, "uuid": "d14344d0-ff4c-4650-8a79-1e9f4e97ecd0", "comment": "Malware payload", "value": "d95cc3ae31198f4c2c330df26797865ec1fac32921e4384ae17c49f2205e94f52d40b04538b7841211616e8a8a81eec5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273322, "uuid": "87968713-893f-4fd6-a2a5-9153a8a2ef3d", "value": "T1D6A423A35253A2D7ABA19F74E40D93D1E2CFCB0D3D9AD2F423B6F904FAA51C9444841B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273322, "uuid": "59fa2d05-4d2b-4f08-a81c-6d22805b88d8", "value": "12288:N1TGoqqMj4uEU5w1RIfMiZ5d63fLGsjukmtrYFQ:N1TGoOjrwEfMiZGItcFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273322, "uuid": "d1203c8b-357a-42e1-8a6f-76eceab85bb5", "value": 491961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273322, "uuid": "9b1d2c9a-0da6-4ecd-b78e-e2a70270760e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273322, "uuid": "428ac55a-5f01-4f6e-a8bc-35f17a908748", "value": "5436714088737f2bb7964f21b363bca9ae058dd7d2ef54fbf1f3faa04aa70970.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d300677a-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273555, "uuid": "8b19d6d7-b854-4348-9bb3-a375945813e2", "comment": "Malware payload", "value": "e6cab76234bbd3200aa7721fc067baf3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273555, "uuid": "ee558cbf-3c84-4da8-86c8-c2ee4f841686", "comment": "Malware payload", "value": "54eae8427e9cff6783d86125cfc643d3d0d7bf58776eeb9597282360579e9b6e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273555, "uuid": "e5839c23-19a9-483b-9deb-10c74a02a343", "comment": "Malware payload", "value": "f0c4310fb532e8ff59f308a762e347030b3ae072", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273555, "uuid": "b987b95c-0149-4f24-bfdc-59c0fb35aeaf", "comment": "Malware payload", "value": "a4fc6d761d26352649e560b9532ab97d3822ae7e785c7d942cb9e131dc48fcee19ef578ef24d8a162e93faa260023d00", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273555, "uuid": "11cdbbdc-981f-4fd8-8280-2014da68dde6", "value": "T1165533C7813C2CC44F780AA76BEF855C62248EFC100218776F2645EB653F79F86B995A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273555, "uuid": "cea4b0b2-3a4e-4989-a53b-3dbd45f385a5", "value": "24576:dpjJAtooZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRI:d9GooZ9bq+MmMEL+hcjXHC/wnwdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273555, "uuid": "d00d68aa-730b-4357-92c3-f282410acd08", "value": 1381514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273555, "uuid": "96406db3-9373-48df-8931-b55462aaef1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273555, "uuid": "49558a5d-ead8-486a-9841-e74138a133ec", "value": "54eae8427e9cff6783d86125cfc643d3d0d7bf58776eeb9597282360579e9b6e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8d852d-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271187, "uuid": "f520c768-87b6-4caf-9846-397a743fc808", "comment": "Malware payload", "value": "1c5d13cf8a20859d9d48a4bb3c9b4d44", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271187, "uuid": "c9490f90-02eb-439b-aa84-266c26b130aa", "comment": "Malware payload", "value": "55ed9f69ff5b67f26607720877db6abf9d044a2917e60482b4ba99e8f9bc2c7b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271187, "uuid": "030c4840-5d12-4904-bf0b-b30b37b07ca8", "comment": "Malware payload", "value": "2082fd9ae03edf323918f04fe0da9e8cc7ec24c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271187, "uuid": "fcc0187e-42d5-4bb3-adb6-719e75ddc550", "comment": "Malware payload", "value": "2ec7ffd094ae4c8bbe35a10b107e5a02769eab1ac5d1147b95a19fbef3251c0fde215e5a6cc5415cdf9fe21599489773", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271187, "uuid": "d1a4c2bb-bb31-488d-a041-864ac9e94d72", "value": "T102C42304340641D5835A2B1EAEC4E7E0BEB560DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271187, "uuid": "9f6cd0eb-6aeb-4a43-aced-4fa752508d6b", "value": "12288:X6wlOMWROC/FTeHo22Qm7NzofOr68mJeA924EwCL:v4MQOC/gHozN7NzomW8vA98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271187, "uuid": "84efebe7-9764-4135-808f-c1d0c4346acf", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271187, "uuid": "0fb9e280-fa03-46f5-9a90-a5d7be96b1ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271187, "uuid": "4e119d2a-24df-43d5-93d0-c516e376d099", "value": "55ed9f69ff5b67f26607720877db6abf9d044a2917e60482b4ba99e8f9bc2c7b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8245fa-c146-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791264310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264310, "uuid": "f999725b-3ad1-45b6-9081-8e2ddded2aa2", "comment": "Malware payload", "value": "81c859e559ebdb756fd469b6140a5f8b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264310, "uuid": "d0e18489-45f8-444a-be4c-231e518957e9", "comment": "Malware payload", "value": "55f90e5edc574b5b39525859d07a4ff8ee14f8243948ae29ec93973087744a5a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264310, "uuid": "3331537b-d2a3-4215-b359-6694a0606eb1", "comment": "Malware payload", "value": "73f9b6902068f555d7b27b1b0e25d32643a20122", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264310, "uuid": "046349f1-8442-4c95-9553-ed886f359708", "comment": "Malware payload", "value": "e5706a5c305107cb5fa4f4843c27a4e3238382deb3195d8bde27acf6894ec965c89e2f47c495c61598575c8f8032a2ac", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264310, "uuid": "e9c8765b-c84e-441d-8852-c2160eb62209", "value": "T15E753303696CA813FC7342744B8DB3EA89C9B01A0D859A7F1D7597218D5FFC84E389B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264310, "uuid": "de87a0c9-bf45-4cec-b170-865bf4f42f46", "value": "49152:C5q+cSCl2yBnILTbD0cs4uFzdc0jr3lW5y:H+cgyBnILTbD0cJubcMZky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264310, "uuid": "ed0af07a-0ab0-479b-8e9d-f09f7e698562", "value": 1584705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264310, "uuid": "42702057-e60d-4c63-a97b-45ae13dff93c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264310, "uuid": "72ec4aef-0b41-490f-92c3-6cd554b2bcc6", "value": "55f90e5edc574b5b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11c6bef-c196-11f1-927a-4201ac107004", "comment": "Malware payload (JJMStealer)", "timestamp": 1791298945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298945, "uuid": "d6e36154-20be-4b04-b16a-816b28d32241", "comment": "Malware payload (JJMStealer)", "value": "33f25a90e23674dfbdae66a02f7ccce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JJMStealer", "colour": "#C5E618", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298945, "uuid": "53e0259a-2278-46f3-9bcb-ace94a67b93d", "comment": "Malware payload (JJMStealer)", "value": "5688131c6dbe9c8bfef086dd441a588dbf26902d30cdf06cc81518cc25f81f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JJMStealer", "colour": "#C5E618", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298945, "uuid": "08a2289c-e7a1-486c-996b-154ef5d7f710", "comment": "Malware payload (JJMStealer)", "value": "531c8529b26135d768a59d86d254df939ced4485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JJMStealer", "colour": "#C5E618", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298945, "uuid": "67e93dbf-1918-4750-b85e-1cdb85b967fb", "comment": "Malware payload (JJMStealer)", "value": "ebfa55511f74b879626b88393b2026056914762c35183f9213815cf76adf1658c186499303b97b8e9204eacb020cfa1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JJMStealer", "colour": "#C5E618", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298945, "uuid": "dde5f558-a87c-41a7-b684-94c0f17d6cc8", "value": "T120B64B43ECA541E4C0AED575C6669663BA713C898F3063D72B50F7283F76BD0AAB9700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298945, "uuid": "e1ea9f69-efc4-4b9f-9094-51614de7e3f0", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298945, "uuid": "11b1edab-115f-466b-b41d-a456d2025542", "value": "98304:CpvXk4RFh88inFbM+r+hOKZxgT4UAEMdqwuurqvfvgvZv3EANUzvPvIvTvfvDAdG:2hFWnFbMfbmBANUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298945, "uuid": "b13576a2-5891-427e-ad68-da2761731cd9", "value": 10939392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298945, "uuid": "9fb87d86-09f3-4727-ae19-e494eef5ed48", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298945, "uuid": "8df42d00-7239-4d8d-9c12-aad9727043d4", "value": "5688131c6dbe9c8bfef086dd441a588dbf26902d30cdf06cc81518cc25f81f6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afb20ed-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276440, "uuid": "ab41b432-fab8-4345-9219-8eeb8659c3b1", "comment": "Malware payload", "value": "fc9a44cb6da68b1d2706e2c230f1a700", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276440, "uuid": "c957563b-73a9-4aec-b3d4-fb9ce05cc1da", "comment": "Malware payload", "value": "56d4053d61fb621c547751d3e4740327563aa3036fb325d8e21a0db0956785f3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276440, "uuid": "a6dfe34e-7ed8-4a07-9248-294cbe93c6cd", "comment": "Malware payload", "value": "6543b6fd527dc8fac00bbf4244b3ee3d17ebbc81", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276440, "uuid": "c22ef495-bf1e-4346-a9d4-d15b36e50fd7", "comment": "Malware payload", "value": "608035abbc1d153e12f4823ec0049e49bac158fe66934b5e7507858ec8719c1f4e5db4caf506b63ed6e84ed6a6147d4f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276440, "uuid": "e32068e8-a556-47f1-97d5-83bcf777a3c7", "value": "T15AB4235A2EAD7BF7CD91A05411E132682C1A89D8CA77EB059C5842F20877B14FE5F28F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276440, "uuid": "9136091b-9c2a-41dd-a9b5-188db8f440d0", "value": "12288:Kyl/3BItd+3+DViRziobl9jcr91+rTY3rkC6uvq39jP6Fe952/mC5c:p1+td50RLbl2rKY3IC+JPF9YXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276440, "uuid": "9ab8fa5f-ec30-4880-9eb0-61f4b3a025a9", "value": 531063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276440, "uuid": "1aa08305-8436-41cc-8f90-edf7140957e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276440, "uuid": "051bc5e1-6172-40e3-8cca-5bbfeec60145", "value": "56d4053d61fb621c547751d3e4740327563aa3036fb325d8e21a0db0956785f3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f15c22-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275417, "uuid": "4c1b7493-5e2d-4bf4-9b77-27eb5a085e45", "comment": "Malware payload", "value": "c08cd2942c96d42812c112740fb408cf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275417, "uuid": "25ee7f55-ab36-4c51-8489-f987df7826e7", "comment": "Malware payload", "value": "5710d5b090b85a9e4f9b24f0f20b0c1f41bc0fc73e05b116921423ed8dfccb9d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275417, "uuid": "23194f0b-5ce6-4ce1-9ab6-9bb2225d29e6", "comment": "Malware payload", "value": "7932271314e685418d9fed27351c6c6919942353", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275417, "uuid": "4d16d81d-19bb-4ef9-a0cb-1f3d85f8c3d1", "comment": "Malware payload", "value": "04973d9484cadb6106c9c354e70c69e8cd9c8fe4142bfbd532d965a825a6bde80309c5fc3b4806326730064919589748", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275417, "uuid": "f4cd420e-6906-43be-b741-5b5c379148f2", "value": "T1D3A42397E39996EC8CC47ABA8B2C0D08B27CE7745CCF06A8537E5335D1688A39E0751D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275417, "uuid": "e53e4763-3321-43f0-ad02-4bfdb2797371", "value": "12288:msS5lyFd6C+6sVXkvgSe5yAqr++rVOje+yH5Y:msgxj6sSvP3y+6eTH5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275417, "uuid": "c046bded-7423-486c-a954-ec316168a6e1", "value": 492541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275417, "uuid": "381cbda9-975e-4b5b-9d77-0564509fd099", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275417, "uuid": "0b8c618e-b684-486a-aadd-2fe7e80a7b0d", "value": "5710d5b090b85a9e4f9b24f0f20b0c1f41bc0fc73e05b116921423ed8dfccb9d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbf9175-c14b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266457, "uuid": "845586b7-4ea5-420b-9542-3a8b8c51dff3", "comment": "Malware payload (Mirai)", "value": "5644ec072672fc87df85a226cefd0e52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266457, "uuid": "281b13f4-025e-488f-9084-9b8a3ff631bd", "comment": "Malware payload (Mirai)", "value": "574b611a85a59d8bae55c1ff3dd2652e87929822bd68a6f42e272379d141d777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266457, "uuid": "0cb6b21e-6986-4bdd-9577-d15dc28b26e0", "comment": "Malware payload (Mirai)", "value": "71f6125fdf86900f9345fb76174beda90ce9bd43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266457, "uuid": "5e8e9ace-3c3b-4909-89a1-5092c5db6499", "comment": "Malware payload (Mirai)", "value": "9131e8d7b41e3cc3301a2c4870daf6d87385d684b34acb00e22759f878e02b2b17a3dd7e3fee455bd1e8fd62173f116a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266457, "uuid": "faeb8275-0efa-4106-a2e5-09f78afba703", "value": "T19205A70A3E22DF7EF578873047F78634969936D62AE18585B19CD20C5F3028E591FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266457, "uuid": "9b0eb0ff-864b-40f4-86fc-b8916d5b4d17", "value": "6144:fAyFcEBJUxhS4kDqtuL30jka7GC4A/ZBI4/1BkXLSKVIyQQd3JfzEznPJxdTe21v:fwwD/pIBZ/Vsfolzl8ePCuqnLNb7iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266457, "uuid": "e1688b0e-e9f2-44eb-b947-d4185dfa047e", "value": 827328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266457, "uuid": "1dad2b09-fad1-42c5-9898-100aa6aa0a0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266457, "uuid": "ecbeb437-71ca-44f5-a398-eb380674686a", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9c2026-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270995, "uuid": "08a64890-3886-44fc-81e2-241ea093a5cc", "comment": "Malware payload", "value": "c7df7e956d47fadcfd213d4df4f8dbc9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270995, "uuid": "08abbc04-941e-4c97-9e91-cb0f989af09b", "comment": "Malware payload", "value": "577f8fd9b0683824ceabd42983962bbf96967b0272afcccd17b1aee870acb4d9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270995, "uuid": "5bef5c60-8811-47c8-bf98-229427a1688a", "comment": "Malware payload", "value": "2525f5db44f88ce3bf2b6f8e88497ce3c93b0d00", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270995, "uuid": "361c7041-08cd-4c2c-8efb-17f9e78db799", "comment": "Malware payload", "value": "e6f424d1ae5ea78fe2873286a080b4bfbd31a9c1de9d536a2f7c988ab2295aadedc178f13849db18f1407a3813245769", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270995, "uuid": "7a6cba89-19e5-4316-86ee-d9384ed981bf", "value": "T1D8C423792755F0C46206F2FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270995, "uuid": "982c1697-16a1-4789-981c-d9371d83be96", "value": "12288:+A7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpW4SFyorOIic/7MPp:xm6Jj6ESfUxZ91kmY/99z8VFXicTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270995, "uuid": "1d528bc4-7093-4c8c-aeb5-66ce0573da76", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270995, "uuid": "42fdb5e3-cd8b-4fc2-9e2a-4c62051876aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270995, "uuid": "0e3d5d84-23f6-410d-942b-3cb5b7d2916d", "value": "577f8fd9b0683824ceabd42983962bbf96967b0272afcccd17b1aee870acb4d9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8ca897-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274829, "uuid": "886fa430-8778-4f05-8b68-55ebd096cc62", "comment": "Malware payload", "value": "e364f2aa5c28e2ad9ef9d832787e6dd5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274829, "uuid": "2fae694d-0e1e-45d9-b17a-e78bfd3ea05a", "comment": "Malware payload", "value": "57cb8dfc003745d28c96f4b45bd3c3db6aad9e86c4cafe624597264bf0804ff4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274829, "uuid": "244a8d72-cb54-439f-8d6e-8386242df5a0", "comment": "Malware payload", "value": "c7120b75881f4194be1228d381bca73f4e304beb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274829, "uuid": "1eebfd63-b197-4669-b80d-c7f8b2f19477", "comment": "Malware payload", "value": "a440d1034d2523db0fbfaffbd7a662430c09b6fe65b1f478a93b58f8d75aff0db90b3eafd8673870d51ed46326d2fd21", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274829, "uuid": "c5af596a-8f28-43fc-b265-312ad26a301a", "value": "T100A4239C26D11A352CD7B294B9153F870770E71F37ECCAEBA60B39C46AADC30054664E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274829, "uuid": "878aca29-6de5-4e14-8de7-3de7b8808635", "value": "12288:gJAjNngJOPdzYfcEaN9B/Jm0LU0gM7aQT:g+VgQafclN9BhmSHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274829, "uuid": "0d73bc84-3515-43f3-9816-e10e1e900ff7", "value": 467513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274829, "uuid": "50bd9fcd-cc10-42d3-885c-da9e53566cf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274829, "uuid": "721bc7b1-623d-44e9-8420-75ef9cb67446", "value": "57cb8dfc003745d28c96f4b45bd3c3db6aad9e86c4cafe624597264bf0804ff4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c309497-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275422, "uuid": "fcd0651a-068b-4691-b9d8-ae55ee2bafdb", "comment": "Malware payload", "value": "9e0cc507ecb25be2d41acfdcd6a96ccf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275422, "uuid": "42db93f2-4470-49e7-bbf2-b1162f901f8e", "comment": "Malware payload", "value": "57ea3b0e2048f6318e14000083fb45eedb6b5c211b8b49c72e18906aeb08a632", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275422, "uuid": "4ee0446a-8178-4ede-8174-4a0e1ddcfdfd", "comment": "Malware payload", "value": "1f79fdfed564c54a8bbbf040a8b73e2a48fc88e8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275422, "uuid": "3d7f9bb0-4852-45bc-b209-c974d959557a", "comment": "Malware payload", "value": "f299e199ab6e0b2a9d1360ba1f1a80f3d9f04d2555afcea65e5e4ed1692ce3778570d29f3ab1740d30b5c9ca3338070f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275422, "uuid": "44521448-2c6f-4b2b-a378-7a0c6c08d67f", "value": "T17AA423B899A00A35EDA776640A6C9F050BA4D08376B84EF64B2F3ED04DFEC941D44ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275422, "uuid": "5f107191-0410-4d8d-a638-4b85beb17ecf", "value": "12288:amC6Z9RoERxZzYfcEaN9B/Jm0LU0gM7aQH:amC6Z9RdbGfclN9BhmSH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275422, "uuid": "e42204f7-a1cf-4b3b-8094-961c8dcb214f", "value": 467927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275422, "uuid": "1bf0f95a-5d16-4f98-9f2b-7d6d206b93a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275422, "uuid": "fb2878b4-ff91-4000-a222-7d15c7ca431a", "value": "57ea3b0e2048f6318e14000083fb45eedb6b5c211b8b49c72e18906aeb08a632.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ea3ff8-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274526, "uuid": "eadc1d35-27a7-4a88-a464-88249738e403", "comment": "Malware payload", "value": "a6625d1cdd7a12af0dd75b63b3ddf5d6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274526, "uuid": "ea952ccb-5ddd-4436-828d-ca5a2576e5e7", "comment": "Malware payload", "value": "580ec147ff99f129189a41e499f9c1d281dd8991f934327a152f1478238b2762", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274526, "uuid": "05b4c563-8e6f-409b-8c0c-076fcc510611", "comment": "Malware payload", "value": "ce044f717ea4b3b7a16ead42b59c03967d78070b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274526, "uuid": "15a94481-b674-4379-9fbc-cd20223b3cee", "comment": "Malware payload", "value": "fd758fa3af02c1ea273bc79d03f14e48117254469e2030042eddaaf476c5cc499d7eb3d43542b2607fd11ff2a55c82d5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274526, "uuid": "c97c590c-bf99-4f51-b62a-5a0e1b06794f", "value": "T113A4236D922554376D67B9C0AD5D2B020A70D18932DDDBD5CE0F38A08EFAC9C1FC61AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274526, "uuid": "da856ad8-f400-4f36-b08c-9bf784c8352b", "value": "12288:MW+GusvMa+kzYfcEaN9B/Jm0LU0gM7aQW:MWF/vMawfclN9BhmSHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274526, "uuid": "b82d93cf-a877-4a80-b893-931c5cd6b881", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274526, "uuid": "e4db3821-2842-4d76-9194-81aceccac716", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274526, "uuid": "c6bb09e4-77a2-4b8a-9ec1-5af2188b6b04", "value": "580ec147ff99f129189a41e499f9c1d281dd8991f934327a152f1478238b2762.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4c5d9f-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271237, "uuid": "6b750926-f3cc-4750-9116-2b1a673c6e48", "comment": "Malware payload", "value": "b7b0015cd05fc5c59b55f3bcd562d87d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271237, "uuid": "95232fe2-5ec4-456c-85fd-ae0c86348a1d", "comment": "Malware payload", "value": "5861dacb3c70636dcf8e67f82b12fd1e3c356c4f762509f535f4f85e0a26a2fd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271237, "uuid": "ae1d4ba8-fe89-4013-8d36-d5301034c6d3", "comment": "Malware payload", "value": "e5cd7c6cd84080c5d9adbc386dbcce466979cfd4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271237, "uuid": "23d1df8b-b9da-4caf-9a76-679724cc4aad", "comment": "Malware payload", "value": "3a389843aaeb7129946ef06e33d17542a6e51259c6103e6c66e2cf86e32d54fad7f52382194faf14fb6e72f576c29e4a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271237, "uuid": "066a36ca-2b55-4302-b5fb-8855b7e0dfd4", "value": "T1C8553397813C24845F3E0B66A7FF856CB2248EFC10030C579B2A49A7293E69FC675997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271237, "uuid": "edae5cd0-a55c-45bd-9392-0c6a119871d3", "value": "24576:zoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRnbA+KCmzWA:zoZ9bq+MmMEL+hcjXHC/wnwdnbA9CmzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271237, "uuid": "a9565bfc-0e9c-439c-83b7-e60d9a2b4f70", "value": 1395268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271237, "uuid": "3ea95ab0-e09c-4f15-a645-a886d8b7ad02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271237, "uuid": "b550e752-5951-4bcb-a49b-09e37debf7d6", "value": "5861dacb3c70636dcf8e67f82b12fd1e3c356c4f762509f535f4f85e0a26a2fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895c81a5-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303066, "uuid": "ef9cfe3a-0f42-42da-9960-af7fe335468d", "comment": "Malware payload (Mirai)", "value": "c3ac2721479332f40a9171e7feb793a6", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303066, "uuid": "d6f226b9-b5a6-470f-8c4a-97626adc6b48", "comment": "Malware payload (Mirai)", "value": "5877828782a60cb9d75609fb8241657c00f74df8d374b759acfcc752880755a3", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303066, "uuid": "a1a5f0e0-3d17-421b-92fd-fbf2aa52dfd9", "comment": "Malware payload (Mirai)", "value": "66100301c8e70105d6c3be1ba862fbcc0c8b23f0", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303066, "uuid": "ba25596e-9c9d-4403-b5bb-f2dafddf97c8", "comment": "Malware payload (Mirai)", "value": "12de5e5aa3e57f84d25fc8305d509677ff5ae32e2b8cdc13ca1adde49084b63458ee5be14c4234d4803851b880797dea", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303066, "uuid": "f89e91d2-6d6a-41f0-99d9-708c4a93fb2e", "value": "T1D9A302F1E3C3921ADE96267145FCCA1663A07A1B068934E0691507B9AF707B18C3BDFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303066, "uuid": "726ca63b-35c3-4abe-8034-537a765c656b", "value": "1536:3hXsVK2r880LvOmwhbAxWGmM2RREccGkJa8ssPB3GgGxNJtmW8J6HB7SVOnrZ6XW:RZahmUAHgCta8jvGWW8YHB7ScnVSPxBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303066, "uuid": "5eba55fd-b8fd-4f23-a165-799220944b65", "value": 103396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303066, "uuid": "d61b39e4-1107-4189-b1ce-9676d5e276d7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303066, "uuid": "15ad8077-4a42-40e2-8a3d-0a73e50a8b73", "value": "flutter.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484ff97c-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275040, "uuid": "10d9e781-2dd3-4e28-80fe-d24547802f04", "comment": "Malware payload", "value": "961c1b9cd9492e67a1ce564650e89763", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275040, "uuid": "cea8bb92-053c-4282-b9fe-cec5c83f1171", "comment": "Malware payload", "value": "58e09b2cff7156b072dcf9cccb04142286cf2b1be658477b05e2de2958468955", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275040, "uuid": "67c129d9-7862-46e9-ab30-9cdecaa2bf0a", "comment": "Malware payload", "value": "2def82429b924d533f3b1e42594238c255cc9521", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275040, "uuid": "6d7c43c5-7cef-42ce-94bc-c058db02d169", "comment": "Malware payload", "value": "29b14e00cea3495e5b86b55a7da2f0d92770838a4837a54d25fd79ad58accae8665752dbe6f0b899be1e1dc3c90d300b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275040, "uuid": "3c1545ba-a721-46b4-b259-574934246f9d", "value": "T107B423CD64BED0A87B658DDA9FDCBFD30CFC003A6D7526F2A51C1A13A1C404B64E958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275040, "uuid": "f456107c-5cc0-4bb6-bbdf-9207907c33f6", "value": "12288:FB/e4pqNFTFbEXkzDoGbDDGIabs/7iiEVwYg2l3/2Nyn:FBm4pgTJoGTabs/7iiWw0Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275040, "uuid": "54843fd2-7524-4ccd-bc64-287f25245a74", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275040, "uuid": "fe2eae73-0e47-424b-a8f1-48d562d3cb75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275040, "uuid": "62510dfb-0cb3-4d35-8dd8-15bc8b880827", "value": "58e09b2cff7156b072dcf9cccb04142286cf2b1be658477b05e2de2958468955.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a602b3-c143-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263312, "uuid": "d6ec9f32-7260-40d1-b00f-1e92bfe421b9", "comment": "Malware payload (Mirai)", "value": "40997165b9d4a65d4aa37ee0e0b782ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263312, "uuid": "ace9f7d4-16af-478c-9714-0e74914689c9", "comment": "Malware payload (Mirai)", "value": "591e135c571321fed659c2d5a763a4685333e2b1bccd35d19e51a1196878c01f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263312, "uuid": "c79c8511-a2e9-455e-a398-1cf4ccb921b7", "comment": "Malware payload (Mirai)", "value": "708e6977cf5429979fc61dc786dd0e94a40fe3ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263312, "uuid": "9de70d2d-78f0-4013-b04f-eb23bebea2fb", "comment": "Malware payload (Mirai)", "value": "a897304015cb4f35be210a600a7078bbd2ba18dc86d08284b055e0e7fce52e3d4301a6253d56413d2aff1d5a52d33e0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263312, "uuid": "1fa5be17-b222-4d5f-99ff-ca58eb30a7b2", "value": "T1B9F3F8CCE865476FC6D327BAF649528F33321B78938BF32159A7EAB41BC17481938191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263312, "uuid": "32508f90-7a38-4dbc-8bdd-0419f8b9fcb6", "value": "3072:GVIjgRsJGMPeuQ8oGM+AL1r9PDv1ZpYZsW1zmLmS44hzkj0ILngGMuDqc7wbEHKg:Z+bEHzqa4J+acdRmRrI+Wm+WusQ6zy5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263312, "uuid": "0d214425-ac08-469e-8d4c-4e560b12f9dd", "value": 164152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263312, "uuid": "6fcf90b9-f724-47f7-b580-8a4e67c2244b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263312, "uuid": "7c7718a4-53ad-4d9d-9c00-3e2b87008bc9", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685bacf3-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276382, "uuid": "96c09c3d-9259-401a-9ab4-1b6ec9ad8a01", "comment": "Malware payload", "value": "dfae29194a72477e715e29b61d7c05ae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276382, "uuid": "5d0efc03-06e1-4ac4-934c-93468b0f762a", "comment": "Malware payload", "value": "597b08e7bb15930f5f4ffaddac6a8138b9397d9a8b638a3a62ba2f7197f66378", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276382, "uuid": "5fe5834e-f0cb-4dd2-b8a9-d13eb2297ea3", "comment": "Malware payload", "value": "62656095a5a3e3020b9e40fdc38f3824d72c23db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276382, "uuid": "fac5e347-3583-4da0-86ef-134cb989f67c", "comment": "Malware payload", "value": "597dcbd6c28a93e710ca9241b308c8bc0fdc0f0fb1f896607034a4305b042e2c7b39872c62fb1c3a7115c06662f4d916", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276382, "uuid": "b3337937-58eb-4504-9534-e0071392fe27", "value": "T18BA42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276382, "uuid": "f0d0b3b7-19b6-4cf2-9364-9461cadb645d", "value": "12288:4SCDe0U+m1V6ECbniSPfS3e2R3feeintFck5TsuC8hH7:4De0wUTiSWzeeiBsP8d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276382, "uuid": "bb6f045c-ed05-4e82-8530-82d2c9fd1dc3", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276382, "uuid": "ca16d343-b34c-4ba5-8543-20c6f03bf59d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276382, "uuid": "1b626fcc-782d-45b0-a55c-5a261e400c43", "value": "597b08e7bb15930f5f4ffaddac6a8138b9397d9a8b638a3a62ba2f7197f66378.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e692414-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273252, "uuid": "7414b15b-71b6-44bf-a443-24fd8b162724", "comment": "Malware payload", "value": "81b276b4f067c6be70074c60a6523ebf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273252, "uuid": "028b197b-4ead-4ec5-a866-9f9240fc4eda", "comment": "Malware payload", "value": "59d5d308ef30f19793399b0db342a76bc12236b1b6b8e68d6461e260935a91e6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273252, "uuid": "84631f0a-a396-4d27-b31d-fe046d215937", "comment": "Malware payload", "value": "2f4356e43bd624aaf5d8864da9f42d2e5cfc5f48", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273252, "uuid": "96baba65-2ac0-463d-927c-dcfec3c1824f", "comment": "Malware payload", "value": "65c9a700e7a6cd164a06522908cb403319525a3b49ac51936cbd0ea7ebedf1ea779ed5a8982fc1f20ba98b3862b9a278", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273252, "uuid": "6fc9c889-7c98-4f67-b2bf-854231e3504e", "value": "T19BB4231AF4D078CFD68ACDA394292C785F6C96C9CD126B7247C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273252, "uuid": "2407a000-bef9-4931-baa7-fbe2dc09f976", "value": "12288:NTibgSMFBOBSlqrQKu7FxPbzJTVBU+8JM9hAC8Z3TVOBRkbKQDiUbpKW:0cSMFY2KkxpTKJM9mCw3TVOMWAPbpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273252, "uuid": "0a3c3dd5-09fa-4727-9c1a-7cdd61b5bf10", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273252, "uuid": "f1a2265a-b8b7-4179-b90a-01f4a7b8d2ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273252, "uuid": "314ec5a0-8e33-40ef-909f-b3d23af865d1", "value": "59d5d308ef30f19793399b0db342a76bc12236b1b6b8e68d6461e260935a91e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad75ab0-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276064, "uuid": "26f50924-80a1-4708-943b-2285b8922c39", "comment": "Malware payload", "value": "9c02df2046f03d0bd957c621b0911fb1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276064, "uuid": "d9a64455-af9e-47eb-a7d4-7d32603a92a7", "comment": "Malware payload", "value": "59f0504df2b612435403f6cb5e90e79c0e2c12a9e5444d7ff46cdaa7dc2ae51d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276064, "uuid": "67b09081-a89e-4d11-a535-338a734992a8", "comment": "Malware payload", "value": "67ba799fcb288842d8b1b31780b329bc29f75356", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276064, "uuid": "37f947b6-f2e1-4214-a7f6-f39db7531423", "comment": "Malware payload", "value": "64cc41d5fc193cdee2931431dba71b4b6ff33a10b5d7005c2e2c8200cc9beeb0d3c3cf193614e306cd68c5099e6a0abb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276064, "uuid": "421ab917-2a6e-4b8a-9eb1-b552c1df2d6c", "value": "T12AA4238274716D0AC096CFBDD4C1AACAD06A023D35663BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276064, "uuid": "85e24f1e-44b6-4f64-99af-703a003d5deb", "value": "12288:or06tUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZV:or06tUv4t1cNk/wjibhv4b2Onn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276064, "uuid": "0c0ce92a-36ec-494c-b04d-46f81aea79ee", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276064, "uuid": "650ed969-66fe-403b-b482-22aff06bfd8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276064, "uuid": "60101ffa-2ba7-4a73-818a-6822d53a5a00", "value": "59f0504df2b612435403f6cb5e90e79c0e2c12a9e5444d7ff46cdaa7dc2ae51d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33904ddc-c1a5-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791305070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305070, "uuid": "8d77254d-ad3a-48d6-bbcd-ef8b59e5f1e2", "comment": "Malware payload", "value": "22e2c4a7b5b4bbcf6f777d9edfdd8ee4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305070, "uuid": "475e2ec4-389e-45db-b6ba-6c1441530920", "comment": "Malware payload", "value": "5a15602695f7ad57725792d8714fa2305748b49f2b7a460849842d122b926249", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305070, "uuid": "1b17c102-31c8-4af3-aecf-5b189c7e3e39", "comment": "Malware payload", "value": "378421c0d5f30c874ae1566ffdfec6009155e530", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305070, "uuid": "8c755bcd-af1b-4401-a3f2-0a88ab604c65", "comment": "Malware payload", "value": "2baaf22f93a40442c3b2683747f71b10fcba4bfacc1980a3de14dc4d6060cd436a8a79e700e2d13904a66b67012e0841", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305070, "uuid": "9f88cc6c-f434-497a-adcb-a19681540b92", "value": "T1A2C2F10819DEEE52C2EF41737107C60310149CA895934B679E189F21B6E1DFA3DEE35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305070, "uuid": "fa169e92-3121-4e77-b9da-3df1e3fe163a", "value": "768:pwZEprJVyxxR0cVOPQ3x6P14J7xJVll9Fs:VJVWgEOCcP14JdJvl9Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791305070, "uuid": "e79ca371-36c7-49f5-be0c-c37570bb4a94", "value": 27777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791305070, "uuid": "30c3decb-6cf4-4653-b282-00f510f0cff9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305070, "uuid": "b71de73c-2c02-490b-bec1-a380b50a5017", "value": "Mina.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faef7f5a-c196-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791298962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298962, "uuid": "a000876a-6177-4834-84b2-1e50b366538f", "comment": "Malware payload", "value": "b00d76530c99525abe31236416af7874", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298962, "uuid": "b1c3fe77-2f94-4cd7-8105-24fa01aa853b", "comment": "Malware payload", "value": "5a1ceb94ecbcd88129a8761d89e9731c32a6a20bc5bfd32a28089fed19fa8aae", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298962, "uuid": "5c21fc1d-88db-4159-8277-6776602d5d78", "comment": "Malware payload", "value": "3f58f9d69a587b6fa23e49aa153916ec87c26e93", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298962, "uuid": "005e33f2-972f-4bcb-ae71-f3e413152f58", "comment": "Malware payload", "value": "45fc524ba5f5f30d22311f7a90bccc6c7933bcc23ee0ae4b8b90abddcbbddf2749d6fc2ecb2a3691aef4ced801db1051", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298962, "uuid": "6799a66d-fa07-4a06-8165-d17b1114dcf7", "value": "T1FE8633853D6CC9B7C94663BFD850C4AA3D3521A2F203B12E5E624FA7AE15FE41B49348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298962, "uuid": "987bbab2-d3dc-4fb4-9c06-f86174df6325", "value": "196608:s4MT/3KXBrf1YH/Kfw71vbdl/8CyDFZOufIXosQR6BS39:sZzKB6HCf8//uDTOuf6jS39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298962, "uuid": "eb171a05-d6ab-4f84-b520-8ded10d2b9c2", "value": 8449887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298962, "uuid": "1afbcea8-fee9-47ac-8340-15ad21009065", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298962, "uuid": "ecfcf1c1-1a35-445d-b3d4-a55589699267", "value": "1.21.11BandsClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffc327d-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274758, "uuid": "d2629c84-44e8-4a0d-959c-d5bf9aba2616", "comment": "Malware payload", "value": "55d470793bc9c166263a299b2e2fe9dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274758, "uuid": "10ca7cf5-2bb9-4cdc-bf5a-bf2a548a597e", "comment": "Malware payload", "value": "5a2882fdd5a13f03a6e4515587b75f5004db8bf0e7b5c631d745f4a73766bec2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274758, "uuid": "2e047d35-6fa4-41af-8960-9b06e4a51ea5", "comment": "Malware payload", "value": "dac9c3be37870ca5da21ffcdca4e1b8bcccb75c0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274758, "uuid": "73576560-21c9-4580-9507-8983af074e1a", "comment": "Malware payload", "value": "ee7930bd772a6c1ef209316d0781ed0229d989dd1e0d68ee5609058ae07e81b72b9806c5ee748f1b9db0cee2569a1004", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274758, "uuid": "ddfe79d1-a350-4379-9f7b-0c6d71fc9f7f", "value": "T1C055338AC17C1CC49F3E0A9779FF555CA2248EFC200208636B2A59A7253E74FC7B595A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274758, "uuid": "84bc301a-66f7-4e34-ae0f-9e597d4bb54d", "value": "24576:OPTJsZg55zoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR/:ObJZ5zoZ9bq+MmMEL+hcjXHC/wnwd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274758, "uuid": "0cf00897-33c2-42f8-9bb4-74e749a21745", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274758, "uuid": "833a9921-a355-43b6-aab2-a4c1247681a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274758, "uuid": "155a6006-046c-4e2f-8837-d802e1b8b65d", "value": "5a2882fdd5a13f03a6e4515587b75f5004db8bf0e7b5c631d745f4a73766bec2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f925a944-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275766, "uuid": "9c029099-709a-43ed-97d2-bf483a336a98", "comment": "Malware payload", "value": "2fb32b91548b5b02b87f97ace761cfbb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275766, "uuid": "8cd55963-98b6-43c5-bc9a-bb9a3f9c84fa", "comment": "Malware payload", "value": "5a440fd25793899e3b0f4615bd75ff842dd8e9f65e69ac51bc621e464502fa6a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275766, "uuid": "8fa3dda5-976c-4345-98dc-ef0a9e0e3d41", "comment": "Malware payload", "value": "7278ef5c4dcf0750592a8e2d74a8b7939637a9b5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275766, "uuid": "272e11ef-76cb-4186-9789-d5b316bb8b22", "comment": "Malware payload", "value": "ef1cf874f4238e9a58cd55472e111e9ddac4ab1afa34fb85435a795c611bc333aadd856efc32280c581e70194ca0df52", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275766, "uuid": "3aaf8da9-3a29-4cc5-a718-3658fae937cd", "value": "T1DDA4239581B983533484E3B5497B1AEA5F301CF28D3D674F88DAC5F81B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275766, "uuid": "1fc1a5e5-8cca-4c7e-ae3d-44fa8806f49f", "value": "12288:rcWSCDe0U+m1V6ECbniSPfS3e2R3feeintFckp:hDe0wUTiSWzeeip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275766, "uuid": "a386123e-329f-4ee7-a811-f3f7a79f2c5a", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275766, "uuid": "67a29c68-e199-4ea9-8a66-c8b3cb62a017", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275766, "uuid": "cc77278b-0521-45eb-be5a-6379c22b836f", "value": "5a440fd25793899e3b0f4615bd75ff842dd8e9f65e69ac51bc621e464502fa6a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc213e90-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275771, "uuid": "c189d045-b0b9-44e7-808b-8eeef5e67f06", "comment": "Malware payload", "value": "e833b109c08f3ee3190d264b5458dc09", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275771, "uuid": "621d6f25-92c0-4ed2-b7ec-78f49de649b7", "comment": "Malware payload", "value": "5afa4a7bc2a99ba85324fc4d96258536e8a9fb6e5e108bf3d91539cb5b82a6fd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275771, "uuid": "950a6587-43b6-4a88-b5f5-71cab8d51147", "comment": "Malware payload", "value": "bb9dd56f63cb026e9403dec985545bc0388c6065", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275771, "uuid": "41e4c2c0-42c8-48d0-99ee-1e69f3561eff", "comment": "Malware payload", "value": "1ff57a271b990fce3101ce34d40cb954fdbf71b48b5c2f51ab8f748b2912d738afff2d86245f4ab31e10987f6e4e68bb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275771, "uuid": "2260f58c-a933-4d73-bae1-9691fec83893", "value": "T1ABC423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275771, "uuid": "a1be8e3f-018c-4c99-9a3a-1efd2fb9ffcc", "value": "12288:oA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWlSFyorOIic/7MPw:zm6Jj6ESfUxZ91kmY/99z8UFXicTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275771, "uuid": "5aa7a5f5-b89c-4df9-9509-004f99c22e57", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275771, "uuid": "84a98817-b8c0-411b-a470-ef683c06f5d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275771, "uuid": "8e63c038-89c5-4ae2-9577-4c80a2e63f85", "value": "5afa4a7bc2a99ba85324fc4d96258536e8a9fb6e5e108bf3d91539cb5b82a6fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ca63a3-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275573, "uuid": "8bb46278-2f08-4a4c-a664-3a0b7d4226b3", "comment": "Malware payload", "value": "da9d7973f1ba30d29bd02e3dff5e67c3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275573, "uuid": "5b4e1131-8e83-4b6c-92c0-14408c2e7141", "comment": "Malware payload", "value": "5c1e7f1b3ddcc237ff1906337a6ae73f5ce04d6d974e96218b6fd8cd380ea160", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275573, "uuid": "6cdd2465-bf2d-4599-8463-5d7b53dbbe0e", "comment": "Malware payload", "value": "ea4c2e30a245e433f43d220923fdc1ae80dcd99f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275573, "uuid": "d1abb5f8-5b93-4d7e-84f2-60ccc8084869", "comment": "Malware payload", "value": "7bc2551af6f9cabfc938d60c1cd7105d45ecc5ba4b404a70f36625192987eba4bdd96adaf5e155e63cceb493adec621e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275573, "uuid": "ea3faaf4-3887-4633-ac91-6af1f5f1ddc2", "value": "T1DEA4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275573, "uuid": "a2b6e022-16ab-4628-b166-3aa14c3c860a", "value": "12288:Qr066Uv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZw:Qr066Uv4t1cNk/wjibhv4b2OnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275573, "uuid": "1219cc37-d72d-4f97-b30e-954bcb3dc51a", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275573, "uuid": "18da71cb-2d97-492c-9043-15e331fd5129", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275573, "uuid": "a06a0d31-12c6-4d26-bdf5-2cc44d23f4c5", "value": "5c1e7f1b3ddcc237ff1906337a6ae73f5ce04d6d974e96218b6fd8cd380ea160.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a7b4bf-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303090, "uuid": "81721b51-0088-45a8-b382-bb8bb6248443", "comment": "Malware payload (Mirai)", "value": "64c1a433db1203c585d582faa0b0e0dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303090, "uuid": "d5fda0bb-1625-4b2c-9ad9-a26c7942799c", "comment": "Malware payload (Mirai)", "value": "5c3b7bc52f43afdd7f0e2232f1695e867b71d58a91842654d376c2474521fdf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303090, "uuid": "ac0de677-3dd5-4a12-965b-0ad139b03990", "comment": "Malware payload (Mirai)", "value": "d0bd10b0f807f1f2bd9c0a4012ddb1951003ffe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303090, "uuid": "12431461-8386-472f-88ed-023be722113d", "comment": "Malware payload (Mirai)", "value": "7aa7a7a5b790cb6ffa2d61ab12ed2be34bcca872ef749b85971caf8af4c15174ee5dd80f8b7f811ce69741d27f35caf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303090, "uuid": "68b631d2-b847-4029-8947-917d43f61f91", "value": "T1B6F32A46F880DE66C6D1267AFA9D019C331317B8D3DAB002DD20AF2937EB55E0B7E546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303090, "uuid": "97036d85-84a8-49de-8c2c-ee66f008d6a0", "value": "3072:AzxP9VRsduC2HXCOY5EmXeUjjU+k5t9zg8uY4/4HIQMIwPg5TfdwerjzI+vv6:Az+EmXljo+k5n0YxIQMIwPg5Tfyoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303090, "uuid": "54506821-99c2-4118-ac23-8fb8d061b292", "value": 165204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303090, "uuid": "3d3d38dc-1e9d-42eb-82e0-d008829df74e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303090, "uuid": "a7d21804-59a4-4bec-b374-8467a7d16841", "value": "flutter.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0e6ed6-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263668, "uuid": "171eab70-67e9-451e-ac04-c705b25d4db1", "comment": "Malware payload (Mirai)", "value": "17fac60da43d2da1f1d1cabc770df771", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263668, "uuid": "78930d3b-d17f-410f-87dc-093fddc3fe3f", "comment": "Malware payload (Mirai)", "value": "5ce670cc00b899f305fa548f2f8b369935b85393c83d2ecabb3de90b74cfb7e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263668, "uuid": "2e81d2af-5123-4754-93c5-27dd2f3e3e0f", "comment": "Malware payload (Mirai)", "value": "3ab2cdd16d8e2325da79328456946d7c7d0d122a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263668, "uuid": "477cff78-25cf-41e3-802d-2fe019344a6c", "comment": "Malware payload (Mirai)", "value": "563066ce2269209865605544aa96ccc14f78c248a9599656e326dcfb37f5128af9977f5740e2ad1a28a3c4feb4782439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263668, "uuid": "85903569-8cd8-4c66-a162-32e87bde86a7", "value": "T19AB47C02FB92CDB2D46200F112179F615A71EC361437E597E3E63DB8DA206D19B1A3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263668, "uuid": "bb277f34-73d1-44c9-9b9a-65cc67c7c3d4", "value": "6144:4oa0SHWXrF2WRH7Ldtx5LkdRmkSXmtPRvu3JdltEqcordREr6+h89FTyHS35N:4QkWXB2WHtx5LkdAn3ogdRXvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263668, "uuid": "4e0b845c-2f1d-4e63-8356-cd6a198ba236", "value": 504656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263668, "uuid": "652a35c1-3379-4d2b-b73a-6dd4558c322f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263668, "uuid": "7a722a65-3eed-47f2-8c24-5f39423ff728", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0fe328-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276306, "uuid": "76f40051-af9d-4b3d-8371-be3f17fb80fb", "comment": "Malware payload", "value": "8daf01e8d673efb5e12f626272a852f9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276306, "uuid": "6727aea7-e854-4aed-80ed-2502f281c1b5", "comment": "Malware payload", "value": "5d2ce084d2c769f648433147faac2d7c75b956897a79f29cef0c3e2cbd6e792f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276306, "uuid": "35abec47-3627-47ae-a120-b518542db3fd", "comment": "Malware payload", "value": "e89c4313a18bf1fe7e088051fdafe2518fdc6d63", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276306, "uuid": "45607f5a-2379-43fd-bb34-82e01d3a9148", "comment": "Malware payload", "value": "e6846245e0489dde9c2f7dd1b3a443b15f3b9878e1f0c42e4d92f1b81fd53edaf1b10f3337d35ed5e832ead83ff96427", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276306, "uuid": "f9860743-70d4-4860-9a7f-3212f261d6a6", "value": "T14BC423443901C1DD874A6F3E9DD44EB46E7D80E79A5A790027CEBE827C85AB033C9D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276306, "uuid": "dc2ad2e2-eadb-438c-b7b9-0202c287f2fd", "value": "12288:9qwEDcCCXE6wlOMWROC/FTeHo22Qm7NzofOr/mShg:qgCC44MQOC/gHozN7NzomLmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276306, "uuid": "6f8e5fec-6600-482a-bd96-07554b85d9a5", "value": 578949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276306, "uuid": "791f277b-9380-4012-86f0-7b6e0dc6a49e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276306, "uuid": "c85331a9-1bb1-4446-8d73-c5eb9098aabd", "value": "5d2ce084d2c769f648433147faac2d7c75b956897a79f29cef0c3e2cbd6e792f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d206e47-c152-11f1-927a-4201ac107004", "comment": "Malware payload (IRATA)", "timestamp": 1791269411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269411, "uuid": "fb8191b4-49d9-4759-a4f7-a9cde4d4f979", "comment": "Malware payload (IRATA)", "value": "9c9b4a57ca58ef385da58d19e8dcafed", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269411, "uuid": "71e622ba-a629-4641-bf08-466d616a4c7f", "comment": "Malware payload (IRATA)", "value": "5d5c21fbab62ec156c8e3897caf31a0dfb1a2bf2e1198a9e9b8ecdea87089a19", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269411, "uuid": "3dcac57d-4108-4da2-8897-20ee040a14ff", "comment": "Malware payload (IRATA)", "value": "674a49653fe759f9703837c2b43d6263d313c29b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269411, "uuid": "c9285ca7-152a-43cf-962c-4fa4e121ea9d", "comment": "Malware payload (IRATA)", "value": "b74ce938938cb52c64016d9996cb03c868cf9e91a511dc34f67d5dec9f974748272fa89eff8ec67c526f20047022bf2a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269411, "uuid": "2d36d816-8010-424c-b8de-6a468dcc84d2", "value": "T1DE863302FB935DA6C4F2C33114A64B24623B0F26D34BB78B177476F928BFAD84B46585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269411, "uuid": "e9af5d37-f741-48e0-b474-1e8d674f4d0c", "value": "196608:w11rgeqVG7lTG4duAkMN4624kksf21quAqSh9ew20c1tGbkIfi:igeqVoY4dBkMixeckown8Bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269411, "uuid": "88d24377-3403-40cd-8544-a636f52be3c4", "value": 8152724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269411, "uuid": "db19ebee-aafe-4130-95f2-3234378079a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269411, "uuid": "b85c47aa-efe0-4c5d-87d3-389af3cd9093", "value": "edli04site.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0721ec77-c12d-11f1-927a-4201ac107004", "comment": "Malware payload (Phorpiex)", "timestamp": 1791253456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253456, "uuid": "95e470e3-2c4c-42e1-b9e5-9d7fdd23450f", "comment": "Malware payload (Phorpiex)", "value": "149428fbb8622cd08b18f008e24d54c6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253456, "uuid": "cb359284-505f-480e-b693-acd94ba8652b", "comment": "Malware payload (Phorpiex)", "value": "5d7d506f8c627c54dcb0b3c18e8549dfa2af4f468e0c418f9f2819e8ee22adf4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253456, "uuid": "d4d18afa-1faa-468d-a040-5809c37d0a31", "comment": "Malware payload (Phorpiex)", "value": "ae420f37026691b85f82fa69c645bb3466c547ff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253456, "uuid": "7a38e6f1-afea-46a5-a5ed-4690ef41ece0", "comment": "Malware payload (Phorpiex)", "value": "210d3477aa1745f83d335eb3af784f1ede0237a3233482622726b454aac0153c239d16aad622e6c40eede7942d159a21", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253456, "uuid": "ede577b2-5d76-4a84-9971-a48c9fd67ca9", "value": "T132F1F80EAD834071C3E849F417B6459D9BBD052327D230FFB7F3D56A0F9129464926BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253456, "uuid": "dc8add37-b9ff-4848-bef9-4d7a00273cf8", "value": "847c11307b6be304e95668df66a5c296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253456, "uuid": "d43663c2-2031-4765-a547-d4f9adb0df5e", "value": "96:rqguFtzBGrdnD3d97+4CA+eQ6WOeBQGFJxGEX2FFhXC7tCEt:OgOtzBGbN+4h/s/BFJxTXmFh8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791253456, "uuid": "31e9e49a-19d9-4fbb-a7c6-21b57d9783f1", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791253456, "uuid": "e9a971d9-b618-4dce-a923-5e613811b93a", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253456, "uuid": "8d969d2a-4397-4173-8790-708f9c4cdeca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f81c2f-c19c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301255, "uuid": "c4d43eb5-60fe-4273-b942-e9cd57f346cf", "comment": "Malware payload", "value": "a5c5b9459c795cc1d03c39b598961421", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301255, "uuid": "9eed76bd-4baf-4156-b741-80f9e45b9471", "comment": "Malware payload", "value": "5e0c452af04409dfdce480e8b66126426d16cd5f8d166485b581ef0d05e28c3e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301255, "uuid": "97a132d1-a075-4c77-a7b0-fbace21773f8", "comment": "Malware payload", "value": "65d1a281b667922469e8c096333b93d847c058d1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301255, "uuid": "49d29958-f8a1-465a-9b24-52c1d103549e", "comment": "Malware payload", "value": "3834d1be553ef13f6d395cb40d71da0cd350e1a5b916f464728629d077787d2d6b59cda55ea6d76d39ff452a7c184062", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301255, "uuid": "73a91e5d-0a0d-4061-991e-e94d27768489", "value": "T17EE63301F96D51B3E137187788120ED1B97933CA859E782D32353ED7A0CAA931786EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301255, "uuid": "c914aaf9-6233-4eed-a9a2-ae0e481432b0", "value": "196608:LZsQJ6X/jRm7n1Sy5k9xikoGGXw7+4DNV/bPlar/vCaDKstCCMBrUhtCkLfZfsQr:LZt6X8j1SJ8zGi4DNRPla7mMpPsQbk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301255, "uuid": "7fe8fa8e-1af3-468b-a8b6-7e938e4bc2d2", "value": 15243752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301255, "uuid": "1bcf42f5-b1c9-4981-a0a1-881735588e6e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301255, "uuid": "cca634c1-1771-41de-95a1-30d952d0eeef", "value": "selene-1.0cracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b334c76-c1a6-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791305646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305646, "uuid": "9e42655f-9287-4f6f-94f7-4116b12b4511", "comment": "Malware payload (Mirai)", "value": "aafd2f2d7a18e32d5598c664ce5b5c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305646, "uuid": "34612be9-185f-4b3b-87c8-b9f573bd5a46", "comment": "Malware payload (Mirai)", "value": "5e2453297f38a5965bd9cbb86eeebf81001044e842a65c7ff3fcdbeefc565a19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305646, "uuid": "0fef45c4-a506-41a0-97e2-5e24978a8480", "comment": "Malware payload (Mirai)", "value": "d080cabb159301b9e1eaa88a5025f6300d861b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305646, "uuid": "a7fc24f3-5440-4b66-8ab3-cba326dc0d40", "comment": "Malware payload (Mirai)", "value": "506479e77e8992dc1eda14a0c7ba5058c4d2e504d1a0f24cd0bf42bd78c7d8a74de3abc2720f614e3a78d78254a9f036", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305646, "uuid": "a73f04e2-a159-4a20-878a-ee116ea65eaa", "value": "T11FD2D17EE5B481C5FD8E0C7E849C3FA24E59A581220BDB9563218C896732C5BF17F4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305646, "uuid": "bba63a9f-f7a7-4f4c-b489-ffaf881a71a7", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjItXwVJVuFRWGVCz0Y:jMYHb62x4ahQ3CfdwLjjtXw9gWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791305646, "uuid": "3f611998-184c-4353-a716-0811516bdff8", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791305646, "uuid": "0888a1e6-d025-4580-b972-5c4b9c1532f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305646, "uuid": "5e79b21a-f52b-4b21-8467-b14459a38ddc", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b43206a-c163-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276763, "uuid": "975618ca-e11c-4d0f-8a20-2af1bceabf3a", "comment": "Malware payload", "value": "0ce2d80be065a036466db67c0ee54c89", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276763, "uuid": "8a104409-55dc-48b5-af0a-ca1a2a96181c", "comment": "Malware payload", "value": "5e41fe8cafb43326462001f4af5bcfd1f15226d5988d9a0617fe24918d4a8600", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276763, "uuid": "51edc89b-cc18-4626-b1b6-1969d10af773", "comment": "Malware payload", "value": "0da715634edebe18ecf426de3ac6ae8df6600329", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276763, "uuid": "d16b5e58-95cd-485e-a3f3-51050232994a", "comment": "Malware payload", "value": "40fa5e2b9d598ac33d8a4e8428b4a82abeb6259cd99beaeef7cc2ddfa15d00dc7515fa51109038e30f2323dec11f6e86", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276763, "uuid": "ae438597-326c-47b4-a0a6-488939f1c526", "value": "T13C821910AD47292505432C7AC44C95F894F902FA51327865FBE8F92D9C30B7C9EBE94E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276763, "uuid": "f81c9370-6cf3-4d6d-a335-fa06814fe018", "value": "384:7EL4XMB7LqW5TT8O0eeBLLGj9RmjldNFTydJXC9:7OBZ7/96V8RC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276763, "uuid": "bb57371c-e3f4-4b34-8116-c973a3ac3baf", "value": 18884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276763, "uuid": "2c0a0e10-ee89-4dd9-9d40-3fc67c991eb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276763, "uuid": "f5a2068c-828e-4c0f-9982-c602d6501c3b", "value": "Schwedt_Newcastle_0510267.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16004443-c1cb-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791321341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791321341, "uuid": "8248de75-2338-47ab-9c15-360b062bdad2", "comment": "Malware payload", "value": "d77b96fe72bfd13d513ab559cba4b308", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791321341, "uuid": "fde73d06-994b-45d7-bb1b-3f17ae5e28c7", "comment": "Malware payload", "value": "5ec4c1ecaf67ba48a7f6ccebc065e587e7629654e455b15f67894240e63ac704", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791321341, "uuid": "1a61a418-150c-4de2-9bd6-a5f32af725fa", "comment": "Malware payload", "value": "d3fd6ee9651ff08f2cd0a945365bd5b984f7cb54", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791321341, "uuid": "b0d0ffdc-7b29-4baf-ac04-1d08da16bfc8", "comment": "Malware payload", "value": "4c625fa8470148e05ea496262295ea4233704018e4e67d0d9a7ccf06280de8130ec981244c31d47c061e2541b6225c5d", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791321341, "uuid": "4be9dbb3-a6eb-48e8-b705-189bcf2a158a", "value": "T12936334972A891FCD0050A7884B78E57B3F37C5A67FA4B0F4B80866B0D53B46EFA4742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791321341, "uuid": "07c8d129-f817-4b1f-8e09-1635cd7112de", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791321341, "uuid": "5b2b440b-2d54-4fcf-983a-60c34b357339", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvK3R8yAVp2H:DI8qPe1Cxcxk3ZAEoR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791321341, "uuid": "f6ee592d-8806-4c71-856b-f67abb009247", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791321341, "uuid": "4473a198-b4f3-4efb-9c3d-2077d0911550", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791321341, "uuid": "536eb601-4f32-4e7b-8aa0-232523d85e96", "value": "5ec4c1ecaf67ba48a7f6ccebc065e587e7629654e455b15f67894240e63ac704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4243de58-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270735, "uuid": "64da6135-7367-4dde-a7c9-2dcbc537d8a9", "comment": "Malware payload", "value": "399759587c94c217ea5d8aaedacb2e33", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270735, "uuid": "b2be6af3-a5fd-4776-9cdf-95e0ef82c760", "comment": "Malware payload", "value": "5f3058c988fc2870dbff821e623b21c9a7eb4f1e7cd164e7b4a38840962ef91a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270735, "uuid": "37599b4a-7440-471f-a57a-d66465d5e2f2", "comment": "Malware payload", "value": "a3c719b0a5913f0c481fb7f5d3d2978f3eb66d8d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270735, "uuid": "2833623a-9959-49d6-88e3-45623c424b86", "comment": "Malware payload", "value": "1c2c1a4f496a07824efc35f8aef79c1c842cfdde3c0a2741a793b4a1eb20463e0d42ac97221fc68638a7df16b51f183e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270735, "uuid": "89219d7e-3131-4ac6-a6b7-463a0e597a9d", "value": "T171C4236D7018EB38E507A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270735, "uuid": "b7ccc390-9844-4a06-a952-7cf23815eaef", "value": "12288:JMU+0xq75aS9iYIp6cP/G2Bku8YtNvC28c5/VTUPkYyN:N+J71vI/G+Yc5/pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270735, "uuid": "e1133875-2e4f-443d-8b12-be9c811c0ae1", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270735, "uuid": "779bfaab-6a02-4d1b-ae12-147b165f50f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270735, "uuid": "10b8decb-c5a8-44a5-9c94-5bdb039ce929", "value": "5f3058c988fc2870dbff821e623b21c9a7eb4f1e7cd164e7b4a38840962ef91a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c31c27-c131-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791255547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791255547, "uuid": "8515dca5-8bfb-4068-bb05-c6b7dd60d5b5", "comment": "Malware payload (Mirai)", "value": "f8d1bb6ef835ce29141def4038a8ae3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791255547, "uuid": "7c08fc2c-e2b2-46c6-8765-dc31a0036805", "comment": "Malware payload (Mirai)", "value": "5fb4ee97ca0fe63cc8930f1f26499b10fbe77cb8b20389813f62c6dc38964a96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791255547, "uuid": "a36f3b88-aed4-4e80-b891-444b5c635b50", "comment": "Malware payload (Mirai)", "value": "8dd7138f5fbc9de89039982d7096223e6f83fa05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791255547, "uuid": "a4136858-c965-4a08-8e08-e973bfac91ac", "comment": "Malware payload (Mirai)", "value": "a2af06aa27f06ef98fcb802b3507aea2dfbb699b74c73c0735e8d9e213ea28aeec22e0acdae6412ad59f9972e817ec6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791255547, "uuid": "ac1dd8b1-d330-4438-82a7-635b08f7c881", "value": "T12D333BC5A743DEF1ED1207B53077EB338B76E47A206AF9C7E3D5A527A841A01920329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791255547, "uuid": "3e714ac3-5c20-4868-b860-1ffe243d6600", "value": "1536:u8OP6OftfvJfrJf0hJeVVMlrZ778tjGIxhBYcPnYvPGGgvSUh:/OfVxfrJfAJ2Vg1UtjGIxhBRnYvuP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791255547, "uuid": "5ae790be-f5c7-4eb1-ad9d-495b224d06fc", "value": 54033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791255547, "uuid": "d6758e32-52b3-4100-a024-b2be988ba781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791255547, "uuid": "f322d19b-586a-441e-a021-45534d92b1c4", "value": "SSH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6df02f-c186-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791292066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292066, "uuid": "f924af1f-9e5e-4f93-8c76-53443c3a79bc", "comment": "Malware payload (Mirai)", "value": "3d5e58389079644d0667312755a8705b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292066, "uuid": "891290fb-6421-4cc6-89a4-73ab865a2baa", "comment": "Malware payload (Mirai)", "value": "60301cd24ed2d9c3d4d5fc2f20ab7404964f6a7702fa4af8de98e26c51ec36b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292066, "uuid": "179f50bf-af2f-4f36-9966-9dc752370051", "comment": "Malware payload (Mirai)", "value": "1ea4e3c7fe1c1a49e41c950399770bb6bde9eefa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292066, "uuid": "6d04adac-7500-4137-a9aa-51f746225068", "comment": "Malware payload (Mirai)", "value": "f0d89b271a26ec2e7d2998731667e96943877f5d93abd9e8426f9d14962f427a8d7325ccbed5793a3b0576092201118d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292066, "uuid": "59c4c9dd-9644-4c92-87cd-85fe7a52b929", "value": "T102F2F27B81F5A57CCC32AC735D54E9D9AC72E82768995BFF644297BE0C31E043600AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292066, "uuid": "0aef4f85-e79f-48a8-bcdd-508246cbd7f2", "value": "768:AwS0nQr9tpJEujVWoMwrIVOqs3AECHgJr6UAX6vKfcnlUx0nZv:rOXVLrIVOqsQZIJKkCMZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791292066, "uuid": "760fce96-e0bf-418b-8221-4c2ba8a6c350", "value": 36916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791292066, "uuid": "473525df-426f-4403-a7b0-dd5f0bad36b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292066, "uuid": "6e3efb4e-3414-42ff-89b0-8feba8bb80af", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d55bc7a-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276015, "uuid": "1be2c19d-616a-4b19-8e47-fb9edc44d9b9", "comment": "Malware payload", "value": "5c1df68893a9f0152e89cce12c9a7d6d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276015, "uuid": "45fc9812-a7aa-4434-9b01-19a9fc5f2ad9", "comment": "Malware payload", "value": "60de519ae5b2b6117cb94cc2ba66b32f712027e1170927ad4b413052640dd626", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276015, "uuid": "f891098f-7a24-49de-991d-2c67db869fc4", "comment": "Malware payload", "value": "f1b5aea051428b4718e7320cf7942942bd5bec50", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276015, "uuid": "d2908f4a-e192-4bff-a390-d448c25d651f", "comment": "Malware payload", "value": "3df45e2d2f342205901331a0c0801349fd13af912e9ecbc517eddac9bb7d617ae332c355eeb01747041b54a1fcf7222a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276015, "uuid": "998227da-07c0-407d-8553-1eaace51f09b", "value": "T1CDB423F5A7506BCC9D20522F2F4A2BCE19274F41B403C54A1AD2875A421FAFF4E7AD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276015, "uuid": "03e02b67-1930-4001-9b06-f61574839902", "value": "12288:oBRdpQ73iBVYWPCwvEXgbvM0a4OTHiQIIFzuK9Gd9IUg:oHUw2WK9XgbM0azTHiQIouDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276015, "uuid": "aff7d036-dfaa-41b0-855c-556c39bcfe04", "value": 542317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276015, "uuid": "a2a94971-ac31-423d-84df-77f7ab2aefb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276015, "uuid": "ba49ca44-d80f-4f67-bfc9-acda136503f4", "value": "60de519ae5b2b6117cb94cc2ba66b32f712027e1170927ad4b413052640dd626.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4249ee0b-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275030, "uuid": "e538a0d3-a73b-4123-9e59-78c0add54b1b", "comment": "Malware payload", "value": "d0bd37d9e242fd70ee38224b2f8809d4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275030, "uuid": "19d1df3c-9f18-4706-9f11-d30a4331d975", "comment": "Malware payload", "value": "60e1beee520f4459ec7759d8c84ca122efe3faf11dc4e6e37c67dc00b5e4504b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275030, "uuid": "01e0379f-b843-4c7c-8074-3977306f7e79", "comment": "Malware payload", "value": "4a33475d5cba008e9481d6f69a1ad8e82651a552", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275030, "uuid": "7adbfc29-3534-4398-9660-0a330fd75005", "comment": "Malware payload", "value": "9cf63462913c127909ea0f641d80c1a175856a4a627d3ea91127cc47a2dd58b389530ea7b297d703e7901607f642e6b3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275030, "uuid": "d43c2809-3de5-4175-9f0d-e21a84e49d68", "value": "T1F655338AC17C1CC49F3E0AD779FF555CA2248EFC200208636B2A59A7253E74FC7B595A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275030, "uuid": "f75653c8-3399-4691-89f9-f203fe6526c0", "value": "24576:uPTJsZg550oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRE:ubJZ50oZ9bq+MmMEL+hcjXHC/wnwdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275030, "uuid": "ec411e7e-58da-44be-b82a-337d604f8d24", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275030, "uuid": "253a357c-c0e8-4471-bad1-5e6167d94231", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275030, "uuid": "cc23b416-4acf-4705-bfc5-9aa574f0a409", "value": "60e1beee520f4459ec7759d8c84ca122efe3faf11dc4e6e37c67dc00b5e4504b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f1a4b2-c120-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791248051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248051, "uuid": "ca627178-f03a-4ed8-a22b-1c7700f46d8e", "comment": "Malware payload", "value": "e6d6d0aef2141910f890daaaabea11c1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248051, "uuid": "c3206f17-0356-4b1a-ad99-3b8181f17667", "comment": "Malware payload", "value": "61580abb0483fd27865d711360b3948c76488a472b3ae080c6e2d9fcb8c5b377", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248051, "uuid": "5a7db226-e0dd-4f15-9193-aba21677cf9e", "comment": "Malware payload", "value": "ac0372aa79a66091be1a6a5342d718412f679966", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791248051, "uuid": "b1b80f66-a99a-404a-b8cd-ae40ace9dd50", "comment": "Malware payload", "value": "00d6f23849876a8680d5c588d6a65a0c81d47fed5ed0314bd33800c93b221c6682583d1916338f4d14a0226e5caf4322", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248051, "uuid": "97f71a25-0c2a-43d3-8a2b-dd6a9981ef65", "value": "T1A0450101CF655095F5CCC7302B668E379B317A60894413DE276A2E89CD763E3F66B23A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248051, "uuid": "2c01f28a-b022-471f-bed4-5c3d71da6c14", "value": "24576:zPoysjrbNvFKvZObiwQl3CHN6LOaJGShbrfv3EvbmZkwE/l8E:ToPdvO6/tOhMOPvmyLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791248051, "uuid": "5adfcd37-ca05-4339-90d0-ac10ae61ddf6", "value": 1166784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791248051, "uuid": "eaf5ba1c-6e44-428f-8fda-82b6f8bec848", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791248051, "uuid": "bdb6f420-3a0e-4039-876a-65a212ff12ef", "value": "macho_61580abb0483.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045bbdd9-c154-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791270201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270201, "uuid": "ac1326b2-62fd-482e-b669-d46e7b77af6d", "comment": "Malware payload (AgentTesla)", "value": "860800d6735bef5a5ae1eba5e10a7c6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270201, "uuid": "f8c8c160-7091-4530-a1c3-bee8ef561850", "comment": "Malware payload (AgentTesla)", "value": "616f88f27ec35f7630bab724e17b6b0efdd7922eee154b458736c42bcc6c8c6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270201, "uuid": "351c62fd-46f8-4a38-9436-24b2ee482f36", "comment": "Malware payload (AgentTesla)", "value": "44a2eff4f8f9137adf1afa9a52eeca3826d9b9c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270201, "uuid": "a3492dd2-777b-4d71-867f-9364126b4101", "comment": "Malware payload (AgentTesla)", "value": "467cf96b40eab055bc0aab098f0aa89d7a197fbfee3a9cf98025f16cae2bd4b7f90cdd793a73d0663fd6250b1d3804d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270201, "uuid": "b2251d07-99c8-43af-b3d9-08a9ce6fcefa", "value": "T1AFE51A7C1258F746F8E848308E0E1FA10AD5B407FDD0DA333AE8BA5A5758BD23376659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270201, "uuid": "5c7a4000-cd53-4ace-8e33-310d16799d29", "value": "98304:zOPLxQxJoC3Yxkj0boT86gOv8HWIBfvCFBN2UaLvltoUm2j0kC:0IBJj0bc86dqVHvlt3z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270201, "uuid": "7444fc35-a17b-48ef-ace0-ffc989c237cd", "value": 3239738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270201, "uuid": "e2c16e92-6ce4-41e7-b8f7-8915c36e6c01", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270201, "uuid": "43893c45-fcb4-41cf-8db8-95e90e56c879", "value": "Proforma Invoice.1709-300126270691.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5b7a56-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276312, "uuid": "1c6497ee-7d8e-47de-80d8-f7e9855b60c8", "comment": "Malware payload", "value": "a1c7c2537595ce1d7c1fd62a7179a448", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276312, "uuid": "aed854d5-7e68-46d2-81f7-1ff7fe309896", "comment": "Malware payload", "value": "61ff760f53f8f11038f32671ee69edb5db4013373802a76883609543c7b0f387", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276312, "uuid": "52d11e7b-bde6-40ba-b018-c564e9ad5626", "comment": "Malware payload", "value": "cf7716bbf4397317a1dc20ee9187dd22df579388", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276312, "uuid": "8c649f8c-ed87-442e-876b-bbcc3503a992", "comment": "Malware payload", "value": "07169872b38d1fc48357fb01025878111293d5a678c2020d12529d3385f9170dcd7180c90d5a800bc29b0e100504dde2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276312, "uuid": "3e0b19e7-e592-43b0-80bd-e3e8a49a3fa6", "value": "T10BA4238274716D06D096CFBDD4C1AACAD06E023D35263BE5639294CAFD940367F9BE13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276312, "uuid": "f57d32a8-8f33-4a1f-a4ad-62adf4a4c0a1", "value": "12288:sr06oUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZW:sr06oUv4t1cNk/wjibhv4b2On0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276312, "uuid": "b5a6d44d-361e-4ba8-9b57-96e109fe133e", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276312, "uuid": "e73c5235-8b70-4b78-971d-d9ef81d19f6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276312, "uuid": "dec69b61-2592-41a1-8de6-2bde9fa937ed", "value": "61ff760f53f8f11038f32671ee69edb5db4013373802a76883609543c7b0f387.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8cfd95-c11c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246348, "uuid": "d5e9320e-b675-4dda-9808-e469b8f55ad9", "comment": "Malware payload (Mirai)", "value": "a21ed44d86e7d1510420e414e2743357", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246348, "uuid": "4c423e9e-658d-47dd-8043-3a7250b7ae04", "comment": "Malware payload (Mirai)", "value": "62437703d6d26c2ac4534fa46d05a31930b358a312b5cc7c5268b3e0eab22c5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246348, "uuid": "03e95879-0384-4871-9292-fce30493fb45", "comment": "Malware payload (Mirai)", "value": "7a842e0d841d05d8315a043365ad84d812e42a3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246348, "uuid": "4b5ba952-cea1-409e-b4bf-c6d8d65a29fe", "comment": "Malware payload (Mirai)", "value": "d637443dbe44a75eaacd8ed0c658d3cd8ebeb944a3980d169129fdc82d25bf369478a2f8cf0a04a43e4818a84985b2de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246348, "uuid": "c3431f56-aabc-4094-b573-e6edc21b71dc", "value": "T144A429A2FD019991C5D42ABEFB5EC2C833030379C3EA71029D1687256DDF69A4F3DA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246348, "uuid": "20d42626-a81c-4c6c-ab5b-a2c2da03619d", "value": "12288:t+eLAbzpIfc+5+f0Kj/rT7kVg3gzc/eBEDoSgX4:w9+MvE1B1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246348, "uuid": "4a6bed9b-c9ba-4ba7-be1a-1321b76538dd", "value": 454124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246348, "uuid": "2e566152-ceac-452f-b22f-ebf36e98d6f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246348, "uuid": "ed45c697-2c04-4181-8b59-a7e86202d035", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dba1b5-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791273392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273392, "uuid": "2f0197dc-b8b5-4a17-8166-fa794c748c67", "comment": "Malware payload (AgentTesla)", "value": "d97c366141a64b329dfcb08864086620", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273392, "uuid": "0c82b908-65b4-4c3d-8673-a947a9efaf14", "comment": "Malware payload (AgentTesla)", "value": "62a5d1c596539f30553a121a3cc16ae46f6329cf8da0965d5ce7e21df5f5ee05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273392, "uuid": "21947dab-bcca-41ba-9983-1153522d885a", "comment": "Malware payload (AgentTesla)", "value": "afc454d188fb2f87cb4e26eb34a8fa8e5289fbe3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273392, "uuid": "d9854101-d050-4b81-b03b-9955c3a70b49", "comment": "Malware payload (AgentTesla)", "value": "21c1ae51c6050a31947dbd7d0e8c08e046620d7b115c553d888edfce655092a16dec659cf3754277f562c525c2cde4b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273392, "uuid": "8314e982-526c-4aae-ac25-b2458cf1be27", "value": "T1C1F5E57A139491327320AB4D6EB69830A49B748338C5EB32B5ECF214771CD07775AEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273392, "uuid": "6e9acb27-38f5-46a4-ba06-37e33738f699", "value": "98304:0mJEiSHctIYYGKgXR28uRc/YILLsdApSBoeaeVhGRaVDOjFOA4RCYl:1JEiTIYM8uRcA9RseVVD27CZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273392, "uuid": "09e89477-e004-4727-8c0c-7f99b60fbf6b", "value": 3381584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273392, "uuid": "905401ef-7835-412d-bc9c-4e28d7c1c17f", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273392, "uuid": "5f7c33a5-db6b-4f0f-84b7-030f97063140", "value": "Payment_Advice_pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba27ce4-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273757, "uuid": "2f09e894-8830-48f8-9ed1-7ceab61b8f21", "comment": "Malware payload", "value": "b9931a75436af5ad05fe101ff8597800", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273757, "uuid": "f8afa8fa-e8a2-4ddd-8f8e-45b6e7a1d73f", "comment": "Malware payload", "value": "62b1bef405485b4ecd9ef19b3030a79935152741aafbc5ee856e9121b70258fb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273757, "uuid": "ce1b075f-2813-40f8-9323-4581ac0a8aaa", "comment": "Malware payload", "value": "7b40c3e8cff13945b52669c2810762569ff77bff", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273757, "uuid": "73ac35d8-c3d5-4089-acd9-d0fc1e484b86", "comment": "Malware payload", "value": "b0bec14b8540bc7ad503b49027051cbac5e8740e42f92517de1c7306752371278e8082be0274eaf8fa6136908706422d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273757, "uuid": "dc2bc227-1970-464d-a316-4be040a80042", "value": "T172553387413C18C44F3D066767AF996CA2259AFC20070C777766446B353F3AF8AB998E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273757, "uuid": "05cb062c-84f6-4257-82d2-3ff4dc73b223", "value": "24576:eoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRxMU94:eoZ9bq+MmMEL+hcjXHC/wnwdxMUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273757, "uuid": "5fdb8f77-7441-426b-9e3e-16136432174f", "value": 1387699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273757, "uuid": "94317021-4595-4e89-b6c2-6a70a210b7c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273757, "uuid": "82168207-fe78-420c-bf45-276659d4d979", "value": "62b1bef405485b4ecd9ef19b3030a79935152741aafbc5ee856e9121b70258fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4615f12e-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271600, "uuid": "d2f17985-ec97-49e8-9d79-99054e12f2f2", "comment": "Malware payload", "value": "d5b08340b6ee1480c7d1024b0b75b845", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271600, "uuid": "a362c4ad-fa15-4175-b30c-b9e2aa6d3ef9", "comment": "Malware payload", "value": "62dc6a933ca7248fbf5364ac75e99e8f9922eef7730d6cec938372425f183318", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271600, "uuid": "44b81ce0-22d5-4a5f-9232-2ec913125afa", "comment": "Malware payload", "value": "ddaf7d16797e11dd0d076c52ff7616869e1bb8b0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271600, "uuid": "958e8038-be24-435d-9a88-b3ee0de62edf", "comment": "Malware payload", "value": "c073ed30ac849dc54f41ae9768c200dfd81b3df1f2b3e80731450eb6ef64621e3822f28bd801cc5538581af972248159", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271600, "uuid": "da1cfec7-20a7-4f38-b5c2-c88cdb529e82", "value": "T1B7C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271600, "uuid": "77820468-6219-4d00-8c69-c940f3ebb786", "value": "12288:D+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byOH9I1P0QKw6FE0:D+QqldA/TSO713u7xnOH9IaQKHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271600, "uuid": "4e14b25b-e98d-45bb-9b12-06f13c468f90", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271600, "uuid": "b2084844-27b0-43f9-a3fa-686b21c5d0ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271600, "uuid": "0d3067c2-4dd3-4a88-a34a-8ebf076a2eb2", "value": "62dc6a933ca7248fbf5364ac75e99e8f9922eef7730d6cec938372425f183318.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4f0663-c11c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246351, "uuid": "3152afc0-2514-414d-a5cf-b3305efe3afd", "comment": "Malware payload (Mirai)", "value": "28bf0cb05f6a04addda071af43caeae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246351, "uuid": "bbbbc529-cca5-40c0-ab4c-d9d1063f4e36", "comment": "Malware payload (Mirai)", "value": "632be1593f28129d1444a404ae0a38ebd4f774aefa1bac3d2194aabcdf625e4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246351, "uuid": "b8df0c6d-53c9-4215-bd33-275c1d349243", "comment": "Malware payload (Mirai)", "value": "51e662da2c92bf149248806544afa89532485768", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246351, "uuid": "dd838194-80cc-4f5a-bc46-1918f4617bf6", "comment": "Malware payload (Mirai)", "value": "74f100a3326c925ca6367305bb5556c0da85d7a15c7d630665c63b7c7013d4e2e99d6d9ef98cc646a35679273c14e040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246351, "uuid": "ffc49994-d0ba-4fb0-a593-6a20fbe379ca", "value": "T150563811FACB08F6E6031E3154BBA26F23315C094B24EBC7EB507B69FD7B6951932219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246351, "uuid": "900f839b-210b-43ba-9150-800bf57c4459", "value": "49152:8uY3c8msSys8eZQgALIM77XOY/doyvb7jw7Wn0WqOSrZ4Kea5Cb9r5E+:a33msSZALIM7TOKdoyz7Hpieac59E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246351, "uuid": "d54e8964-140b-40a8-bec1-502eca25ad75", "value": 6058146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246351, "uuid": "6eda9815-8924-44f9-b5d3-33cdba758437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246351, "uuid": "c7dd82f5-8a31-4c60-ac97-4e357badd98d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec47b710-c196-11f1-927a-4201ac107004", "comment": "Malware payload (CollextorRAT)", "timestamp": 1791298937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298937, "uuid": "7211c6a7-a613-4633-8cc1-90457bf49532", "comment": "Malware payload (CollextorRAT)", "value": "4951465b8b9db30de15a8034b4e62137", "object_relation": "md5", "Tag": [ { "name": "CollextorRAT", "colour": "#5EB532", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298937, "uuid": "8f13cb20-21b1-4eda-8b8c-438992b153de", "comment": "Malware payload (CollextorRAT)", "value": "63a4f55282106baed0ef20a3017768fd1fca367d63bf12206768e18211b985a0", "object_relation": "sha256", "Tag": [ { "name": "CollextorRAT", "colour": "#5EB532", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298937, "uuid": "ed9b79f8-0918-4aec-97c1-1040ac2199ec", "comment": "Malware payload (CollextorRAT)", "value": "6f431cfe9413d3b900b3c0f69d8fee0dab1b7a19", "object_relation": "sha1", "Tag": [ { "name": "CollextorRAT", "colour": "#5EB532", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298937, "uuid": "ad83cc64-2165-458c-80a4-c9ea3d29edee", "comment": "Malware payload (CollextorRAT)", "value": "16748e70113bac9e4c7816909d82940c38513272426dda9a66807778fd4b39833c3f5ceb0db3dc99c6afb6064fae2e37", "object_relation": "sha3-384", "Tag": [ { "name": "CollextorRAT", "colour": "#5EB532", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298937, "uuid": "7b42442a-6a20-4840-93e7-111acfbbce03", "value": "T11D452B07E39286F5C5AAC170C75AD332AA70F44A9435B61E2EADDF023E16F609B1F714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298937, "uuid": "39797109-6314-49bd-9f7f-6f784edf953a", "value": "6f77e0e0b51f09e1188e670f8d02d4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298937, "uuid": "3076c2a4-208f-428d-b8cd-ac8a6fae5303", "value": "24576:CxZBaRGGbT5BJe/V6h2K/ZIb6BZynfN0EbgF:CxZBaRGGbT5Pe/Vo2cIb6BZGfN0Ebg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298937, "uuid": "7881a36f-83d6-4a2e-b597-19a3b1374f13", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298937, "uuid": "e965c122-c487-4243-b1b5-8a80e9850dfd", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298937, "uuid": "c8e046c3-0256-4545-9302-968a3f073fe6", "value": "63a4f55282106baed0ef20a3017768fd1fca367d63bf12206768e18211b985a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5b1511-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275825, "uuid": "b7e5af56-f1d4-4f65-b890-1d67c4ff15e3", "comment": "Malware payload", "value": "a732ea7fa8a3c9610358f604106ba362", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275825, "uuid": "b46ce1cf-ca02-4f2d-b609-78fd14e07849", "comment": "Malware payload", "value": "6411183b90cfc36c986d990a964f92c27803cee548da8b2c4cb4c59e1cf26323", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275825, "uuid": "f1d9ad91-a08e-4e68-b437-3d9d2e72eece", "comment": "Malware payload", "value": "74b8671297edbb2bfbbb4af36cd3d8c3ca919ec3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275825, "uuid": "3712705c-94cb-4100-a67b-51dd8f1037d5", "comment": "Malware payload", "value": "0007a1613a79dba48d084967f6fd612f01b63cc5c270c2820a9812d7d9a297a96c377f00c05364a6ae2d29f671211b81", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275825, "uuid": "ae66f37b-e46e-494d-8d30-6681f98e7de2", "value": "T1565533D781BC29C44F3D0BA3A7EF855C72248DFC20020867276985D77A3E79F46A4A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275825, "uuid": "2cfa476c-06c4-456d-9ddf-0fd051189561", "value": "24576:loZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRM+a5+ta:loZ9bq+MmMEL+hcjXHC/wnwdva5+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275825, "uuid": "7331bf95-8262-4de2-a0c5-5ee3a43ffa7b", "value": 1380742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275825, "uuid": "7b110c3a-b643-43b0-8857-3ecbf0e234e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275825, "uuid": "c777ed4b-87f2-4502-bfd1-663aa1a01168", "value": "6411183b90cfc36c986d990a964f92c27803cee548da8b2c4cb4c59e1cf26323.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3952dc18-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271579, "uuid": "59381da6-8b73-41a8-b9fc-b441474b7bc4", "comment": "Malware payload", "value": "c7fe3864cd183a2ca55accfc0ce64ac4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271579, "uuid": "2e8cbd4c-8fb9-4e17-8f63-ec4b21d1556c", "comment": "Malware payload", "value": "64210dc3a00fd6062d45570beb5c01ce773ddc0b791059cdfcea217711bcfbde", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271579, "uuid": "83b4c6a3-8be1-452d-9765-0f592ed32dc0", "comment": "Malware payload", "value": "03d97f95e4f6195c8b2578b55b341f2bd929fb4c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271579, "uuid": "b379c4c3-6459-478c-88c0-e09bf6ad1972", "comment": "Malware payload", "value": "142bbc3f62a5afb62c91e9cc401c9b231127d65fe2aa881e38461bf226bf879284049d1670e0ad6d1e31e19b5ed8a0f1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271579, "uuid": "ec1f691b-cada-480c-8789-f83d888e71cc", "value": "T123C4231DA4547B51F68B6A78B323CDB08B29D03FD219C388A0840B399B5BE5769CD376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271579, "uuid": "0c6c5b36-c13e-47fe-b7c5-c51d4d23bccf", "value": "12288:MMU+0xq75aS9iYIp6cP/G2Bku6zXLcHXP427bX:o+J71vI/GzXAftHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271579, "uuid": "ccee7ee1-e347-46a3-8650-cf26fbde170d", "value": 587431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271579, "uuid": "bc61b19e-8cb6-48f9-807c-0676b9b6bd3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271579, "uuid": "292f49f7-98bd-40e4-8268-8b8e02ce9c74", "value": "64210dc3a00fd6062d45570beb5c01ce773ddc0b791059cdfcea217711bcfbde.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c878debd-c154-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791270530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270530, "uuid": "64f8ae84-12ea-4dbe-9f80-a9fe585078c9", "comment": "Malware payload (Mirai)", "value": "5ffefaaca22755d0b020a85d739d9bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270530, "uuid": "c3f273ef-a07d-46e1-a1e2-df5072f1dd2a", "comment": "Malware payload (Mirai)", "value": "644fa7ab326d731734f7a87dace1d9cc10b09467f4e66aff6db4adde07e1393a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270530, "uuid": "1dd1921f-06e1-4f01-8607-e4096df00f87", "comment": "Malware payload (Mirai)", "value": "2b6aed102009e690cc4f160421323eee47071a34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270530, "uuid": "71e55a8b-3c11-49bd-ae28-c463f482844c", "comment": "Malware payload (Mirai)", "value": "14bf207cf1d4201aa407ec252d9e06e4b566c2e6c11d89391ddf6da3f9cf9278f74611e1e7dd7a403b63e7183d06d3cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270530, "uuid": "16bdc162-4bdf-4d78-8067-43c7e47fc46f", "value": "T134C43B52F8419F93C6C12ABBFF5E834833175B78D2EE710299156F74A3DB8960E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270530, "uuid": "32fb7516-ff9c-414c-973d-2fe3e85ab7f6", "value": "12288:1wsf5OK3BFk6kvr1Bv3AgllWaMA9YF0Z5IrR8r2A7x451v0:fxF4RB19Q0G8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270530, "uuid": "55ce8655-1665-426b-8620-cf327ec8f40d", "value": 565136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270530, "uuid": "d8a76413-fd10-47eb-a93d-8e0eae7c6bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270530, "uuid": "5c4c5b69-26f7-47b2-8428-4f3864a15de8", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e61b33-c14f-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791268159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268159, "uuid": "ee6fd5f2-73da-4506-a444-7b8914f6836c", "comment": "Malware payload (PureLogsStealer)", "value": "ec2a78c2af84423047091595a79909ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268159, "uuid": "5809c698-e3fe-41aa-bc19-0781c49f567a", "comment": "Malware payload (PureLogsStealer)", "value": "64885dbfcdfe2c57c999000a4707cb465c4f1457c40890887d9eaea73e61f127", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268159, "uuid": "1269002d-17f5-400d-882c-6a8ca35d54d5", "comment": "Malware payload (PureLogsStealer)", "value": "6ab7ef14c901eff8b63802a5ac5bb91c6ac7b9bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268159, "uuid": "a3330602-b8fb-4836-a0a8-745ef75659da", "comment": "Malware payload (PureLogsStealer)", "value": "6c0a180156d413535d03c30d128cac248811855ae3b1b2b8928b36ab31c14d3eb366d899a00fc0bd1dffee0e488a1a2f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268159, "uuid": "d990ac92-83e6-4b73-870f-0a8fab4a7c95", "value": "T1EF6512680251CBD2EA7C130C6B3BDF2546F989A0D25FD185D6E8DBC62BA5781E0F0DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268159, "uuid": "86113666-f31b-48df-898f-2840edba90c1", "value": "24576:/nNdyiCypNpO5NnVoMksH5yvxR/kDagKM2sxz4CDBG1Gxor2J+DPEzBQfm:FdyivNcfKMrIv0KMdC+CGoNDEzBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791268159, "uuid": "f3c885b6-ee7a-4b8b-9238-5107246a31f5", "value": 1510946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791268159, "uuid": "e7edaf1f-e1ee-45bf-ac0a-2f20fe6c40b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268159, "uuid": "86b95893-72da-469c-bb3b-2f9256ba14e2", "value": "Enquiry_AG-Trading_2026-10-06.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4232dd7-c1b8-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791313446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791313446, "uuid": "58c08f12-f16a-449b-8574-c4c647e36945", "comment": "Malware payload", "value": "7b9957f3d0d8de82d8d64b5c8ae437e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791313446, "uuid": "9833879b-713c-4cb2-942f-4a6d68a866db", "comment": "Malware payload", "value": "649695cc337c50bf71bbf43b6c976d7937d6c504332db83e7d9e71213a0ac728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791313446, "uuid": "9dbc0a73-ab9c-4dd3-86b3-477e939140b3", "comment": "Malware payload", "value": "a83aeabe86879e155d507102e1b71c554f39cfbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791313446, "uuid": "cb1964e8-a5a9-4031-970c-b0246999edf0", "comment": "Malware payload", "value": "6e01501a40d91c15109324f365b169c9420f1c7142f7314fd56e191f4f139ec85b8eabbcac6c6f395975202e811260a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791313446, "uuid": "08950b9b-0275-43a3-8f3c-20f4a8580018", "value": "T188C5191BE2A344ECC12FD17486639772FA70B85941347E6E1A98DB312F20E605B6EF35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791313446, "uuid": "96c9b791-b3ff-4555-9236-f0ab84b2498a", "value": "a07d43f4f1f9e66f3ef4ab55e02b7693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791313446, "uuid": "7eef1e15-cdec-4613-9016-9f1e5d2deac4", "value": "49152:ScWTgrD4vGfPqeDQ6zcWTgrD4vGfPqeDQ6:ATgbvvTgbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791313446, "uuid": "5cd514ee-e1f9-4b1e-ac08-bd019a65d8dd", "value": 2510848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791313446, "uuid": "9b69ac95-5c4a-4e56-a556-11e66ec92b19", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791313446, "uuid": "632c8469-69ae-4ca5-b14c-69acceda37e4", "value": "WindowsSecurityUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c75688-c1c8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791320129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791320129, "uuid": "8d3cc4f6-a6a5-483f-b4b3-402e0a05bb11", "comment": "Malware payload (Mirai)", "value": "c40e83d7f6430c4aa70ea5041f24d8f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791320129, "uuid": "4df4b721-9b22-4138-94a3-1ec926dc91ad", "comment": "Malware payload (Mirai)", "value": "64b9c6000e30cd09d2f81b418df20e1ff916fc0e34100df262830c8d15ba4cd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791320129, "uuid": "98c2701f-b80c-4d61-9624-0714974d3b6f", "comment": "Malware payload (Mirai)", "value": "9d8f79ac112d709b9887bbbbd4368904bd9bf14c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791320129, "uuid": "1e1ca785-5000-4c1c-9a7f-9999287ee5bd", "comment": "Malware payload (Mirai)", "value": "754d8da99d0624452dfc494e7f72f316e391a4db6a7b5223871fc04ae75a8571c2af8ad4312c9f66181014e21d551f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791320129, "uuid": "b5c36ad7-fe8d-4551-a643-d2f935f80fa7", "value": "T191D47E8BB650DDBEF886D33644130B296020F2E245E29B6FF15F7DA4EB2D1902535BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791320129, "uuid": "7b092912-f2a7-4593-97d7-194876b7bcab", "value": "6144:UBbHIxDcUKogZB0jdf4/bfQyZg8W8XAlT5hSzhuwyjGJtpWbDm977LZHutLKdex:WDIxoqzjC/DdC8MTZdDQHut2dex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791320129, "uuid": "15f4ed88-c6a4-426e-a425-7a1cae907c7a", "value": 612244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791320129, "uuid": "8071e8e9-bf05-465a-9bfa-1131b4ac380c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791320129, "uuid": "83d20798-6cf5-469f-99d1-0e1d20a0c496", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f2c7f4-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791263888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263888, "uuid": "745d8427-dbef-4452-9325-64062ccbe4e3", "comment": "Malware payload (Gafgyt)", "value": "409bf8883817ad1dee7c490d4ea4145f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263888, "uuid": "f15ad3af-08f7-4123-87fe-4011fdb7d17e", "comment": "Malware payload (Gafgyt)", "value": "64d8fb286b66082ef57f080e5bfd24f641ca9ab0f16141eb69677207632ac553", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263888, "uuid": "041b8f9d-cbaa-439a-92cb-3f5a1b08e964", "comment": "Malware payload (Gafgyt)", "value": "19e6b4cbb03869cd43d30689557f6eae74454ace", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263888, "uuid": "c86ca203-6a22-41c0-bffa-35cd42bfb291", "comment": "Malware payload (Gafgyt)", "value": "6d3d7a003fac59ffc6bf5b6fbd952a154db175efba49e1042467eae009e755272511e14162e09a20c9fb02d11fbf7fc9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263888, "uuid": "ac735e6c-767c-4504-ae37-279e6dab764d", "value": "T1DF145B13A9A55F97C5866FB662A38B710753E8214B430F7AF62AE9F44603DCCF809374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263888, "uuid": "1ee4e7a7-f051-447d-aebf-77f48517763a", "value": "3072:N1x787iRz5o+GfnCPlIQWOFrS7pclKcaF4h4tlUtk/3PXPnlr41HY:57605o+wf5OFmp6Kh4h4tlUtk/3PXPnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263888, "uuid": "c1cdc7a0-c034-49c0-9671-27bfdc38472a", "value": 191619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263888, "uuid": "d02c3fd1-fc9e-42ed-892a-2b095b5b4a92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263888, "uuid": "e98581d6-bedb-4b75-8d46-c76e9ec3ae5e", "value": "qv3.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469d0530-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250556, "uuid": "c4d248f4-e24c-4c1e-aade-2e129b955eb9", "comment": "Malware payload (Mirai)", "value": "a64bee50f0809bbe06b6d3d2b794a98a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250556, "uuid": "897de8d8-fc10-4da7-85f2-342610dc9074", "comment": "Malware payload (Mirai)", "value": "64dc2a9b183b0007cfcca8bf7091d1c7f37cf66f7ad94f98e113e87c60c10962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250556, "uuid": "5f314df8-647d-45c5-b30d-4d80ca084c1a", "comment": "Malware payload (Mirai)", "value": "cb5295deb9c90f3e1905b24058a01c621f007eb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250556, "uuid": "d9bdf238-ff2e-42b6-9dd3-2bd00167732f", "comment": "Malware payload (Mirai)", "value": "b53aa0435835d71beb6b0d1a9f9f2912d7da03b46e2cede69e9085ae3236a931821f2ebc54e8ed2ed740d759202c0b80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250556, "uuid": "24d4a3b0-6407-4e84-b738-6eb8a706a882", "value": "T1ABB2E1A8C64E746EF0C905BFA0DF01D6ACEEC64140BE92076AB7D78D54EB1518B2CB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250556, "uuid": "dbf56022-02c8-44ed-9a1d-66860cc0b6fb", "value": "384:MaiiBiccUIgcNADBQDDY6/J3Nwlzq3ipTyKQurQlZANnDQsNJTv1RHD:iiBiQI3ADYDXkl2SprQury6tVbHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250556, "uuid": "67c15cf8-4adf-4f71-b3ea-d4f2c6bd14a9", "value": 23432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250556, "uuid": "f9c622d7-815d-46e1-b713-913fb3019fc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250556, "uuid": "eefdeaa8-1c52-4593-9a70-7ea450aeafab", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c265049-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274939, "uuid": "c1e7bf4b-f660-44cc-a8fe-e9f701ae86c4", "comment": "Malware payload", "value": "cd49332c7dfd7b860c90b5392f77f849", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274939, "uuid": "8cd7464c-489b-4cd0-8bde-f183750007c2", "comment": "Malware payload", "value": "65209c08f7670b89bfebd3fc1ebe2b0b748efa576d09b038ebc7bc38c0da06b0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274939, "uuid": "9049e0a1-7f24-40b8-86d2-2c7695a83f22", "comment": "Malware payload", "value": "bdfd745b6d3195d2f83a4fcc9c9a60cb12afce9a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274939, "uuid": "4f3d2f1f-4618-4919-8036-caca8c73d3fd", "comment": "Malware payload", "value": "7fd2a79fb886706a9f697324e5447b4491b52239c38321f00f253f734f104016184b81634cd319942fc97ef503d1dff1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274939, "uuid": "a77f35dc-ec2b-448c-bee3-187a85a81e47", "value": "T1B6553387817C28C45F7C0A53A7FB901C61249DFC20020D775BA689ABA53E7AFC97199F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274939, "uuid": "60d03f71-b37e-483d-9432-0aa4c7bc26e5", "value": "24576:4oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRam8fdCZziT:4oZ9bq+MmMEL+hcjXHC/wnwdam8fdSWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274939, "uuid": "c94b0233-cdb5-4a8d-90f2-9beead856b9d", "value": 1394680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274939, "uuid": "4392c7ac-a6eb-4703-863e-38dcafb55878", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274939, "uuid": "c4f1f1f0-34d2-403f-9e85-3152d58705e4", "value": "65209c08f7670b89bfebd3fc1ebe2b0b748efa576d09b038ebc7bc38c0da06b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fdbf8f-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272025, "uuid": "7ad99af4-e4e2-45c0-a6ce-380eade54a7b", "comment": "Malware payload", "value": "62908523b76e4ada2d1b6e4e79ce5bc1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272025, "uuid": "57b7f3cc-216e-458b-8cf5-c6a8ba8ce829", "comment": "Malware payload", "value": "662e2dc6744ad29766d4f2d7bba42a6c2cfe287087fdf871eb7ace7837325803", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272025, "uuid": "04f9f557-869c-47e3-9044-ce5803657cd9", "comment": "Malware payload", "value": "17550687aa41c429da14f6d2d4d4780658edaa79", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272025, "uuid": "70ef2a8c-53da-4dcb-b516-63972a526512", "comment": "Malware payload", "value": "9d8b69388746fd155e37fdf1eed0c6b7f4d3b3b110fccf379257849a6533af3e1e761d2504b593017646c495c3493c47", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272025, "uuid": "86b94ef6-5f52-4a46-84b3-9fda819f0d6a", "value": "T11DA4239CAC901E565C9637905E3EDF130BB0E81B32EDCEB9970B36A0D9F8D8455D824E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272025, "uuid": "bd49e834-7332-4cbe-a775-c77fb7a43a0d", "value": "12288:dzYfcEaN9B/Jm0LU0gM7aQGF/KBrh6OF8uRNiwowhr:SfclN9BhmSHcKD/qWnogr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272025, "uuid": "07a86ca8-5893-41ce-84c8-46a619622db4", "value": 467813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272025, "uuid": "cf181df7-e513-46c3-b989-77d7541f32d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272025, "uuid": "a0a9e557-6f8e-47c7-83df-91390566616e", "value": "662e2dc6744ad29766d4f2d7bba42a6c2cfe287087fdf871eb7ace7837325803.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00832c6f-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791273201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273201, "uuid": "7d7ad90f-1ab3-463f-80eb-d7556d57c390", "comment": "Malware payload (MassLogger)", "value": "32f12e4ca9597d23c1b446793c211049", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273201, "uuid": "bdf41edc-b243-46b6-9c21-9efd2739ec76", "comment": "Malware payload (MassLogger)", "value": "66f503b12d359e33d474b62f9c2d63ed662912e297ebfe5e999d2cc6e9e3ea3a", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273201, "uuid": "23b8b9ff-f478-4779-a74b-3e9b12a65514", "comment": "Malware payload (MassLogger)", "value": "663a6c70a8666343e8262620ccb2a4d44466254f", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273201, "uuid": "c7c5ce99-df18-4bc4-a213-d068a9ba81b7", "comment": "Malware payload (MassLogger)", "value": "3187316df347558a54e79cd40c3c1dbdfb93eb40ddfdbe10145e8bd35a209ff24eb08541ae584f36e320d75cb95399ee", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273201, "uuid": "de3c88d7-3883-47bc-9aba-29021c770ad2", "value": "T1DA45233D6E3E19DF0102D5BEB261FC4C62CA239749821623625DC6243BFD1F5AA63D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273201, "uuid": "22438f08-97fa-4b0d-b43b-43500ec49f2a", "value": "24576:lvkXiI1AHZMjWuwUSQC1wqV4ODKql96rNX+Zzdtap0hDBLAv6wi:oiIqZMjNCBV4ORlgeFLI6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273201, "uuid": "e3c759a0-c580-4de9-8ad9-7d9c0ece4081", "value": 1216679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273201, "uuid": "aff90071-298a-47e1-bb01-f8f3dd594bc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273201, "uuid": "27ba42a5-57e1-4c7a-ace8-48d5b6519109", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12c38bb-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274813, "uuid": "ed20eb3c-113e-41c7-bcae-683e76cc7438", "comment": "Malware payload", "value": "6b96c748c5689ae5ae58ee0adf9e3efb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274813, "uuid": "ab2b6577-4846-4851-824e-bce28202f28f", "comment": "Malware payload", "value": "67197f64764990795499e89fa296dd63b65d1e29c20cf98bc11df1ab5b6c04a5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274813, "uuid": "f2e58679-4916-4836-97c8-65f21e0ca3b9", "comment": "Malware payload", "value": "d998be62a3a9c8542966ebc86a0de735eb3a31f8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274813, "uuid": "81569ff8-57f1-41b8-b4ad-7cc96275917d", "comment": "Malware payload", "value": "827d28cfe42e3a5adeaec85a02ba2f290d0b8d3368c5b09624e56b083efe646efa9c2d65846422ad6557b196cabe6cc4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274813, "uuid": "8fb01dc2-261a-4471-b98d-cd8431d0eae7", "value": "T108B433F5AC68721A176F9D13E762EBD03B7DC3AC265313C42527A2CC404B96B116E3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274813, "uuid": "d1e18f00-1f1d-4a64-90c8-1bfd3951f7aa", "value": "12288:HrLZ+vPYN9Vr64fQ/IPI2si0Ndq7r04rxkF56zm5vI:LLZ+vwN9Z6qQQAHi0mgUmNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274813, "uuid": "144bea00-729f-4a24-9cd1-d737b1dde969", "value": 538362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274813, "uuid": "c237a75d-b149-402c-9c64-d0d6009a2e87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274813, "uuid": "40a61f29-f3ad-4a1c-b609-1d27cf76d9ae", "value": "67197f64764990795499e89fa296dd63b65d1e29c20cf98bc11df1ab5b6c04a5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546a8a6d-c18b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791293958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293958, "uuid": "13987412-50ea-4572-9421-34dbbb3ebf8f", "comment": "Malware payload (Mirai)", "value": "9beca2578b0c9fe1241e9d1919d63492", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293958, "uuid": "3ea93f12-24fa-40ab-8adf-ee4a53daab5e", "comment": "Malware payload (Mirai)", "value": "6739756b61f6a373543f47b098dfd549ca19fa7804d95371f124ba04d9433cec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293958, "uuid": "ff1e7c3f-9a51-4934-bcbf-5f9999e3c088", "comment": "Malware payload (Mirai)", "value": "3f8efeca65097ec5a11151bc31fd932433059da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293958, "uuid": "9e76a885-801d-49eb-9647-68d1f3c9cba2", "comment": "Malware payload (Mirai)", "value": "825db51cb1efd70443c7e17c566a1cc036d019e8f674a5636b55b01db721f516b9c77d769cc87e2fb7409548a0371ebf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293958, "uuid": "deda8549-32cc-402d-84f0-aaac17acf574", "value": "T121733985F987C6F2D4474830426BFB3FCB32D8A511B19B0DDF569F35DA33602AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293958, "uuid": "821d8675-ec9e-45be-add9-34beb1a72d93", "value": "1536:8A9Uqtm/qzBpzah2tYeQmP7uW2wORzBbkivom3aJ25dLNn:8A9U7KB9ah2tYe3PrXORzBbVvf5dLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791293958, "uuid": "c097a113-e0e5-4711-94be-93cfd050ca0e", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791293958, "uuid": "9f672ab3-7a09-496b-9631-b19ffb94e4f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293958, "uuid": "13f33dcb-1191-405e-87c7-eb305fa67b87", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5e3734-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273195, "uuid": "0b6f0ad4-f491-4eb9-8bfc-a649809bd583", "comment": "Malware payload", "value": "3c97baa54a1512cca595c9262cb9bd85", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273195, "uuid": "d3693bba-61e5-44df-b17e-26465f1ae87c", "comment": "Malware payload", "value": "675d10fc98f8a80216dc7562146fc2c9535cb12bc998432afc3f4e3c1573f953", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273195, "uuid": "d947cf62-648f-4e8e-b435-44e21c997d33", "comment": "Malware payload", "value": "cab20d9ee23326f2f2b279062aa19b525b62eb2d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273195, "uuid": "3961c5dd-bc7d-4853-9def-1ec01541d939", "comment": "Malware payload", "value": "8b694e2fc1150acb78a4e64bfa95a4f7ee3b43a4d3cc0a35acd711ec07a21eade01217398d70c92d8e293f0f09eb8ea9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273195, "uuid": "73d9b8db-eb05-47d5-b1d5-b599efa27e24", "value": "T18EC42304340641D5835A2B1EAEC4E7E0BEB560DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273195, "uuid": "8365c8ff-81a5-4874-884c-b03cdb3e847d", "value": "12288:D6wlOMWROC/FTeHo22Qm7NzofOr68mTeA924EwCF:74MQOC/gHozN7NzomW8NA9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273195, "uuid": "a48d859d-cbb6-4bef-b7f8-16396fc7cf0f", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273195, "uuid": "df1754a4-8067-4ec6-87ea-82062710971d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273195, "uuid": "2a477fdd-3323-43b6-a15b-460d3ab98012", "value": "675d10fc98f8a80216dc7562146fc2c9535cb12bc998432afc3f4e3c1573f953.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7c975f-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273621, "uuid": "48205696-0595-434c-bc41-cc0332aff828", "comment": "Malware payload", "value": "8449560c69c002fa8d94e69e83780356", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273621, "uuid": "80c5ced2-68e7-4bcf-8e10-c398693b1c11", "comment": "Malware payload", "value": "676a58dc08bcc41116b29292260772a889f225eda8db7f935b98b78d851199a5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273621, "uuid": "799a59b4-48ef-47c1-9e61-9c25fdbb4a97", "comment": "Malware payload", "value": "5cdabbb61c8bce6207ff30ac542ae4eaf28f57a7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273621, "uuid": "b54f9943-3f99-41a3-9c56-a715f82f1896", "comment": "Malware payload", "value": "ece189df6020398b525ad987ad07ca8da56adb81918fad4c3998f98b9ed33ee4ad4cfccec7cfe35b2e7109fd07f9ec18", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273621, "uuid": "5ce471e2-2250-423d-9445-74151d1f5f02", "value": "T14CA4235CA9511D32BC777AD03C2D9F020F28E543B5D98AFB891B3A904CBEC2862D52DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273621, "uuid": "1631a1c6-decf-4bef-b021-a180c51e4803", "value": "6144:de9ZfnUXRCvHWUEDH3s/bTLY4k2k7Xa5ozFYJHd3XcEqFN9KAK4Jmn+VJFNZ+0+D:de9Z/U30/kzYfcEaN9B/Jm0LU0gM7aQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273621, "uuid": "09a93750-b52f-4f36-9bd8-d3123fbc0e86", "value": 466717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273621, "uuid": "6217e076-40ec-465e-b769-4edc1359cbc9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273621, "uuid": "dd28eee9-ffb1-4b12-b25a-dce3fac143b5", "value": "676a58dc08bcc41116b29292260772a889f225eda8db7f935b98b78d851199a5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af67a8fd-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273065, "uuid": "fdd0704c-3f5f-43ee-b348-9f0d1e45a578", "comment": "Malware payload", "value": "964beb2773975e7b4f9b8f864746e05f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273065, "uuid": "ec17a53d-2d9e-47b8-995b-f8fdb93f71b5", "comment": "Malware payload", "value": "67f8416844c5668ff995a24a2354721580d8f5325760dae0447cf8aec38d13ae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273065, "uuid": "02be9187-1386-452e-81d3-c303513c5374", "comment": "Malware payload", "value": "bc074b43d9bafc1c686da22256fe22a9e1b4cfb5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273065, "uuid": "2b88d1e9-044d-427c-a112-1a9e93ac3c2e", "comment": "Malware payload", "value": "b2589c09db6034f76606f3546eed7443c244398d636ccb90a4bb9bf76e7244d21a90650cd09e3e06a2414d10674503bf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273065, "uuid": "67ef3e40-6a64-4cc5-a927-8036a6c27905", "value": "T1ACA4239CA9511D32BC777AD03C2D9F020F28E547B5D98AFB891B3A904C7EC2862D52DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273065, "uuid": "bd41ac13-7b54-42a9-8400-7d8a9a3fd61a", "value": "6144:Ge9ZfnUXRCvHWUEDH3s/bTSY4k2k7Xa5ozFYJHd3XcEqFN9KAK4Jmn+VJFNZ+0+d:Ge9Z/U30/ZzYfcEaN9B/Jm0LU0gM7aQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273065, "uuid": "b9f931d5-7015-4d41-8a5e-7171f8617d10", "value": 466717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273065, "uuid": "14e00c4a-952c-4f92-9da4-f0c5ca21931a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273065, "uuid": "d5f8eabe-ee22-4d5a-a5f4-6ca0d1997f26", "value": "67f8416844c5668ff995a24a2354721580d8f5325760dae0447cf8aec38d13ae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e2a0d1-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276328, "uuid": "8bbe92b8-d174-41e9-965b-5ffffef8c04a", "comment": "Malware payload", "value": "118f9c74b2ba12ee808eb4cc0c665192", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276328, "uuid": "728a6bbd-1bd0-48d1-a21e-05836a0f12ca", "comment": "Malware payload", "value": "695360d3607a95c15e6d81bb576770c0d277f31f855cf4a9c01aca914da6a442", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276328, "uuid": "5c02d086-c032-4919-8a05-f046e77fa6c5", "comment": "Malware payload", "value": "f4ef0e3124ee49916ac7d7fc8e514fa668a88838", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276328, "uuid": "44054e36-fb81-4967-aca5-bab6c61c738c", "comment": "Malware payload", "value": "e004b69db03c0de43dbb6083b51fee5642a4abaa416370bc6e68a1cd8fb347df89bbcea21787a4314ba4317093211811", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276328, "uuid": "3863cdca-07ec-41e2-afa4-401f9ecc1e32", "value": "T1015533C6807C28C48F7D0AB26BFF95BC61209EFC10021C772A6559AA753D38B87B595F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276328, "uuid": "aa5f5ddb-af3b-4332-9654-36b403dcfd6e", "value": "24576:nJA3RwNVoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRZ:JA3RwvoZ9bq+MmMEL+hcjXHC/wnwdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276328, "uuid": "5b945183-0de2-4d16-953f-0c21fa1c0f31", "value": 1394413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276328, "uuid": "1f445e7d-1d1c-44cc-acff-9a115b8bfce8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276328, "uuid": "0f279f2f-4503-48da-8967-07c4de8a9ddb", "value": "695360d3607a95c15e6d81bb576770c0d277f31f855cf4a9c01aca914da6a442.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b998112-c175-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791284414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284414, "uuid": "76a24c4d-d06f-42b2-821d-f1d0334f4cc0", "comment": "Malware payload", "value": "0809f4b39593be896a72212af48d1bfc", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284414, "uuid": "9386c37b-646a-4bb6-b93d-1f539f164577", "comment": "Malware payload", "value": "69baf8f04de627b5b755f22b0611ab507c8ebf9f7109d32772f1617475cf6069", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284414, "uuid": "5327b571-72c9-4b0c-a2c8-81805880993f", "comment": "Malware payload", "value": "9706c409c5332f6cb8e292734b56ddc03b473260", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284414, "uuid": "58cc6670-109d-497f-a4e7-076f54d5a521", "comment": "Malware payload", "value": "6d5653ae080c79d43ed51e4dc92fc05f11776ffe5ed8fa5ed442420f2a9193b9a24c9a77f0401915dcd5535833ed6289", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284414, "uuid": "90f64a24-a6ad-4f3f-833a-b6937df3f025", "value": "T1BCB17491BA35DC3067DA90789CCACD13B4E728BED6B37C8CA103CC85660EBAE714551B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284414, "uuid": "1ddaec9b-6903-49ca-b49e-353263b3f7d7", "value": "96:MQjss4YEF0sF1B7ERnKlB3TMS0pB5v8TASd/B0jBlBsseEgnB5BvB93s2v8/nDHv:73EKs/2Kl2S0mdoTKpESLlNvcDl0Tir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791284414, "uuid": "d7fd3b02-5805-4dc1-9e29-5c1d9c5b4263", "value": 5236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791284414, "uuid": "0fd35380-9b14-4a9f-8897-b366a19352b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284414, "uuid": "cadd9a80-a4f4-45e1-a7d8-44dc822c91c8", "value": "69baf8f04de627b5b755f22b0611ab507c8ebf9f7109d32772f1617475cf6069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aba0464-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "ff05fb9e-deb1-4f5b-a25a-b3380c255a1f", "comment": "Malware payload (Mirai)", "value": "39b667f4b1cc027948f3dfb354acc3b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "b74a583c-a2c7-43d9-8db9-0d0220cc094d", "comment": "Malware payload (Mirai)", "value": "6a6e1647f6dd43d62c2957b3182d0792ba33c9585b68899b9cb987afdf809de9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "03c0072b-3c76-4150-8197-2728d81cb51c", "comment": "Malware payload (Mirai)", "value": "9494cee50adf07c4cac009b3520df3f3eeb22ee0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "990da96e-4bdd-4b7f-8f50-221fca392f5b", "comment": "Malware payload (Mirai)", "value": "d77bd22ac97bc670ee913892c2e3cde519c45ee74eae3492601c3113d165487f437cfb7bb3bdc6f3725c317293209608", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "7f810053-f013-4c74-be8f-652d2f580f34", "value": "T10F342A0295518E53C1C71B7ABB9F865537336B74D3DB3302AA18BFB42F4669E0E2E111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "351e4a5e-50e0-4b06-83da-28eabf6a6901", "value": "6144:QPTn/4p8+vXsrroavnuc4DpaI9MeN5fsmyVOAZ7ZQu6aRqh:Qz/gnvX6oavnylaI9McKmyVOAZ7ZQu6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263877, "uuid": "8747d717-89d7-48e0-b6ca-a639d689b46b", "value": 236426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263877, "uuid": "c4522f8f-658d-4f09-8610-86f735eb593a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "87d6f544-0f13-49d1-ab32-8129f999e2a6", "value": "qv3.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e7de21-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "e02df568-28ba-4ed0-a60c-4233b3d86838", "comment": "Malware payload (Mirai)", "value": "224bee7695185602e54729e98bcb952c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "fb111652-1822-4b43-a0c5-7650c1133af5", "comment": "Malware payload (Mirai)", "value": "6ace19d81500192e18a25f9b42068e116c20f541ae51f49a1ac2638605081963", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "5858617b-85b0-47bc-8de5-3b60d0a64de3", "comment": "Malware payload (Mirai)", "value": "003ed343574769de532285fc08b5719c69c51035", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "f6e7b8e8-d477-4763-a5d7-28164369e082", "comment": "Malware payload (Mirai)", "value": "3d8f716fa4ac81fcfd12afa3e2b9ca3c4a752a19c451f3dc3a7b7a3998f44988291fb3c5bcc3dc2ccf2fad66213b01bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "cf934300-9347-4662-b7a5-712cd74b710a", "value": "T1520429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "26f44cb6-5e8a-4b2d-b39f-bdf50c74e700", "value": "3072:T1ThtmVqwyJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cKNKB:Fwgx4yvjd34F7GD8V4g2LLPNKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263361, "uuid": "d4c9d255-b4ac-4f23-adc7-883b5e08d539", "value": 182244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263361, "uuid": "8c36a07e-23bb-4428-a2b9-87e3237f60fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "f92057d4-8c36-462b-bbd5-6ad614d8787a", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfe978b-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275130, "uuid": "887e4172-78fe-4ee1-89e6-5dc6114a66b8", "comment": "Malware payload", "value": "eead66ec3ff2b40e857785b3654a97a5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275130, "uuid": "7d117ca3-7fbc-4653-8531-ed124f88aabd", "comment": "Malware payload", "value": "6af912c69baccbed6440d85fd59a74ff1d89e3d007c02cd018bc0b68ed976efc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275130, "uuid": "52efd42e-9244-4f29-93b3-f4e98bad30af", "comment": "Malware payload", "value": "4f6a5a2518ca7ec44c63d5f2a33699e3ccb44585", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275130, "uuid": "ff8c1eff-c18f-409b-b6e7-852ae0a66b25", "comment": "Malware payload", "value": "e86a62577f1601b0ac772f9760c625537e42b6c23419287ebbd504b8730da2bed572032cb76161a3afc445976ef0333e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275130, "uuid": "e17b4c58-62b2-40d9-a29c-3fde1cd85fa0", "value": "T10AB4230A85D01FFF899ECB9946D4A4672FF467952F93565BC0CD20B00AEA203D6EFC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275130, "uuid": "76c0116e-86ed-4644-a96f-acd4e90e066c", "value": "12288:zvOi3UDYXndLQ/jJOjB89RitlR0XjuIkVp69d3iY829uhBwbY7vPpCkIi:zWiEGnlQ/jwyil0X7kWv3icYwb9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275130, "uuid": "ec5ccef5-44ea-464e-8b3d-950a58076585", "value": 540419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275130, "uuid": "7b18afcf-aaa4-47ee-ab7d-847f6072726e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275130, "uuid": "4a43cae7-bd4a-494c-99c5-df174abf5255", "value": "6af912c69baccbed6440d85fd59a74ff1d89e3d007c02cd018bc0b68ed976efc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167a807b-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263360, "uuid": "4952471f-3f34-4810-b154-bc64526328ea", "comment": "Malware payload (Mirai)", "value": "f8b45c0ff231a7bec1ff3a2dc4ea7b38", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263360, "uuid": "63b25090-c1c7-490e-a51b-ea420f5b325f", "comment": "Malware payload (Mirai)", "value": "6b2171ad66224954ed1845a46ea6aa8f047304957f3e8e514bdeee6abf5139e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263360, "uuid": "86c5a8bb-d73f-4040-b4d1-118c44891d8d", "comment": "Malware payload (Mirai)", "value": "51e386536b8d0311fef5e5d9d3a93301cc4395df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263360, "uuid": "3143f284-be3d-44cd-a217-eac9af5d0bac", "comment": "Malware payload (Mirai)", "value": "fe7ffc6eb22ec1da3b765c7c1b82530dcb5c8e4e95974af02ca597119cdb1cbd96129e470d3d3000f8aa87c6b85b90b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263360, "uuid": "e79cb160-5e1a-4c7a-bae6-8e450ce771df", "value": "T10FE30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263360, "uuid": "625a76e5-0312-4658-8cfe-9c92e8e893cf", "value": "3072:6nZpD+/4jw0P0GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWcVq0:6nZpD+/4jw0PtfvCazzQvCalfnIQc0rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263360, "uuid": "74fb6b55-1b72-4f59-a085-15deedebb96d", "value": 146264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263360, "uuid": "2e4cb66d-fc72-4b92-9614-f4bd2784a0e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263360, "uuid": "cc354d53-915e-44b7-a9bd-f3bcc4d368c3", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1efbb6-c11d-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791246946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246946, "uuid": "2d274996-4760-40a0-8310-d21b86f4a33c", "comment": "Malware payload (Gafgyt)", "value": "d1f2c4cd856fc0bfdbd502acd4140b0b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246946, "uuid": "f230bbac-b1e5-427f-8a48-e96ad3db5046", "comment": "Malware payload (Gafgyt)", "value": "6baa3672c6d9af30dcb0f1d74660fae6a5ce61bcf27a852c82ef909cbde847db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246946, "uuid": "71d4f829-bc31-4c53-8cac-9713648a4ccf", "comment": "Malware payload (Gafgyt)", "value": "40aec289818ebabe9c449ebe620e860612565ba8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246946, "uuid": "8cd3f42f-3634-4ed3-8ca8-b22ed4e4963e", "comment": "Malware payload (Gafgyt)", "value": "66c2a8b35145543b66a0412fbfe8877b84f1cbc22077b7abc17d09c18944360d71c271d10ad49a1de4fbd4eb0aa44b98", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246946, "uuid": "858b8215-d5c1-40a1-94ad-825c0fa4877e", "value": "T1FA212CD751E20A36AC65D877B4AF8CB434D0E5C645E1BF0868EC38F4648DE59E481B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246946, "uuid": "d31f5551-2ef2-4a0e-85f5-16dfbc892618", "value": "24:vKVeJbI/s+VG+4DLTNIpks2KYBbIKA7xf:vKVsbI0CWLEJ2NFIl79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246946, "uuid": "fc05efc8-ca6f-488a-bb5f-2d4b56b8dc85", "value": 1356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246946, "uuid": "c1cf27c2-393a-4474-8788-dea77f388b0a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246946, "uuid": "21ed78c0-836a-416f-9e64-d4b6bf0c2a3d", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d196b0c8-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276129, "uuid": "22b959e0-9e40-48be-8324-89fd8ef111a3", "comment": "Malware payload", "value": "f81c30dfcefc9013de732f5560acbb4c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276129, "uuid": "7311a8e9-c95c-4cf8-8558-2261cca2b76e", "comment": "Malware payload", "value": "6bab496ccb0e22f4ead689bb212b473cf542242c462a2ee005a97b745c895be6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276129, "uuid": "4c077bcc-1f79-4159-809e-69fc5d6d419d", "comment": "Malware payload", "value": "50bfd08da4491b5b06ca493b1d5b336bcadb154f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276129, "uuid": "7c2c1c66-b70d-4012-b7f3-ac988da27a2e", "comment": "Malware payload", "value": "c7549eda498ecd87ff832f84c9a9baf31f63c6471733af99c3bbb5803c3b713803169b04ac03a389608d96beefc8f8b0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276129, "uuid": "18409bc5-2db7-4940-8e73-4dbe5f7b4a8f", "value": "T10EA4239581B983533484E3B5497B1AEA5F301CF28D3D674F88DAC5F81B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276129, "uuid": "a7b5d03e-8637-4879-bebc-14ec6de17af1", "value": "12288:HcwSCDe0U+m1V6ECbniSPfS3e2R3feeintFckL:DDe0wUTiSWzeeiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276129, "uuid": "17d03378-30cd-4dfa-afb2-809b16d4ee14", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276129, "uuid": "bd167edf-0a58-4464-be5a-0488260a86d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276129, "uuid": "c5f5ca15-35df-4b18-ac59-e8534e2e01c5", "value": "6bab496ccb0e22f4ead689bb212b473cf542242c462a2ee005a97b745c895be6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ee90c7-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276430, "uuid": "477b3ccb-6743-4a4b-934a-ab8c145efd1d", "comment": "Malware payload", "value": "7ea39abf0e7a2623532e674473310c5b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276430, "uuid": "6fa2ada0-c3f0-45d8-a2e6-2f9f6c5a251e", "comment": "Malware payload", "value": "6bc55ceef478cef64729baf7abd095b906f6879e70c3444e26dbeb304541994e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276430, "uuid": "a6bafcd9-e256-4642-9e7e-33953ba55995", "comment": "Malware payload", "value": "a617e0045ab078a512d6aad20bf0da91858f9e13", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276430, "uuid": "2c1ba1ef-9580-4c3a-99f3-43ac310c44a1", "comment": "Malware payload", "value": "d30de4053adf05167102e7e035101b45734ebdef8617dff47662178cd792b690b42a2b2d8650908d7aeb8be0bc608896", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276430, "uuid": "62bb9859-fe66-4e8d-99f3-67bf7166932a", "value": "T16A553387413C18C44F3D066767AF996CA2259AFC20070C777766446B353F3AF8AB998E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276430, "uuid": "4453d05e-c10c-40a3-b185-9daab78ebc58", "value": "24576:MoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRvMU9o:MoZ9bq+MmMEL+hcjXHC/wnwdvMUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276430, "uuid": "ba2ee7ea-a877-4496-a4d7-d2a6a9d06eb0", "value": 1387699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276430, "uuid": "2a29f23c-8e1e-4948-8531-fbcb2c9c3cd9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276430, "uuid": "faa3443b-de8e-40d6-9307-10752f45d23a", "value": "6bc55ceef478cef64729baf7abd095b906f6879e70c3444e26dbeb304541994e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebf1994-c163-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791276796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276796, "uuid": "99264bed-3759-4eb4-8633-5e600d7c0442", "comment": "Malware payload (MassLogger)", "value": "f59b5a40cdf47665d322808cda55a67f", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276796, "uuid": "464e8e3b-c6c8-4404-9bf6-938e72a67d3b", "comment": "Malware payload (MassLogger)", "value": "6c75d9c69a97d1bee2c6802c9dd7bb652e76e58a8e01a4fec25120a5c78c2845", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276796, "uuid": "31049760-0aa9-4b5c-89cd-f0a39e437913", "comment": "Malware payload (MassLogger)", "value": "9bcc084fb98f40c82e1aad0ee73010a695236f8c", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276796, "uuid": "463b7024-fc71-45ed-a9e1-f53da8b5dfff", "comment": "Malware payload (MassLogger)", "value": "b24bd390b82dbb8299994b08f7da29ffa7b1112a95eb34a2e0c378b77e23d9cc0b451bc18a3a7de0d3da919926035ccb", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276796, "uuid": "eed99a0b-901d-43fb-9347-dfa96e36a98c", "value": "T18D4523BDA8DD16DF0801F1B67613F982F5E56343184A126252EC83ADB6FE874EA1BC14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276796, "uuid": "7b40aa13-4608-4e03-b787-3587855b6e20", "value": "24576:C6ex9AZEoHqCToIAgRuNL2qtFqv6zm6YL0DLWc9J2hv2hDkgFhDmDZ4:CljIA32QDzm6X0ky4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276796, "uuid": "14f28a24-1903-4c0d-a962-59d615298af6", "value": 1239889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276796, "uuid": "ee15d3fa-fbc0-4fa0-9bb8-cf216c6e7e96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276796, "uuid": "b39277bf-8822-44b1-80bb-3c392f33d353", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a270283c-c199-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791300102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300102, "uuid": "fc9c0c7b-2867-4214-b97e-2363b882414c", "comment": "Malware payload (Mirai)", "value": "c122cd664b2662c58ce8c6a938f85b4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300102, "uuid": "1c10a9ed-8334-4446-8b5a-f5fb5b61f14f", "comment": "Malware payload (Mirai)", "value": "6c81eb4643cb5dd3172fa1df1361c1cadfbec280391e36ac71c335da1b5c1306", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300102, "uuid": "815b0700-7deb-47fa-8751-cb4431f9c526", "comment": "Malware payload (Mirai)", "value": "64ebda5330e64e8b33b6db4818527d2c71036eaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300102, "uuid": "8e8ca448-d0aa-41ed-9b32-d0ee2c8f2a79", "comment": "Malware payload (Mirai)", "value": "d05e0fea590b9d829e035042826822e0eb9b583282da71b56106ea8e7d859b87702a4614512e475674b876a2fd955f03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300102, "uuid": "d727c484-ccb0-4554-8108-93143967d0d2", "value": "T18EE3C4BFE7271E23C0C51071D2E30233A5B9D67438A9D797A9D3EC692F1A98034157EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300102, "uuid": "15745b0a-2d63-4488-8ba7-8acdb7f55b46", "value": "3072:Q7BJ7+1c5NoN9CrMTt6YCDahJIY4BAhRE5:ur0Ou3hGDahJIY4BAhRE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300102, "uuid": "5cee5911-98e6-475b-b119-b5c6effac00e", "value": 153328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300102, "uuid": "1574e059-efab-42ce-8d11-2fa7ee4afd8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300102, "uuid": "bfe41aa1-b6a3-4586-9aad-f45c7b7336a2", "value": "systemd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9c175c-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273462, "uuid": "e58c9100-af74-4ba1-bbae-c9e91d8271e7", "comment": "Malware payload", "value": "23e8ebf3f1972f3d28f7b677c36cec6f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273462, "uuid": "900ae21e-41b3-4687-a74f-e6212b73239c", "comment": "Malware payload", "value": "6ca7378dd8295d0e2306f7aafc5bd26b90115fa712d6e983727c10ade7e3e8ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273462, "uuid": "5a02b7aa-e714-4165-832f-10f1296ae6ec", "comment": "Malware payload", "value": "7ded3916fbfa593b7d3ac4862820d8e0dde4a00d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273462, "uuid": "f363f400-9b60-420e-9c7c-6cf00aff4d34", "comment": "Malware payload", "value": "1c2d08ec4dfbe56ca2d4cc6da2129a308210d8be08ea9a7e3326718d43c19a98007ba4a5558ac7381f0c906bdc8462cb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273462, "uuid": "38bddc9e-f9e2-40e5-92cf-38480e4f1d4a", "value": "T11255339A407D29844F3D0A6377EF9A1C91108AFC10420C736B6A98DB663E7DFC77499B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273462, "uuid": "2f685d8f-7131-4f57-bc43-3ae04769a2c9", "value": "24576:RyJeXoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRs:qAoZ9bq+MmMEL+hcjXHC/wnwds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273462, "uuid": "04e8e893-cfe9-4af8-a420-e886ee052157", "value": 1386736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273462, "uuid": "9a5581b7-7ead-417f-9d04-4ae8067ca3b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273462, "uuid": "0d3a6e91-1d1c-45b9-b1ec-e1320896be78", "value": "6ca7378dd8295d0e2306f7aafc5bd26b90115fa712d6e983727c10ade7e3e8ed.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efad3f3d-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274032, "uuid": "e91cb22a-3477-4eca-894e-2269100117a6", "comment": "Malware payload", "value": "0e92f7fb99055dfaa8385f4c84df374a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274032, "uuid": "801a2871-0c5e-403a-aee4-ba2430e313d1", "comment": "Malware payload", "value": "6cc05b526583b3afa6e9119dc4db11c40ccb56cb4283f48b4ec2de750c463ea2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274032, "uuid": "cd127ff3-839c-4a32-ae21-2524b6b217a8", "comment": "Malware payload", "value": "189ca92d33ebeaee4f00f36711a7167f9c98445e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274032, "uuid": "986c59e4-a605-4f8e-8837-2d2a40e5cf0b", "comment": "Malware payload", "value": "a34ec08146c89dca5a5fdb85f6c13d5355892c1ee53f2209e540c3658ca2aa36e9dfb0543a57dd7e2ee3d689721e3aea", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274032, "uuid": "f28d90c8-d4b7-4602-8c54-690761ed6c9e", "value": "T185A42397E39996EC88C47ABA8B2C0D18B27CE7745CCF07A8537E5335D1688A29E0351D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274032, "uuid": "09612d4d-97a5-491b-97ae-adc0302940e3", "value": "12288:KsS5lyFd6V+6sVXkvgSe5yPqr++rVOje+yH5e:KsgxM6sSvPiy+6eTH5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274032, "uuid": "264ce221-0c79-4f0e-8da2-0ddbe7fa421b", "value": 492541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274032, "uuid": "992237cb-0353-4051-9549-b3a09c778917", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274032, "uuid": "dd84a0fc-804d-47cb-8f13-94994a739bab", "value": "6cc05b526583b3afa6e9119dc4db11c40ccb56cb4283f48b4ec2de750c463ea2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c3731d-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271145, "uuid": "87def20b-5f00-492b-b22c-a3b1a3bd2bbf", "comment": "Malware payload", "value": "03a76950bee81a350107b6b3a5ff8f94", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271145, "uuid": "91ea4040-dcd5-43fe-8b21-ca5a831baee0", "comment": "Malware payload", "value": "6d41123563020a0d1f723523bdb4501a95277bc745ad8283ea3a75507881d872", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271145, "uuid": "726e55ca-b01e-43cf-a014-f48b830c4cc7", "comment": "Malware payload", "value": "41cbecfecb4472e416aa2a1cda4cf6af2103bd0a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271145, "uuid": "6ee00410-0570-4b2f-abeb-b2206a808b6d", "comment": "Malware payload", "value": "af6ab80f4b1458235b72a55794228f1bb9deee255abce0bab36d565c9c16e80c904a50607aec5fdff952d70e7a42b6db", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271145, "uuid": "1ade11c6-8c19-48af-bbcf-b70a3bee3538", "value": "T16231AC085FC80614D2B38E3664EBE301E9257452FD43DF6D0180528C2552151F876F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271145, "uuid": "55a55522-2e3b-426d-88ae-f8ef4b97a506", "value": "12:8N0m/3BVSXzvXxMnWj2u+fIlVlDmo0I6iNL4t2YqlWUe2ZIjdx:8NJ/BO/h+fk4o0a5/u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271145, "uuid": "55b2a8d7-6474-4563-b75a-2576e7a4f078", "value": 1520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271145, "uuid": "12e6ca7a-d340-4733-8ae0-b38633250401", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271145, "uuid": "52c3ae1b-b729-476f-bb0a-207ceaf975c6", "value": "uat.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e00b21a-c16d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791281116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281116, "uuid": "9bf9c2cf-0d58-43c8-be00-d3b859bfc28c", "comment": "Malware payload", "value": "b073966fa856bdef3727532f3a6c5824", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281116, "uuid": "51473b1d-4dad-4fdc-acbd-d4f445bc3be4", "comment": "Malware payload", "value": "6d582d395bde7d7e3b2b0859b98ccd1a7a89f4dcfc9655805b2cd517ad5e6d01", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281116, "uuid": "36cca40e-8cf9-4bdb-8933-71edcbdb2455", "comment": "Malware payload", "value": "39305c85abca827065670bff00f7ff611f750ef9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281116, "uuid": "2cfee5e4-62a7-4456-9917-1ec3687d60fd", "comment": "Malware payload", "value": "bb377615ea9e98b7c032cb703c84c8bda30379ae95827d0bcf478e677341827fceee259dd10eab392b63f43343de9856", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281116, "uuid": "d4e9a610-ea31-4505-86c8-0b7b6abd64a6", "value": "T1BEB5E057BAD8D87AEEBF8577522A4172B92F479CD00E602228B435D594E3D0D4F083EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281116, "uuid": "84fae6b0-a7ea-4b3f-87e8-c39f45cacac3", "value": "49152:rrIgvWsXyp9hKXD2evx+yHfJFmjywdcDPXMP2:rRvWsip9UxMM4TdcDPcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791281116, "uuid": "c0b5fb08-fd47-4711-a8a0-274e45757da8", "value": 2281004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791281116, "uuid": "cda3552f-e982-4427-b5ff-dd40e531abbc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281116, "uuid": "1129efcb-e468-4972-ad9f-a7f258fe5e4d", "value": "RuneLite.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd63e7c3-c144-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791263640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263640, "uuid": "043c4ea5-116e-40f5-88c8-d0531516e051", "comment": "Malware payload (ConnectWise)", "value": "8c224bd3347c99685ac39d0322fbcde5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263640, "uuid": "cd94c12e-a30b-4366-a9e1-9230e3c085d0", "comment": "Malware payload (ConnectWise)", "value": "6d6520b0cc38c74a5c62c5d7e1adec832953d11819b7f8a8867a8b96439824cd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263640, "uuid": "88da048b-eb70-442b-85f8-201b82873b58", "comment": "Malware payload (ConnectWise)", "value": "8605caec14f4f253ca727d18b74db1df680dc526", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263640, "uuid": "da89563b-c010-4b75-9298-40ea496eb3a6", "comment": "Malware payload (ConnectWise)", "value": "9c57c69677715f5a74ed19da1a357bc7efd041db6bf9cad42647c76c629aa25f330e364ce35b1e52a52444be671d134c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263640, "uuid": "6ec53f38-013b-4f80-a380-31940f50652b", "value": "T1EF836C43B5D18476E9720E3118B1D9B4593FBE210E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263640, "uuid": "b25070eb-ca5c-4030-97e3-12b2607b52c8", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263640, "uuid": "0f1cc2fa-2afa-47e1-921a-5f425e757a19", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYj70JpN:genkyfPAwiMq0RqRfbaWZJYYjwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263640, "uuid": "310a8233-b5c5-4c9c-9137-46bd34c3f2da", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263640, "uuid": "d4120bda-9fbd-487f-a7c5-faf5a943e138", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263640, "uuid": "ee51dd1c-c3ab-423e-9bbf-59c7cd861029", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38ad273-c19a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791300533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300533, "uuid": "2511c227-01b6-4472-87db-65b7db76d030", "comment": "Malware payload", "value": "0eee78035d68f8362ab74c948e9f9edb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300533, "uuid": "46d0c1bc-54dc-402b-8561-0df1e40ff777", "comment": "Malware payload", "value": "6e39245d165befa0b33984d2e4c6c6732f1a9e7a6c922122ace167d7a5830953", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300533, "uuid": "0eaaf38d-0e2f-4996-b1ff-f34d6a871952", "comment": "Malware payload", "value": "3bba8d8a56ad78152a04a3e1f12b1038072d16a5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300533, "uuid": "89eb57e9-61ad-4ada-80b4-6e839e873b8c", "comment": "Malware payload", "value": "b174ef58b6f9d8c5f9829275cc2279d70a65f71eff31494e1bdbd14464eac55680849c36a9df1e736a4ab8f62c655180", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300533, "uuid": "d5b3ba52-b4e9-46a4-8df7-f70ed7a14fa7", "value": "T183F5331A09DEEA79ED076333F092E9309F2F1741E24B24165F58C6E98952FB11F4A24F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300533, "uuid": "6df05b3e-9387-4299-a1f7-885d87ac644d", "value": "98304:/Q5eCUUCv75UHNH5v150Grjg/XsLG47ucZqLWYk4yvH:n2tHJ9fg/XsLG4EiYJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300533, "uuid": "16c50b7b-207d-4ffb-9b8f-94d9caf6a394", "value": 3415302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300533, "uuid": "2872489e-76e4-4e96-9a06-8aa99ba327e8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300533, "uuid": "f66dda88-b756-4efa-9623-04fd96f8f10f", "value": "LarpClientCracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07090484-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274501, "uuid": "67d94541-d2f9-480f-85b3-0f67ba497e35", "comment": "Malware payload", "value": "bdb70111787c9d678741321e69a1a58d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274501, "uuid": "289fd494-cc1d-4cd1-84bb-7883640e9942", "comment": "Malware payload", "value": "6e408d2a9704fb0094f7dfb681ea51df09d2c25012385917edfef904416e3dda", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274501, "uuid": "6365a3d4-e45b-409e-9931-4a30a930af61", "comment": "Malware payload", "value": "2348348853c1b33815dbb9d7d6820da1095bb872", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274501, "uuid": "8845d0c7-21ab-465d-9b96-98b54afec364", "comment": "Malware payload", "value": "25110db65efde9bdb4ba9f6c704c25c029ac07ca0dcc63ae4448ad1eb7d6cfa580d2088dc060bbee4af338e8106f7072", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274501, "uuid": "9581f073-aa01-4d6e-a8b2-6037c312b7e0", "value": "T198553387C17C18C84F3E06D7AFAF995C72288EFC100204766A6658AB253E75F87395DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274501, "uuid": "e4ce1eee-9cd6-4118-a130-6e64bce4bc43", "value": "24576:0MZioZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRY:0MZioZ9bq+MmMEL+hcjXHC/wnwdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274501, "uuid": "5f466a49-c76c-4826-92fa-73d5e1188e46", "value": 1394468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274501, "uuid": "f20f4d9d-72fd-4e8f-86ea-ee71d1c06da0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274501, "uuid": "98bd8990-3f6a-4180-916c-3a41eb1a71a3", "value": "6e408d2a9704fb0094f7dfb681ea51df09d2c25012385917edfef904416e3dda.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bd7b8f-c199-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791300104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300104, "uuid": "9d84b317-9eda-469c-ba90-b450dd40efc4", "comment": "Malware payload (Mirai)", "value": "4d606bd1c17695dda40f5d62bbdb2925", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300104, "uuid": "2ad91670-b6a4-4ce9-a6b6-b8b56c0480a5", "comment": "Malware payload (Mirai)", "value": "6e72ef0cf28fbe82cf69779c2fb5e6d4c0c9fee57598da8713f8a8997dbe5483", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300104, "uuid": "692a9725-0140-4b62-9019-c0311e4c5abf", "comment": "Malware payload (Mirai)", "value": "b64d479ec7b918d3320eab887164162f8c943ce7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300104, "uuid": "69025794-1f54-4518-a613-dc785710ca4e", "comment": "Malware payload (Mirai)", "value": "f0d60703494827da102a7a98c61dfc13f343398a8fc3f5d484e7e24730b493144b9a352635d301c99b9df412c568b06c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300104, "uuid": "c4d01506-f85f-4185-a571-84f161dccb34", "value": "T183831955B8814B12D5D512BEFE2E118E3323277CE2DE73129D206F24778B96B0E7B606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300104, "uuid": "5140b9b9-e85e-44ce-bbb0-ea7cfa050829", "value": "1536:ynnj4NLOwLiExjHoG+WTDk0DPaFg4HQ7Mnie+xmzQBD76C5sY0s/he:BlDL7jLTg0DPaFN+xmzQBDGCCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300104, "uuid": "2609a84f-8f78-4bf8-8c2b-7b4bc756f21a", "value": 83900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300104, "uuid": "0ff1ffa2-9d48-4160-acd9-ed5228489143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300104, "uuid": "c149aa00-c1e2-4402-a714-093dbb511257", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f482631c-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271034, "uuid": "2c51b6e6-17b7-4568-9094-ffc86a1bcda3", "comment": "Malware payload", "value": "8cc4d69a8526f9a9d02d413721190a79", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271034, "uuid": "47995d0f-15e7-476a-9bd9-cb7f59da6c79", "comment": "Malware payload", "value": "6e87a75ee454d71a9db687bfc1774604658b73b9427c096cd8863203d5955c84", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271034, "uuid": "af02f68d-c085-47d2-b7b4-557af047337a", "comment": "Malware payload", "value": "79914f2fd103657c5c7fe197f8e123cfa677ad56", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271034, "uuid": "83c6709a-5c06-479c-8934-9063e92a28ea", "comment": "Malware payload", "value": "19419522b85555fd3c9d6f87c908d4add9f92b258f20d308d34ed6d02316e2af3a562c3625548121a78a95052ec0075d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271034, "uuid": "3cd803fa-04ef-48aa-a145-4ed37fbf134c", "value": "T110C42304340741D5835A2B1EAEC4E6E0BEB560DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271034, "uuid": "85a4d659-2239-4fc0-b0da-c7781abdb6ba", "value": "12288:j6wlOMWROC/FTeHo22Qm7NzofOr68mUeA924EwCm:b4MQOC/gHozN7NzomW8yA9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271034, "uuid": "a573ebca-6c42-493c-b7e1-7c8c7fe7d1b0", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271034, "uuid": "b52566f1-54e2-4e9b-881d-4032a88a94e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271034, "uuid": "8a562a78-a5d1-48c6-a573-ecc6a1b2a4bc", "value": "6e87a75ee454d71a9db687bfc1774604658b73b9427c096cd8863203d5955c84.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60556cf-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275761, "uuid": "2e953c6e-bdf7-432a-bce8-24960a6b688c", "comment": "Malware payload", "value": "d078dbda22cad47d7d95f74998532453", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275761, "uuid": "76a2c6d8-b0ec-479a-ad4f-747793308db5", "comment": "Malware payload", "value": "6f00abb3dc0670d5c9cdc7af7f55b1c3386bcf5adc578c463119584e11f20d6f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275761, "uuid": "8103c72c-65fa-40db-9943-53e846f589c6", "comment": "Malware payload", "value": "ab2244000ffb855b464307f52154c434c330a0ec", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275761, "uuid": "32b93bf1-4b4f-4d5b-962d-22abeaf2cf51", "comment": "Malware payload", "value": "2703bae584bfea56bae7bc40a773531a25a769d7f02b0a936b70a5ddcd6391906088ada5dfaba07a7a6f87401e85f3ff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275761, "uuid": "afb4416c-47eb-4d52-bdbe-e410deaa265f", "value": "T1FBB4231AF4D078CFD68ACDA394291C785F6C9AC9CD126B7247C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275761, "uuid": "ac789cca-ce96-44fa-be6a-70392e38b564", "value": "12288:tTibgSMFBOBSlqrXKu7FxPbzJTVBU+8JM9hAC8Z3WVOBRkbKQDiUbpKc:UcSMFYBKkxpTKJM9mCw3WVOMWAPbp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275761, "uuid": "df55c8f8-f2a3-4faf-b358-8f28e021bd1f", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275761, "uuid": "b0d29302-62b6-4e99-a5ee-e9a39a69b81e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275761, "uuid": "46134807-8126-4fee-88a7-7cc6d3ced3bc", "value": "6f00abb3dc0670d5c9cdc7af7f55b1c3386bcf5adc578c463119584e11f20d6f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c453e13b-c154-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791270524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270524, "uuid": "16107a86-78cc-467b-9b49-367609ebca00", "comment": "Malware payload (Mirai)", "value": "46b52c1aeca9d61c7b1bf67667648431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270524, "uuid": "73a14d09-9cb8-4189-ab85-38f99c6e9026", "comment": "Malware payload (Mirai)", "value": "6f498a7cb640ee8902113e951937e1f4cf2d21743ef4fc1cdcc4426a26c7af18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270524, "uuid": "f4c90196-3767-40a6-80db-47fd5bc093ba", "comment": "Malware payload (Mirai)", "value": "18dab527c7a23ad84e8406ad603d6586cf9c8f98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270524, "uuid": "a7890acc-e763-4b46-8aec-208393bb63e1", "comment": "Malware payload (Mirai)", "value": "671b15825b68c56870a9df9f22191300644b0ec2258bc127a22c3afecaed9c66e620d82a7d765c51efbc5c160fc42713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270524, "uuid": "2524a9bd-20d1-48b7-a7f7-ecd41c32ba47", "value": "T141D3F9CEF801DEB6F50AA636C4C30A17B2B0BB750A52D62172C7F96699371D43826FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270524, "uuid": "7de31436-9e62-4e3b-8f65-d82cab6e6ecc", "value": "3072:gBlf72PGdy+fX4L7r+24+1NOsyuYjZYwD7JoYWBthL15:4f72PgyT/+291xyu8HD7JoYWBthL15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270524, "uuid": "88bf9776-8c0d-4d65-bf85-f4b83bae0469", "value": 134929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270524, "uuid": "c9247351-bbf4-40c8-abd6-0925f8b23a25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270524, "uuid": "2825a82c-820c-4af1-bb4f-badcd3b9990f", "value": "kernal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a71cc0d-c180-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791289190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289190, "uuid": "ed6c26a4-9744-45ce-b85e-b0bce4be9b7f", "comment": "Malware payload (Mirai)", "value": "d9c9c310cba85f6fc64ffc53b4e3ce01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289190, "uuid": "34045ad8-0b89-4119-89a3-ce22972fbda9", "comment": "Malware payload (Mirai)", "value": "6fb593f99acb421d91f864e01d61c65ab5c775aa92b96ca7c538785682974125", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289190, "uuid": "34fa48e0-e907-4683-8e8d-be22d75ce14d", "comment": "Malware payload (Mirai)", "value": "acb426f6485b89c6fb219425b9ea24d72f9e6954", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289190, "uuid": "e517cec3-77cf-4e74-afd5-ef343874e924", "comment": "Malware payload (Mirai)", "value": "f36277b3ed207e5daa3fd5a74d68fe7003e87cd313751675d54be6e0276d1e9c708d1de9c8e9b048db14161926bdb3c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289190, "uuid": "788069f8-02d8-4299-b6d7-2b1cdf51e22d", "value": "T1D3A3A91E6E218FBDF769C33047B78A21A39833D626E1D685E16CD6105F6038E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289190, "uuid": "932c42ac-6d6a-4448-a84d-4193e4c84b90", "value": "1536:vf4KlOjWLaCgw9c+mtJ5p5lViUH5Mzq4zeR9BLc0s/RdS9G:rlOjaaC1FCHCzq4acpGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791289190, "uuid": "19ffd9c5-cd5e-4649-b600-b48bba83433a", "value": 97744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791289190, "uuid": "1f05eb9d-d770-427b-ae4b-3fac8e4663ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289190, "uuid": "a32ec00c-94ff-4ebe-bf86-4b63db873716", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbaba3b-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270674, "uuid": "85d71b2f-8da3-4766-83e2-0eac47312265", "comment": "Malware payload", "value": "2f9535d993abe60128c16d1f6af89269", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270674, "uuid": "16fcd9ad-50a8-4112-b67a-bf811bbbc736", "comment": "Malware payload", "value": "6fc25363cbfff78a3ff588e574dd7da58e08d80de62fbc2986d5ed51724d8e7e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270674, "uuid": "94fb5008-a5dd-4a42-a88b-83fb7259cbbd", "comment": "Malware payload", "value": "b0615471ed7470bec8da97b4966d2fa893a968a3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270674, "uuid": "cb1afcd8-fef9-4750-a06a-d1de7dc852e1", "comment": "Malware payload", "value": "83fcac9f1c42fedd9395108cb7e9aace51225892ac1827dba499687a4f82fe705aea2b76885bde2b1d48ef728527a2c7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270674, "uuid": "e8a02e0b-7386-4dc4-a526-0089f6b72d4a", "value": "T13BC42367226F72500DFE92ED4E4156146D3D8E322A00A6FE55D8C9CE8719F0ECE35E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270674, "uuid": "9d39ef69-cbb8-4e0b-bb32-be885e0741c0", "value": "12288:4eCEhty9qO3g/ALyYG0ZaDajTCXMO8xzDOeQaky:PtEA/f0Za6TCXKBxld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270674, "uuid": "151a9150-357b-4ec7-8100-4e3e61d32877", "value": 546286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270674, "uuid": "0cd211ad-e8ba-409e-8c31-1c5aa4527f71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270674, "uuid": "c1913d8c-43db-4fa6-a8bc-1a1e398d3246", "value": "6fc25363cbfff78a3ff588e574dd7da58e08d80de62fbc2986d5ed51724d8e7e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e8e34a-c152-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791269432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269432, "uuid": "ff7b6de5-cf9d-41dc-bd40-d497dcc32511", "comment": "Malware payload (PureLogsStealer)", "value": "c3771e4e827f87a19e718f4e18534675", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269432, "uuid": "36d7a9dd-de61-4232-a45a-915f02e9e3d7", "comment": "Malware payload (PureLogsStealer)", "value": "701756d2d5567ee3d19b7129af0497c950578fbb065fbe53fdcace912970551a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269432, "uuid": "108fea46-28cb-49dc-a3fa-de7907531a94", "comment": "Malware payload (PureLogsStealer)", "value": "c2d2cadd4db396e64c7aef9acc155815998b0c32", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269432, "uuid": "2b057d69-b6a3-4639-baf4-c9b22dd60403", "comment": "Malware payload (PureLogsStealer)", "value": "236c27e9c0f76430eb11a920606577899a063078ab5375125654a9b749ca529d583d22ac696a7a7c3b5bd2f8e1ae4377", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269432, "uuid": "012b8ed7-ac3c-42cb-8251-c42ae626f4b0", "value": "T187651268AF85D5750D6C033A3B2B3A1106F38AF89F1DED56C91E8B96E728D41C1F8C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269432, "uuid": "948c4ec4-dd4b-48be-a370-ace4523463be", "value": "24576:I87DBK5rbKIKi4sCRo8zgAjnczS2vS6J0eI2B1qKnsx97Y+ls5x5xRBH/3SMB:5HzvDo8sk2vS627GU7YSmhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269432, "uuid": "bc8f440a-63b0-4b92-88f5-5c142ec79f5f", "value": 1512820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269432, "uuid": "78e1ec75-c1a1-4f47-92e2-a01f0a46a6f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269432, "uuid": "f048ad0d-0ce8-4253-b42d-b4f6351ea73a", "value": "Payment Reversal \u2013 Request for Clarification and Account Verification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd409b9-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275428, "uuid": "4529780e-e307-439a-9ad5-a3a252447d6b", "comment": "Malware payload", "value": "fa1428dedd686f7b69f545d56f21584e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275428, "uuid": "57ad4d32-953c-4c7d-8a71-61276cbe395d", "comment": "Malware payload", "value": "7053ddfb363f074bb9c148af99eb417d3d4cdf3dcc121d8864ace1a0a694bcf9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275428, "uuid": "0c87b642-657f-4ce5-acb6-87a17decd467", "comment": "Malware payload", "value": "dbc3009106d5e7952d2d18b645de77446e29c308", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275428, "uuid": "1bdd1292-a321-463c-b109-1f5c648d1c51", "comment": "Malware payload", "value": "c3003218ea815a77979ec6d888ad304990240535f6ec098dea27491f34f883d4d2bc598f166e23a45dec0cf465075082", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275428, "uuid": "832b55af-a8bf-4fca-92d7-fad641b685e9", "value": "T1B0C423445C187B6C3AF6A0FD2AB65D83631E1DFAF0D23DBEA43484FE1C16264A18587D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275428, "uuid": "0bfcc422-3055-4149-bedf-cb57d6a03401", "value": "12288:0b7TqKR2IkSlQXALUMF2G5SLjrlFlU7ecTUNZhmbs2sYbl7I:67fkSlQXAIMF2SSPrlFYTU3hVYbl7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275428, "uuid": "f2c9a542-ecf0-4f2b-9442-6e0ddaebd217", "value": 584990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275428, "uuid": "0c7c9d93-6305-4bb6-a306-81817ae5ed80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275428, "uuid": "dd01f33a-affe-41f7-ac3f-2de28e2574fe", "value": "7053ddfb363f074bb9c148af99eb417d3d4cdf3dcc121d8864ace1a0a694bcf9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c8eb41-c142-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791262825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262825, "uuid": "4a8da6c7-fe85-4993-8b3a-5c0e81c8da0d", "comment": "Malware payload (Mirai)", "value": "46d37ea1f617db55b02aa8f4729576c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262825, "uuid": "d8d58bf9-3ffc-46b1-ab11-d76a078a88f1", "comment": "Malware payload (Mirai)", "value": "707fc73c91ebe386a4443125a3f8a43d2523910922a46e352ce33977e59b0f2b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262825, "uuid": "b57a3d9c-f8d0-45d1-b979-e7b1a7321b79", "comment": "Malware payload (Mirai)", "value": "954a7cddbbbcc53439cf8700d596a26fde0dafb9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262825, "uuid": "88e64c6b-4341-4737-b759-3db705708e71", "comment": "Malware payload (Mirai)", "value": "9bc0768708c8cabbf4c13480618d3ffc3e2d709a808c20b8d129f18583ec25a51733519e977e667894217a5f3459b8b7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262825, "uuid": "0370fa68-cdae-46b5-a5e6-9c1b8809c79d", "value": "T156356B2AA2B2E17CD007D13057EFC6A15530B17526322D7F36C5AA313DB6DE16369B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262825, "uuid": "eed738f9-2337-46f5-8129-15ed19bbc693", "value": "12288:pxSMaafnlGS2x93AgwYM5deHzHkLNgXZLX/UELviFMVVCpDtQ6PCayTVKIAHX:7Sx8l2xBAgwYGLNgXpvUELKLpZQ6kKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262825, "uuid": "82a54729-c35f-4db2-b82a-5cac8b8f0c6a", "value": 1084792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262825, "uuid": "ed197917-14be-4324-930d-d5b5cc2dc329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262825, "uuid": "fc688bff-2bac-4fe1-94d2-7bb1dc9c4dd5", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3783fe-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273439, "uuid": "0d04902d-6c35-437b-825d-6a0a628045b3", "comment": "Malware payload", "value": "23ea504016d328127225110658f776ed", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273439, "uuid": "35154691-aa54-4c81-aaaf-48bedb01ed40", "comment": "Malware payload", "value": "70b5fe6d4feaf98e83fb38a1102cc359f480fe6625dfbe39a8dd8f1eb6496149", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273439, "uuid": "3fc78ffd-d2ef-40b7-b2f6-cb47c1da0eff", "comment": "Malware payload", "value": "0399ed216dd307c23148549d3eb912ce74d4b91f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273439, "uuid": "181c64ea-b726-4023-8456-493ce2b87dc9", "comment": "Malware payload", "value": "3971f02c6908dde3ca18b9a4c47b24f6f986533a5450bbbc9ad3299c3f5a2a60a7187bcde4fd59767069e1503e6c571c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273439, "uuid": "0427e171-9ed9-4f22-9c36-24e95ede437a", "value": "T127C42304340681D5835A2B1EAEC4E7E0BEB560DBFA1CF940AADE7ED06DE52A177C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273439, "uuid": "90933ce2-dd23-4f5f-a046-2e286fad70dd", "value": "12288:z6wlOMWROC/FTeHo22Qm7NzofOr68mIeA924EwCq:r4MQOC/gHozN7NzomW8eA91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273439, "uuid": "20be02ec-1fde-4c56-9ff5-3b38ccfeb4ad", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273439, "uuid": "a44ee6f3-8b6e-47e3-8d3e-e0a9cca905f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273439, "uuid": "873a1b1f-38dc-4adb-84e5-dce3a92b4434", "value": "70b5fe6d4feaf98e83fb38a1102cc359f480fe6625dfbe39a8dd8f1eb6496149.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516d80d0-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245849, "uuid": "715efd6c-ed2d-47c0-a205-bc5e4b79830a", "comment": "Malware payload (Mirai)", "value": "183aef7e12962074611ff76d52a1e14d", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245849, "uuid": "5d092ee7-6f40-4e6b-a292-87dcf467bbda", "comment": "Malware payload (Mirai)", "value": "70d09f7fa8adaa885f71c811ea8497b424ccd2cdd302b7a70cee9578c52e3821", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245849, "uuid": "f96c22f2-e245-4fbc-8916-4ba2d98153af", "comment": "Malware payload (Mirai)", "value": "d221ba6a5ba9d8bdb2e8e20e27192c1a0ca3bc5c", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245849, "uuid": "5fa2e29c-0170-4041-913e-ee0a35aca10e", "comment": "Malware payload (Mirai)", "value": "d7d08c00306d8a7ed07dd838cfa3aa84f757ab5afad48527247dedd9031c9d972936049f285b17c956d956d728e88515", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245849, "uuid": "1823563f-e459-4197-b44b-12bf404adcc8", "value": "T114442315EBD2CAB1C2C036F299F3D88593049E767D809034D1D6F879AFC98645BEE842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245849, "uuid": "ea6225c5-f02c-4214-bc2a-348ff01a9c9d", "value": "6144:LbdJvniFbcN7UA8aJMxNSmpgaqFQHvGh8yw7:Lb3vP7PoNSFBQPGh07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245849, "uuid": "4f35241e-3626-41ba-b858-90a64e2e0cdf", "value": 273424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245849, "uuid": "0d94b6b7-3ce6-4dfd-91c9-ec864943e65d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245849, "uuid": "6a5ef9cd-894c-480f-96d9-3d58a4a6b3d9", "value": "mbupload-6h5uzubu.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50135245-c15c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791273764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273764, "uuid": "dd0b8dd3-f9f8-4876-bfee-596580947b28", "comment": "Malware payload (Mirai)", "value": "1a80d5a991212c963f165913d35b65b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273764, "uuid": "4aea1332-c005-4b56-8602-1d4f17e2d490", "comment": "Malware payload (Mirai)", "value": "70eb0892f238355368f12814bd36aad1f8babf6be7c25a97a340ca8b86e3c1f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273764, "uuid": "6c45ada1-e671-4c56-bb83-19322bf2a091", "comment": "Malware payload (Mirai)", "value": "240cc63a0d51774b849b9bdc1a051fcc9da51b0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273764, "uuid": "37f063a5-5488-469e-ae93-9a311d782e80", "comment": "Malware payload (Mirai)", "value": "5af29e610b1e29e10486fd0682e5698cc61a9918aac64bc52c24f981a480e77e65ab5170cb06855264b6950c4fb02336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273764, "uuid": "8d5bb06c-dd86-4333-beee-ced2c4831f67", "value": "T19DC49E009E0D6831C6C5F0BE4D8E0B91736B78AC5622C3A61E37D65CCD92BA4AF79771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273764, "uuid": "bb217e98-e18d-4ec4-82c3-9fa4b22801d7", "value": "6144:NER86AZQOZ8ulvhZxiC/if38iiPGf3jnAoWGq39VQW4wShG62zwOsQmLxFTZnZYl:br3vhZxV/iZVjnA9G+9Vz4wHzb2vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273764, "uuid": "ec22bd25-d783-478e-963a-b1bea3017a17", "value": 587408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273764, "uuid": "f6f3d587-eb41-4d57-b0cb-6bfbc1ff0597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273764, "uuid": "03355957-df24-4784-9f12-c4b592711a33", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853dd9d5-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791273424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273424, "uuid": "5c8974f4-239a-4bc4-93db-d1a831f0b94d", "comment": "Malware payload (RemcosRAT)", "value": "63b8f6956f83263c19f55433523e52ca", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273424, "uuid": "e79c0da1-c13a-4c97-81c7-21b3bb066077", "comment": "Malware payload (RemcosRAT)", "value": "71000e3216530f9c6174b08dae181c16642a7dfa6021895c1db4856298d6c3f4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273424, "uuid": "d22f2394-ec3b-4c06-9722-31da1a193b50", "comment": "Malware payload (RemcosRAT)", "value": "d5af687163d462bba4f3fa85f3dc8b7aed22c397", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273424, "uuid": "4bc849e0-f7eb-4675-9b26-3f873a1a3d93", "comment": "Malware payload (RemcosRAT)", "value": "72560ce96fa8ed6496b8f8420f5c688e9a020a59f728d7c2bd4930de53fbfbb5a21835a98e1bf30009dcdb873e7098d5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273424, "uuid": "2a8f5dfc-0fb5-4591-a44c-d27b41e225ca", "value": "T111735A03277120062C7396CC7C79A57A062AEF950B7E75BB32F2458F8AD267D4BC0792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273424, "uuid": "dcdc741f-ab72-41a2-a356-934bc02c68cc", "value": "384:gIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIf:t2Z+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273424, "uuid": "ca5e4679-5901-4d1a-b576-97c0391b7197", "value": 74000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273424, "uuid": "af52a4df-8195-4741-9786-5753d6eb5c54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273424, "uuid": "1175788e-81cd-478d-92fb-fa9314b2db18", "value": "OCBC Bank_ Payment Advice.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e552a8ff-c196-11f1-927a-4201ac107004", "comment": "Malware payload (GiaPhucStealer)", "timestamp": 1791298926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298926, "uuid": "51e46b10-24cd-46fe-bef6-cb1c311972e0", "comment": "Malware payload (GiaPhucStealer)", "value": "3b9d2c4c21957d21b76e3b839f8d14d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GiaPhucStealer", "colour": "#81F8C7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298926, "uuid": "ff02ca16-61a7-4c85-859a-c6963f824a92", "comment": "Malware payload (GiaPhucStealer)", "value": "7140d529758138bc7f87f651d82f17fcd2fe3afb17c7d827e88721796778c1a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GiaPhucStealer", "colour": "#81F8C7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298926, "uuid": "b0828bae-7b54-404a-bc5c-474e6fd90792", "comment": "Malware payload (GiaPhucStealer)", "value": "080fe8940a78a482ac3e44356b991f41692194d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GiaPhucStealer", "colour": "#81F8C7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298926, "uuid": "8ed75a0b-4be5-43c4-a5fd-731db882e66d", "comment": "Malware payload (GiaPhucStealer)", "value": "20fbb6a813b84438ee7416b579ce8d1e85a4a300055b5e503731a6e5652a0e0c88d1468234064ddbf7e5ef6b51b2f04b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GiaPhucStealer", "colour": "#81F8C7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298926, "uuid": "3806c89e-b35f-4647-946a-77938cbd6fd5", "value": "T109059F4BB76C00E8D4B7D279C916A70BE7F2B8462660D74B12F48BDA2F536316E1E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298926, "uuid": "e35624d8-2438-46e8-af2e-78150787ac94", "value": "92e30f8aa2bd38e8502d22c0d890c204", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298926, "uuid": "9357320b-685d-405f-b322-96804fd31289", "value": "12288:RAd9tFMTfpehROUcCmx4wUDTc+pPETJXyKcnbgGo9+:+btSD4h8lvUxpsFXyKcEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298926, "uuid": "a7c31285-2f47-4650-9d20-10818c8ff451", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298926, "uuid": "6c1bc8e2-9691-4747-ad20-5d428ab9a2fb", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298926, "uuid": "d30ead73-51f6-44c6-83fa-d70be42a09c5", "value": "7140d529758138bc7f87f651d82f17fcd2fe3afb17c7d827e88721796778c1a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10208e4c-c19c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301145, "uuid": "24412f11-e4dc-4eda-a443-eb048f1798e0", "comment": "Malware payload", "value": "309a40fee02ec8eadb7b241c0dc4b8bd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301145, "uuid": "faf9934a-6d3a-4a3e-b40c-26e3a856fb9a", "comment": "Malware payload", "value": "714e511cb704ac38bb392c192ae789a88f26ea31cc6ec0aa2f2d5fdc09154195", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301145, "uuid": "133df4ba-fa15-4f5b-92b0-f4a11596e56c", "comment": "Malware payload", "value": "a54ab820cf3cbc5b731beee5938eb4992adfdefb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301145, "uuid": "797ea790-73c0-4e3c-89eb-e57211ad9cd5", "comment": "Malware payload", "value": "97a6091dcec81137070486cbb82bea694ab5c49345bba8f0a000a1301135531bd5f1c7c8c838d3f4c855f09c43fc67ee", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301145, "uuid": "443717e3-7a0f-440c-b0fc-c5a0a107ba76", "value": "T1E8C4022756AC4839FC2BAF3BF852CA1178BC99D5A01FB0155EB821CD8D427C11F5D3AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301145, "uuid": "217a688c-e84e-4684-9559-1d5575649036", "value": "12288:fUYStBaco56uN2eT1k9+eitxGu+TWEJZWD53v7ysznQBJ1z3y:slBLCPNE9+eoxGhL0xv7FQBJFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301145, "uuid": "467bbd09-7fbf-4d8f-b975-379e55187060", "value": 579335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301145, "uuid": "2867ac6c-7a79-4188-a23c-874bc437c63d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301145, "uuid": "7a8b2d22-5c5b-4b41-bfe9-924f09482b6b", "value": "RelogClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba146fa8-c19d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301860, "uuid": "c72b33d3-bda0-4e69-b982-6f2928e538ce", "comment": "Malware payload", "value": "035668fcb32e76b6a8e206165b9900aa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301860, "uuid": "18e7ac3a-7fb3-4117-94c6-02e2b96b299f", "comment": "Malware payload", "value": "726729278b842339396db387675ead3523317761da6d0132c4aa0a4739523f6b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301860, "uuid": "3a3f20c4-79dd-48a8-9f3b-292694dd6d8c", "comment": "Malware payload", "value": "9671e941aa817cdc3ea6443a78a9e548b466573d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301860, "uuid": "a3d54bab-2c86-44ab-b41b-5e3858a0111f", "comment": "Malware payload", "value": "010ab942e24219d39476993e00512a16e3615b0e1485e3eb68e9de214cfe0b3cbbdf2aa309d3cc33f9f8f180a3d6296f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301860, "uuid": "f149e85f-3850-49ed-b0e2-2ec4b7c7ec34", "value": "T187963392D0C6092AE423A13240D11E977E1817F5E08CA4BF6BF5C94539A6CEB2FD674F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301860, "uuid": "0ccb1659-632f-4532-a9b5-f1f7408aad1b", "value": "196608:n12WZoO/0ViT1yITfYicwJd05pYpNYIXmgQ2qogdBqlC:n127+sITfYi/LSYwS9Ngc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301860, "uuid": "10f553e2-8ff5-4069-b390-a68a1faad5a3", "value": 8790413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301860, "uuid": "cb685260-caf6-4927-a407-cf683cb07678", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301860, "uuid": "fb44ca15-9b8a-40c7-a55b-bb81b7e8ff1b", "value": "ZerioClientCracked-injected.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69101875-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273806, "uuid": "4a2abc64-dd05-45cb-a36e-168e7518e1b1", "comment": "Malware payload", "value": "1f53bb4e4ac9cdeeb000ddb257bca2a4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273806, "uuid": "29d8948f-b6dc-4920-b383-2318400d8fb6", "comment": "Malware payload", "value": "72743dc3b763e783fcfc46f5fb5ac5bff638529f54755eb3d1f023a955f83a36", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273806, "uuid": "d885798a-f60f-42f9-aceb-1a7958cc84ce", "comment": "Malware payload", "value": "cf9c5038e649bc561feb1027f900223c71a90e23", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273806, "uuid": "e8a1d4a5-1519-4e2e-be4d-8d0b43f88018", "comment": "Malware payload", "value": "8e6f49eb959f70a159505e8ca08e3cd42ad51a4b87ea39ca89860941eeeb8b1ec46b59ba125e1ba1898a1c694c163d52", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273806, "uuid": "f90177ee-d33a-4353-9961-52f75d0e0ecd", "value": "T1D1B423CD64BED0A87B658DDA9FDCBFD30CFC003A6D7526F2A51C1A13A1C400B64A958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273806, "uuid": "5a45f741-b69b-4324-9fdb-4fed18379f27", "value": "12288:jB/e4pqNFTFbEXknDoGbDDGIabs/7iiEVwYg2l3/2NyB:jBm4pgTVoGTabs/7iiWw0DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273806, "uuid": "6ce0fa67-b373-4d21-ae0b-00a025cb60e8", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273806, "uuid": "aa3c7d0b-4776-4ff5-9f16-620b085405ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273806, "uuid": "e21c5af8-a1c7-439c-814c-67136d808da5", "value": "72743dc3b763e783fcfc46f5fb5ac5bff638529f54755eb3d1f023a955f83a36.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69036698-c17c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791287550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287550, "uuid": "de769acc-49ec-4381-9049-cb57608980e6", "comment": "Malware payload", "value": "52b31e58514712c14852b04cc07cd595", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287550, "uuid": "2033ffaa-de6a-4c12-9fbb-768ff6c4f367", "comment": "Malware payload", "value": "729f917a016df231164a233c20538f4c2927af811e3fe1bc226c2eb548353a6a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287550, "uuid": "ff0442e9-d6d8-4a58-885c-92321028f9c7", "comment": "Malware payload", "value": "2442d734bfeea6f8f3142205f960219eaa9a0c54", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287550, "uuid": "982bd094-c4c0-403a-810a-195121ead775", "comment": "Malware payload", "value": "7714e8f7e8fff56e5fd286120e213be2fddac32b02878d00513144b705bef84d055eb7d86ba747a9185cab05ab2bd20c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287550, "uuid": "68737a48-f1c4-43bf-829a-f5fa5adcb88a", "value": "T181B469855922E17F5B96CA192F47AEDC2868D9EFC5C9E701B0C41A4FE0A873C94F17C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287550, "uuid": "397b102a-3101-44a4-87b7-9724df8c7f4c", "value": "6144:VSEQRoOZgSFAPH84DAMHMyBrp4Ri1y6eLp9BOgdTIj4YD7kBmXujIV0cCICqW7xQ:iuzvfu6VgdTA4e3mTl8RVFBod5Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287550, "uuid": "b954803a-f1d0-4288-b4b7-d05734b6da62", "value": 534730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287550, "uuid": "45002515-e997-422c-9c8a-a290d7db852a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287550, "uuid": "c45d3332-4f31-44fc-914e-4b61dc2a9892", "value": "app2.asar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9617b60-c148-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791265351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265351, "uuid": "74237ebf-5379-4d66-ac7a-c4a224b2652b", "comment": "Malware payload (Mirai)", "value": "f39428e918a2a717d60e0c09d38cc2a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265351, "uuid": "ef848476-f78c-4695-b2ff-77c78c5255d4", "comment": "Malware payload (Mirai)", "value": "72b32fcc25135e62c64c1f00e24043f5d073844c71cffcbb29bcf28d1ff4c62a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265351, "uuid": "7e2edc1a-cac4-42d5-8de9-65b3e3ef5c68", "comment": "Malware payload (Mirai)", "value": "e0d5ed048ad664d97d4e214d6fb8b637449284e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265351, "uuid": "cbfa58a5-f194-4dce-9666-36f10d82817f", "comment": "Malware payload (Mirai)", "value": "c178b63f4fdf558f040ba6d63fe3f176bcb2fd91a2caef077b10b04aaf0a52f71a18bfcdc70dbf7b5974831fc701a7bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265351, "uuid": "31d7b4af-09c8-4dc8-81a7-cecc8c288ec8", "value": "T196D49E98BB8D7D43D3C7F33DCB8A8671322BB5E49352D2A23501425DE5C2EA9CBB4641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265351, "uuid": "9670658e-5077-431b-a036-22bfacb19a00", "value": "12288:JTFi/mP+ezec3Z8CG65PSAWtcQa4S3ZqNizD7OnOtQvbxs5ENify:J8Jaec3XDPSAWtcQdyqoDiZHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791265351, "uuid": "58ee944e-c4ba-475f-aa96-41930720de67", "value": 651800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791265351, "uuid": "8ece47ca-1576-4309-9540-797b0ab647df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265351, "uuid": "a3cb873e-227b-4902-b082-711f8747bc8b", "value": "dissarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2291fa93-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275836, "uuid": "047687e1-0cba-471f-9b9d-8fed63e911e0", "comment": "Malware payload", "value": "f636c49f4b4686cd3463167b810eea9d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275836, "uuid": "184ff25a-f09a-40ce-ad3c-dc4d2d7602e3", "comment": "Malware payload", "value": "7329d923ef98ac5b2953807baa5b0bc37b23897b42c5c90c829e1662ccf91b99", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275836, "uuid": "0b38c8ef-9f17-473b-b3b4-111e54472e7e", "comment": "Malware payload", "value": "a875ca768bae12b55038d57a9779d63d2ca43697", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275836, "uuid": "c608dc60-2e3f-4361-a21a-a32dd7d2f973", "comment": "Malware payload", "value": "bd469c39f700f42dc353c0ecd576a538315f0a44c33f693ffeb71867721a4b80723eb13f6a56718bd2f88b9b4036224f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275836, "uuid": "53cc12b4-0073-4fad-987f-45b52bc9ddd1", "value": "T172B423A3FFF9786920C2B952C1615A4B641C79A4C40D5F987E480F4644F972EE73A38F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275836, "uuid": "6cf32e4f-e522-4de9-918b-31f7b3740ea6", "value": "12288:CIUDzTyUi+Rb8FnNy3iO6TroDiigeEP+6pFgSq6o2m:ZGzTyaVCNySHvfigeEW6pCcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275836, "uuid": "f46c2bff-aab0-4b44-b01e-c170ac04e2cc", "value": 527980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275836, "uuid": "a0796947-a73c-459f-aef6-c8be4e36ae1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275836, "uuid": "ebe2709e-133b-4bc0-a473-25c3a2a136a9", "value": "7329d923ef98ac5b2953807baa5b0bc37b23897b42c5c90c829e1662ccf91b99.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bc081e-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273670, "uuid": "b5bda9c4-6ad6-4ab4-8df0-f34e93307464", "comment": "Malware payload", "value": "1acf4ae99e668c04f087f771328b7f19", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273670, "uuid": "236ced07-cbfa-42f9-a5bc-845d155959a8", "comment": "Malware payload", "value": "734eac59daa8f401e882128b36bc02e0b3a19fda92a390a5893a67d4184800d8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273670, "uuid": "368cd1d3-8f83-41fd-a529-3c573d05159b", "comment": "Malware payload", "value": "132d9b7f7a2da2625e654d32ff945f971a3c62f9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273670, "uuid": "0c752912-0887-48e8-a3c6-ca2e737d5b55", "comment": "Malware payload", "value": "d31630661b2928ee0fbab21a031cc53ef8f26de10b1793a8b0d435360e10bf0b1b183522be5b57d3f468a9bca8534631", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273670, "uuid": "95873250-aa7d-4007-b66f-84eabff343fc", "value": "T18AC4238BA3FD845390BF1F58AA5BB48D091976F34722DC93146A3313D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273670, "uuid": "461754d8-f8b8-4f39-b34d-919e8ad72443", "value": "12288:L+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2bySH9I1P0QKw6FEw:L+QqldA/TSO713u7xnSH9IaQKH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273670, "uuid": "6de5c314-809b-477b-b039-8c8cf94d3484", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273670, "uuid": "71fad35f-ffa8-4962-b7d2-513487e604f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273670, "uuid": "c9a4e8a1-00fc-464b-83d6-6e8f6a34b78a", "value": "734eac59daa8f401e882128b36bc02e0b3a19fda92a390a5893a67d4184800d8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48818b39-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271175, "uuid": "68d0457e-daf2-417b-bf89-b6e8cf030878", "comment": "Malware payload", "value": "f685aa98d6258e290b9c4a205c7e6af8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271175, "uuid": "65b90e16-e6d7-42eb-8476-c62215c62c64", "comment": "Malware payload", "value": "739eb34a97e0459af4057083bd87a12945e7b348a980a81259529fca8b4a7cdc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271175, "uuid": "27c89cdd-8261-4de7-89d1-9a22b8f1484f", "comment": "Malware payload", "value": "476fd0c1a43b67c990e25f8c345eeedea7eac081", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271175, "uuid": "7a475bf1-8dc7-448a-890f-a0cdbe6c5b28", "comment": "Malware payload", "value": "013e14b53767875ead3a6bafa1f17c57f6a6d09a22a0b2f347d4ce55a56027aec8ac20b10c6832f88c25a239b9abb16b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271175, "uuid": "8d57d5ec-c00e-4d9d-b86e-7a53b59ef7dd", "value": "T19BC423B7179AB4897503E3E4814C6D94C9AF20D957C3436ECA1E2693F5BE247FB2009E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271175, "uuid": "d8e08792-7568-44fc-9d71-1d8480a15c1d", "value": "12288:neElNtIBB2gX3U5KA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9N3ez8:neSIBBfHMm6Jj6ESfUxZ91kmY/9HeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271175, "uuid": "03eb0a7a-a744-4ec0-9bf0-38e5c7c4d1f3", "value": 584435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271175, "uuid": "74b779ec-7f90-4bf9-8254-720c81d922a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271175, "uuid": "250dd49c-043b-4ebe-a755-2b3806948613", "value": "739eb34a97e0459af4057083bd87a12945e7b348a980a81259529fca8b4a7cdc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c505d65-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303098, "uuid": "80b5ba74-935e-4413-8477-49f9c7497fc0", "comment": "Malware payload (Mirai)", "value": "ac6521a6380c63c9c9bc57ea9fb97bca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303098, "uuid": "37e1564a-014a-45ee-a0b1-ad556ab7192f", "comment": "Malware payload (Mirai)", "value": "73f264b2e45f84651fd7a97f4231f241b0dc99a2a6bccbd2aa7acbcfaa08b0bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303098, "uuid": "0608bad1-74d8-4c3b-b161-5088540f5ddb", "comment": "Malware payload (Mirai)", "value": "f00dcdb6f25a9a0637a3467450bfaa22541754c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303098, "uuid": "1a117bde-7dee-4fe8-86b5-4323c41c8048", "comment": "Malware payload (Mirai)", "value": "eeefdff18eb927ee07dbbf0a2899ac1587899a50b6245ea998d56731ddc9c6e6a6ef2c6c95cd1b47a3693042acf239fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303098, "uuid": "2c178b9c-de94-4106-9be7-d1afd0e0d87a", "value": "T145345C4B77A08F90E275D93006F34AA79AB9129317E39545E2BDDE113E6034C6C2FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303098, "uuid": "e6ef50d1-18d6-4aca-a303-ab8976c4f810", "value": "6144:Ec4e/ON1IYZxMY6GsMMZf0TsyfHJLXDX6/OM8+:EVeCIYZNmas6XDK2M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303098, "uuid": "c5697c2a-7a1b-48b6-84c9-168639ff4e59", "value": 241208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303098, "uuid": "a3d3ea83-2cd0-4dba-a4df-5fe938241016", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303098, "uuid": "d4f05bdb-b66f-4c85-a6d8-2d674037bf81", "value": "flutter.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2b8bb5-c186-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791292064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292064, "uuid": "1fa6f60c-f874-46f8-bfb2-c6c4a9cb6394", "comment": "Malware payload", "value": "ff0470d6bc70c0858612c126e118986b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292064, "uuid": "b9562751-af1c-4af9-a62a-ede325270655", "comment": "Malware payload", "value": "741e3672ea733fcc561f6b9aa1570d9daaa444dbf05599f256eae08433540161", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292064, "uuid": "dd663f67-0db4-4f9a-910d-6971e9e1398e", "comment": "Malware payload", "value": "ba03da5222d314f09aa3e0c9f1f1c3b838e8e831", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292064, "uuid": "7a8af9ea-e08f-417e-8824-14735d2c3c6d", "comment": "Malware payload", "value": "87d99008d5d951a601055bc54617aba4040366ed79029e2037f1de050437bd8740a4915086dc8054047729366504a0cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292064, "uuid": "be0c73fb-1478-439b-a245-f0d45f7c419a", "value": "T19562687721F08B339B9055C4A2771BA14FB2961B456720B8F4FE1A259F5AA0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292064, "uuid": "ac243a2f-59fc-474b-bbc1-bd3076a4fc89", "value": "192:cCu34hvZ5m5FG4j4HKNphvUh6/lxuFtRd+e:c4hvZ5m5FGGoKNphvUA/lxuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791292064, "uuid": "c19a8605-bd40-4cc3-948b-644506ac3d5e", "value": 15831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791292064, "uuid": "df6a5181-2009-44ad-8363-306f36ed5474", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292064, "uuid": "037ff85b-14e7-40ea-b3a3-53850acd4b71", "value": "741e3672ea733fcc561f6b9aa1570d9daaa444dbf05599f256eae08433540161.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b16598-c146-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791264318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264318, "uuid": "f42e5a47-7b2c-422c-b6f6-f359abed06c2", "comment": "Malware payload", "value": "5887d9d7aefe645297fa1835e8195d7c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264318, "uuid": "5e861514-2c79-4117-84f6-4d55994c403a", "comment": "Malware payload", "value": "745d5630e55280ba4c78b4fdd6df8ff840bd8dc73dc60854f59a58fb283a4ab5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264318, "uuid": "75619f67-d439-4715-bdc9-bcdea48a94d1", "comment": "Malware payload", "value": "29497c6717b3edb066a9467bdf8aa517965e0958", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264318, "uuid": "e3de1b09-68ad-4063-a010-2761804e2e0f", "comment": "Malware payload", "value": "7dbf856718c185591dad42c77e678a4bdf3c434ac71ad0b4d0895bfe5b0f3663af01f3f2db81561a75958f7699716984", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264318, "uuid": "5498685f-669e-444f-bb93-fa03717e1249", "value": "T163753303995CF813FCB34374878D63EA8AC9705A4D859A7B5E7552218C9FFC40E2C5BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264318, "uuid": "94823cb2-47a8-43e2-911f-e1b2b7023768", "value": "49152:W/uV8uMIwZ4U/Zs3BNX0W4IArpdgqx53oW/z:W/vuMuU/Zs3BNX0WVAbgYuYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264318, "uuid": "1458b7c3-e61f-41ce-8494-ed54ba3283bf", "value": 1584657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264318, "uuid": "a930f837-0f2f-4da7-9aaf-c8d29b095bb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264318, "uuid": "3fa28a5d-667e-4d67-a9be-2ea0eb66bb92", "value": "745d5630e55280ba.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258fa3a3-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270687, "uuid": "d920db36-ddc2-41df-ab73-599c1133aaf6", "comment": "Malware payload", "value": "232c09fad48b296723ebea09ddd90f37", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270687, "uuid": "bde34144-0076-4726-a9fd-736bf7924e9c", "comment": "Malware payload", "value": "745f79f54065285a599c52be31c0ace5470b04e7967e57e9e8af7f6dcbd291c7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270687, "uuid": "2da655e7-4c37-44c8-916d-6a047d241b9a", "comment": "Malware payload", "value": "18635d4df721bd92b18426607d6afeb6bf7366f8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270687, "uuid": "6bc258e8-e798-4f24-923b-8ab6b7150bb4", "comment": "Malware payload", "value": "eff2d497244a3fc6050d0af76c71fb74467660ddb7e802dac8e04dd42677371e1b6093a82be3b10dc93b3deceb7ca7e1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270687, "uuid": "e4adc1e3-e658-498c-8835-85e528469236", "value": "T14DB423CCB6C788CC55A63134E6A20B4194DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270687, "uuid": "792a9ced-16c3-432f-aadb-e92bf3389cce", "value": "12288:5wsK8MG1KnyC/G76u6M0gXar5qdutct2ien3P+bex:nKGcGmuwjFQen3Pwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270687, "uuid": "d180d345-14cf-4bb9-84b1-ef4368768a72", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270687, "uuid": "16c96a28-9271-4f37-9f66-b1eb5a7eeb30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270687, "uuid": "ff360fe0-1e4b-4a3c-b403-c46108553e59", "value": "745f79f54065285a599c52be31c0ace5470b04e7967e57e9e8af7f6dcbd291c7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b28b2fe-c1de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791329537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791329537, "uuid": "f92894a6-fc5d-4bf7-94b8-ab52f53d07c7", "comment": "Malware payload (Mirai)", "value": "7b7004cef67ccbca7eabc2f5f1d3eb1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791329537, "uuid": "3a53a80e-f3ab-4f82-aa15-df8f5e259553", "comment": "Malware payload (Mirai)", "value": "74f3d4e41fcb7a41eb5a9e6a768d25f647073d750e6d2af600a4e9e3c9de10e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791329537, "uuid": "008cc86f-e2db-432f-b42a-737f0c7659dc", "comment": "Malware payload (Mirai)", "value": "bff5d7d5bf6ff5e46e2ac58480cf36f6171c38d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791329537, "uuid": "32beca88-80fc-46e9-9a7c-7454b55b23f4", "comment": "Malware payload (Mirai)", "value": "37ee277717f0aca0df6851d22ecdd8e1def9fd95f4ff829759100c88dad1f3596ed9cd9bf3620c320d8d285627c825e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791329537, "uuid": "4686fcca-e336-43a2-b224-bf5ec8157b6a", "value": "T1CE358D1AB2F3F6BCD007C03097DFC6A24531F0756A312D7B26C49A392EA6DE51369B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791329537, "uuid": "7a423e4f-eeed-4eb9-8710-106b412679b6", "value": "24576:+9TKE4ICUYygUvpgbENg916rThFr7MJlePHauQ4fWo1:fbENg91sX7MS7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791329537, "uuid": "3593e068-c908-4e20-aab1-6de8f3b6f1c4", "value": 1090592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791329537, "uuid": "18582634-195f-4709-ac0b-c4739128b37c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791329537, "uuid": "83eeb014-ec9b-417e-9290-33c5a70b10bf", "value": "74f3d4e41fcb7a41eb5a9e6a768d25f647073d750e6d2af600a4e9e3c9de10e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e89bb4c-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275587, "uuid": "058e6c50-1b3a-4026-8757-ef1644d0de6e", "comment": "Malware payload", "value": "7fff22381a34f510b19a86e923f79266", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275587, "uuid": "6d2c0995-2f4f-433f-936e-8621b8650535", "comment": "Malware payload", "value": "7545c444bb6a1c5f9a209200eaba953bac07e21905b28ecb302b1d48402967f6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275587, "uuid": "9acfd259-50f1-4213-ae9b-135686d904ca", "comment": "Malware payload", "value": "d3e1273b10e82aedcd179b0c97f54ee919797c5b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275587, "uuid": "f0dfd0c6-0a00-405a-8caa-f797a599b0b7", "comment": "Malware payload", "value": "a9ea1c7e71eac52a9f63bc736c39021c9453b90d08a115bcd12e853f690823b1a049d8295f60a71f999f5030fa666cc7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275587, "uuid": "8c11c468-fb98-41d8-8a41-12ab0ca878f8", "value": "T162A4235CA9511D32FC777AD03C2D9F020F28E547B5D98ABB891B3A904C7EC2862D52DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275587, "uuid": "c3a5d701-4dcf-4a48-81a0-5f7cccc78d89", "value": "6144:Ge9ZfnUXRCvHWUEDH3s/bTeY4k2k7Xa5ozFYJHd3XcEqFN9KAK4Jmn+VJFNZ+0+h:Ge9Z/U30/dzYfcEaN9B/Jm0LU0gM7aQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275587, "uuid": "2a3c10b2-72f2-4826-bba9-c6a27501f7d8", "value": 466717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275587, "uuid": "5f78752f-3d40-4253-b5cd-020eb2545433", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275587, "uuid": "95e776a1-ec37-4858-912c-b4c5b4802403", "value": "7545c444bb6a1c5f9a209200eaba953bac07e21905b28ecb302b1d48402967f6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d3374b-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276074, "uuid": "68be54a5-e558-461f-8735-f8ab4fd81d63", "comment": "Malware payload", "value": "aeac487dda002a40e7b75847e411bdb9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276074, "uuid": "1e8e8b79-7add-498d-ac46-7b91311fefed", "comment": "Malware payload", "value": "756bca4d38dbf5db8a81018033834caac7b7c7484d3d6b76f1a782f94db1344b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276074, "uuid": "2e60d9cb-6053-48f2-896b-ffbdab40953b", "comment": "Malware payload", "value": "8f5b47c75e704149bb09f4dff58f782f77e17d0c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276074, "uuid": "75a6c6a0-86a9-4d5d-a33c-6e1ea4919e19", "comment": "Malware payload", "value": "265cf09a4b75f3d00a2d5b79f269b5f1e4277e6d76ed83df15a0620c5c0c2fdf7450b26ef063f3f9839a9f1676923d0e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276074, "uuid": "e10b18cd-2f39-4ec1-b498-126c30077dd3", "value": "T1B8553386813D28C48F7D0AA3A77F895C72294EFC20030C675F2645976A3E7CF867599B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276074, "uuid": "474fa50e-87a8-4068-9cc5-55d61aa63eac", "value": "24576:hoYx+WoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR9:VIWoZ9bq+MmMEL+hcjXHC/wnwd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276074, "uuid": "aeec91f8-1301-4737-845b-a28922f1a0d8", "value": 1394698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276074, "uuid": "41cc6db3-a32d-4e1d-89a4-a72d1196cfc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276074, "uuid": "cf1371e2-df81-4114-8065-508138dc1b43", "value": "756bca4d38dbf5db8a81018033834caac7b7c7484d3d6b76f1a782f94db1344b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3676d85-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274441, "uuid": "e6799f4e-9bc8-48e5-8a93-cac808750a3f", "comment": "Malware payload", "value": "4512c46def2d1d3f72085473b5c2478f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274441, "uuid": "3f838f00-95a1-44d1-89d6-0b473334ee4d", "comment": "Malware payload", "value": "757e7c813a71d08ca3bbad29bdbadbf4758613995ad2e21a946b6cd0e2177b11", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274441, "uuid": "68ca7da1-31e5-4ebb-b44a-9e0314520417", "comment": "Malware payload", "value": "38fed3a098e75ee4f289eb1103df04fd04418cc0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274441, "uuid": "e6966f48-5f4c-4a7c-8116-7d217931fe99", "comment": "Malware payload", "value": "4fbeb1c11ce330aa2444f95a3a29f2d7234dc5ea5ad50ff458fbb90f3a1a66b0ae27ba472b616d649e36916ddfffd85f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274441, "uuid": "e2ce40b8-1225-4a8e-8372-cb976f64f358", "value": "T1ABB423CCB6CB88CC55A63134E6A20B4154DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274441, "uuid": "936d02e6-6bbc-43d7-9080-6834a8855247", "value": "12288:XwsK8MG1KnyC/G76u6M0gXar5qduJct2ien3P+bef:lKGcGmuwjBQen3Pwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274441, "uuid": "b5182ddd-420c-49e3-b9be-8f8b00445133", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274441, "uuid": "d14543fe-2c66-4b95-b735-421f105482c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274441, "uuid": "bc75e702-ee4b-44f0-a117-ce00f5d9ace7", "value": "757e7c813a71d08ca3bbad29bdbadbf4758613995ad2e21a946b6cd0e2177b11.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3407ff3-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275622, "uuid": "05385b85-04cc-4863-b813-c354bc76e64d", "comment": "Malware payload", "value": "508ce6f1d144baed0ca2fe2539178e66", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275622, "uuid": "4f9a9630-56e6-479e-b332-c17ca92f5ba8", "comment": "Malware payload", "value": "75938aa62b5d148609c501884c52981ff6a62e967120651c0ed706adb0694c95", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275622, "uuid": "77ceae80-e8d6-4927-9820-2e5bb7257728", "comment": "Malware payload", "value": "4edbed4085e3ec22f4d1f9b1b47c2c91f59e0dfb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275622, "uuid": "a887eac0-511c-40bf-aebe-736865a1b1a6", "comment": "Malware payload", "value": "05845900c9ba5e6601126e1045ed2c6313944a8c5ce2e1d5bba34cd8f4966259a1bf8aa49c27f05cfb2a55ee56a6022e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275622, "uuid": "b0801ffd-c7be-4028-b90e-0c78d1872c61", "value": "T1CBA42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275622, "uuid": "b22bcb23-67da-4a5f-8f77-c648c25d04b8", "value": "12288:ASCDe0U+m1V6ECbniSPfS3e2R3feeintFckfTsuC8hHd:ADe0wUTiSWzeeiLsP8dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275622, "uuid": "5854e48f-89c2-41c3-b7ab-6013c3808272", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275622, "uuid": "1ff7e3cb-06fa-4c0f-a991-0b4f2232f77a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275622, "uuid": "e9cec88c-4847-49a3-8853-0cdaf978d54e", "value": "75938aa62b5d148609c501884c52981ff6a62e967120651c0ed706adb0694c95.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070ac7cc-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273212, "uuid": "9f9a2178-56bc-4ed9-8ed7-8349e77d1461", "comment": "Malware payload", "value": "4286c8a8a9bf38cd4194bcc42b3551ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273212, "uuid": "5d4a7392-84bc-423f-be34-d31fd6a0a512", "comment": "Malware payload", "value": "759a0feb4c3c408808d60e02c604b33765397a5332c00d8f9e16b5086941382b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273212, "uuid": "5830ed67-b3b4-49a7-8a1e-7fddd3941e48", "comment": "Malware payload", "value": "5be26054f0a194825a0ed009135a6ffb1243b46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273212, "uuid": "f74a8d7a-f86a-4f33-a2d7-a9426634ed55", "comment": "Malware payload", "value": "1d3763b05897677fe85e1670b7375b9e5b67b3b9a175a708f30030934fbdc84d65825fdcd1e23f1d54891a1bc94a0bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273212, "uuid": "497caf20-f1fd-4bfd-b0ce-fe57d31072a3", "value": "T1A3254D3213C94FFEF046903DBA0E4216EE61ECA126F656773F6F48619AC07816AF6D50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273212, "uuid": "457e4ec4-1873-4519-8930-ac9b517fe6d9", "value": "82878c8e2b9dcdf3bfa2bd03db333a40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273212, "uuid": "12ad940e-8fd1-4f78-879d-12a636d05590", "value": "24576:0ihbZNj2EyJAvhLQGCE938OeQg0PVwrlXqu:0ih2CLFB4Ysdqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273212, "uuid": "2653035e-0fc1-4eda-a636-c64e92b0d9f5", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273212, "uuid": "42d5b565-c53b-4100-8167-7d46fc8aefe9", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273212, "uuid": "cbaaff0d-25d5-4ec9-8bab-cfc2ae2ac724", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b51da5-c19f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791302636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302636, "uuid": "5a8a57e0-dc36-407e-919c-1a617f18aac1", "comment": "Malware payload (Mirai)", "value": "caa810383324fd92cceacc398645dad2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302636, "uuid": "a03a5073-0b44-4177-8777-ad9216a12982", "comment": "Malware payload (Mirai)", "value": "75f9e3dcd0c7944466e5447d8540b90e256e7e92f3302b43b90db56db8d99cdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302636, "uuid": "54bf12d7-ea9c-4926-a0b4-e4c6f8d9ab34", "comment": "Malware payload (Mirai)", "value": "418cb20d7e3d6e0f78adbfb036104044fc2b1d48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302636, "uuid": "d43e2184-4aaa-4343-a1e7-5601e2cad14a", "comment": "Malware payload (Mirai)", "value": "be5fc8e466b699104f15aa6ccd8b7326a096cc38c4a917f52fa2d9bd24cb42bd6e06d6b1a5e1147110acdeb0fc075120", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302636, "uuid": "abbd8732-4c88-45af-82a5-b1b32c7d5255", "value": "T17803D0BFB505B98BCA5C6C7D119C47A54DCB64C4B7AA8B9D23520C8B393508FBC2987C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302636, "uuid": "922d42bd-cc47-45aa-9250-2c2ebf1b37d9", "value": "768:1RmDWoEuE87oL6NS5Mr7lEVWaj0OCwdugsNIDfVaPRPhA5eRWD:IEpkoTMVEYI0OCtgvDNapPhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791302636, "uuid": "17c0ff60-528a-4334-988a-062a680df5bb", "value": 38576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791302636, "uuid": "b9fe5ddc-1bb9-4238-8aac-39b1921361e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302636, "uuid": "94b58c5d-5257-4992-af75-5e89a7385687", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325aa945-c153-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791269849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269849, "uuid": "c022de06-5430-482a-be30-ce512307b8a2", "comment": "Malware payload (Mirai)", "value": "2a8101f09fedb58908227b57359ae554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269849, "uuid": "b5dce74e-f912-4d37-8c2a-e2a0ac7cc3a4", "comment": "Malware payload (Mirai)", "value": "76084e03973916864de9dec256d45cd25c9c0dcb0fb4b8423c9c7ee00a85e123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269849, "uuid": "fd6e9b53-71c3-4020-9f68-292d90393f89", "comment": "Malware payload (Mirai)", "value": "72772c2be6289fc2a1d0270a3fb6482688562c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269849, "uuid": "364482b9-7b9b-47ef-b8e7-45a9a629df98", "comment": "Malware payload (Mirai)", "value": "f0ee601fc9f6789aba8061f08f9357e269661ceb5b152b908bbc7912a490051ad9ecffeb9c9b371df8b18404c9256d9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269849, "uuid": "b7cdaf10-3b82-4670-8c34-0562d39b8c6c", "value": "T1AA0474ADEBA19EB7D80ECD3385994503108C957A12D9AB6FB2F6C518E387C4E08D3DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269849, "uuid": "9ac4bc4e-d91d-4409-8f15-ec23a71d0d5d", "value": "3072:CXO/Ar3n2QGu3kiVqLiNADKpSIeZ8tjTl5:WbrGQGWR0LieDKpSIeZ8tjTl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269849, "uuid": "6c73c61b-f467-4a77-87e9-de60b5a9b876", "value": 181798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269849, "uuid": "1d1be76a-00cf-43a8-8f12-704ebd1466d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269849, "uuid": "5fba7926-d031-4825-95ba-b9dfef5e519e", "value": "ntp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b0893e-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275175, "uuid": "19017341-f5b4-435d-8457-a3b8f003735e", "comment": "Malware payload", "value": "4486b2a71356d2c028726498f0ef4137", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275175, "uuid": "d763243a-55b4-4992-a9f0-3e0d67fd91d8", "comment": "Malware payload", "value": "767914b4270f03725a5db2820b902ce44e7a7d904151d4d652de647680e20848", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275175, "uuid": "7a40b634-6ed1-4bfc-b019-914ae75f108f", "comment": "Malware payload", "value": "f3d4bc805ab6c98162fae8d6615cfff6fe80d7c0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275175, "uuid": "797d6b80-8b3d-4da3-97dd-0abc4c36a7bd", "comment": "Malware payload", "value": "39d37882248cc630393a99b6609bab7ec793d61ffd42201fba88d7d5e67166e008b6f21bd5c31f87d228ce5af554ed5e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275175, "uuid": "8b0a5bf2-ff98-42a9-8a93-293fb4aea06d", "value": "T13E553387C17C18C44F3F06D7ABAF996C72288EFC100204766A6618AB253E75F87795DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275175, "uuid": "07337138-0a90-4166-a2bf-1477713a9d9e", "value": "24576:jMZyoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR7:jMZyoZ9bq+MmMEL+hcjXHC/wnwd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275175, "uuid": "057721ef-36cc-4744-8912-4ca339bc8d8a", "value": 1394468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275175, "uuid": "3c1af697-9cf0-45a8-bb93-7d11ff98f33b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275175, "uuid": "29e1c0c1-620f-4387-9654-a1a3db9f28a4", "value": "767914b4270f03725a5db2820b902ce44e7a7d904151d4d652de647680e20848.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f715f90-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273414, "uuid": "55ba39eb-7838-4c26-948e-f19183a3bf5f", "comment": "Malware payload", "value": "3dc564d2c1a1800134655e21b57ad764", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273414, "uuid": "3b35c6f8-b9ec-476b-86b1-52aed754a750", "comment": "Malware payload", "value": "7748dad53783d305ee2a8efd68fd39bbd478174c8140664d73019f21f029152f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273414, "uuid": "b53006be-906e-430a-9044-ae2e0dce88fb", "comment": "Malware payload", "value": "a43bffbca4024c4a5c969351b0c2b978f6b5c162", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273414, "uuid": "3db777f5-e914-4947-980a-2ff428ba2a80", "comment": "Malware payload", "value": "5be93f51b6d20f747fa7474120969825ef8619081fe7abbdebd5cb487f2a36897d77b3069a605d90f938372a62462198", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273414, "uuid": "4c8e170c-6f84-4d95-a39c-ef82508702e5", "value": "T1C8A423EC4DA10A22AC6BB604690C5F430B65D44F3BDD8DE91A0F3EA4CAD7C544AD92ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273414, "uuid": "d55a313f-bf81-419b-952f-6131ef4a1fd6", "value": "12288:ozYfcEaN9B/Jm0LU0gM7aQ8SDbvyiXKkFfaKz:3fclN9BhmSHHaCKkxaKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273414, "uuid": "90be2591-0928-47af-8417-71382e822d8a", "value": 462519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273414, "uuid": "ae7a8e43-42b2-4ccb-ad65-529bfe8c055a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273414, "uuid": "243e26bf-261f-42cd-bdee-f49548fd710f", "value": "7748dad53783d305ee2a8efd68fd39bbd478174c8140664d73019f21f029152f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3063751-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274763, "uuid": "084b277e-f550-4e48-9213-f7cbe232100c", "comment": "Malware payload", "value": "2469ee73257bd5cb873b70f6c89329ad", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274763, "uuid": "dec3d98c-6f31-4f8e-9230-608819aada5c", "comment": "Malware payload", "value": "778de101611b043423043dd64cb606c8596f6752321c9a7ba401155db65c67aa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274763, "uuid": "b7409952-5501-454d-bb07-7fbb71886e81", "comment": "Malware payload", "value": "06556535950559158c810dabca5ad4b5fbd83d5e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274763, "uuid": "693ecbb4-5c0c-4afa-8a76-14629ca2f7d8", "comment": "Malware payload", "value": "fc46fd7e9573149f95abc08254ef06f0e75cd25a5bc4bd13a5e8f5ea88aec83d193d3a549fdd11cc2354e6859ab5a022", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274763, "uuid": "78400e58-5f05-4a8f-acf5-f6c3d3b47a9b", "value": "T1F8C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274763, "uuid": "3949159e-7f65-47cd-9d48-dd1e3879c321", "value": "12288:D+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2bySH9I1P0QKw6FEc:D+QqldA/TSO713u7xnSH9IaQKHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274763, "uuid": "f3239192-bdb9-4551-ba30-9c3d9e3c55c9", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274763, "uuid": "2539976a-dab0-4d84-ab58-40e3151b0bc8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274763, "uuid": "d470d971-b55f-4452-a236-85ed27bbf0ec", "value": "778de101611b043423043dd64cb606c8596f6752321c9a7ba401155db65c67aa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faece68e-c143-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263314, "uuid": "5a16ebbd-a445-4aa6-9941-1716e03d1625", "comment": "Malware payload (Mirai)", "value": "0146414eaf2187529debb4266eae3b5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263314, "uuid": "d5dcc260-b733-4b84-9d86-366f9d8eb8d1", "comment": "Malware payload (Mirai)", "value": "77fc6f910dd038d6130155905536e42f01febf66977781551740ec28c49a99c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263314, "uuid": "d801eb73-ef2e-47ba-b00c-c354f5fc29cc", "comment": "Malware payload (Mirai)", "value": "14e34752da3bd82a1a4a8de363e349439948baae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263314, "uuid": "a0dfd44b-c859-47d9-8b5f-65f6578096cc", "comment": "Malware payload (Mirai)", "value": "12239cf78d3d55b3a416714c78447440909ed938e097853a56bf98bcc5804a51c707c9dca082b6e23b66228a0ca3e139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263314, "uuid": "436c684d-2c55-45d9-b711-1f38bd08b23c", "value": "T10AC42966B8418B81D5C16ABEFF5E834933131F38E2DE72029D186F74A7D789A0F3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263314, "uuid": "def7a8be-8059-4040-ae15-d5a774bbc47d", "value": "12288:dz4DdmQfarFj0vqRXbfHFkM4AKQmfjG3DrWfrDwDayd07CCR:dzUjsQS+2qGXqcO7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263314, "uuid": "50568e26-0310-4f7e-9fba-aee898370330", "value": 591104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263314, "uuid": "ec9635be-43c8-4aca-8751-bddfd4e152b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263314, "uuid": "5450801b-5c11-47d7-9812-4b8756936047", "value": "eclipse.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17d884a-c119-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245152, "uuid": "4d0eea6d-39dc-4c01-a4b2-9dea1058d4df", "comment": "Malware payload (Mirai)", "value": "be00f152834ba1e86bb314c28e703c06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245152, "uuid": "7ad740c7-cf01-440b-99fd-4f39b59680fc", "comment": "Malware payload (Mirai)", "value": "784f7756a00a56e12c5ff47cfad8eb1e076a826f0ed9e16ff099e74fa60b7613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245152, "uuid": "8144ea2b-28aa-4a86-8905-c268827db8fe", "comment": "Malware payload (Mirai)", "value": "7dec4bc1168e1915b86ddb59693993a7d635099d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245152, "uuid": "830d2ecc-7b71-48a4-8e01-90d598da78c5", "comment": "Malware payload (Mirai)", "value": "ec8070063ce10a6d8899346548b2f7c97dec4c6a005b3565e6e1d6a8f98bcd30523f5921f336efcfb53b090cbc1d2ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245152, "uuid": "235aa88b-94e3-45c3-b17b-caabc1f36efe", "value": "T15BA42966FD41D991C0E42ABEFB5EC2C833030379C3EA71029D1687256DDF69A4F3AA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245152, "uuid": "67fef589-a90d-4b42-9a4c-6fa8be3f6cff", "value": "12288:33I4+5XWjxFp3KfAaqQIuZ7zWkzOVA7KLhTb6ja:IX6bSO6WhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245152, "uuid": "f2e5bc73-5c2d-4ded-9102-859cdb689000", "value": 457428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245152, "uuid": "f6e03c15-50fe-4b11-a301-ac2532ebc05e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245152, "uuid": "2d01c22d-6162-46b5-8272-da3f0a62f0b6", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a099b938-c194-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791297951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297951, "uuid": "46ce700a-b48c-4f8f-8dcb-2718a6d4fe07", "comment": "Malware payload (Mirai)", "value": "1e0c335d39aa7d0623a42d9842522ecf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297951, "uuid": "5585cf84-64ec-4f70-907a-056d292c855b", "comment": "Malware payload (Mirai)", "value": "7866ad59809384101096a5d91740248baf98922d89c9c91c7dd1d43d85d69838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297951, "uuid": "b47980c4-264e-4e1b-a42b-646cd1565054", "comment": "Malware payload (Mirai)", "value": "f69724ff80798a75355682e55e9e766d2800a214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297951, "uuid": "5bb243f9-e26f-4b82-bb8d-ee63e11283de", "comment": "Malware payload (Mirai)", "value": "0374c39ee3aef69842cc6ce840e026a5d77fa4fd74b88bc8b37bd74692dac7c68a3bcad8474e2bbeb902824ea94be191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297951, "uuid": "c0bfa9ca-a004-4af2-9ba5-aed2552278bf", "value": "T1C783189179929E6EC7C153BFFA9F5288332573D8C3CF3252C8200EA036DD65E59236A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297951, "uuid": "dcefc62b-1bbd-45f2-ad87-5693785c787e", "value": "1536:oLei+UuK2fMBcGoAElkw9xvyQ3+jcaaymlQNsrw25lHPjc5lEG:oai+UuK2fMucElLv/3+QR+Srn/PvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791297951, "uuid": "5f040515-2521-45fb-828c-ad93b14f91aa", "value": 81456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791297951, "uuid": "894a41aa-c262-4df0-8d49-194d6eb4bcd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297951, "uuid": "622e9738-a118-413d-80e9-b31b67a10cca", "value": "vcimanagement.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8d85fb-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276388, "uuid": "cb24eb0e-f14b-4736-b0f0-e232e59ceb16", "comment": "Malware payload", "value": "679dbe52e34e1dcaa3907444a91596b7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276388, "uuid": "b42301f5-cb13-429d-89db-ed4fbe1e0d05", "comment": "Malware payload", "value": "7891d93044b17f4469ef593ff0aea3af5dc12f0b1d60d20cc55c84045f82a1e3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276388, "uuid": "e83eabfc-29cb-4291-a8d1-f6ce3595bb4b", "comment": "Malware payload", "value": "70a4cd0a6f8408bf5e15ab9e108e0a71bcb0c5e5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276388, "uuid": "f2cefd70-4912-44f8-85ba-c4376532269e", "comment": "Malware payload", "value": "5cc2d0dfd7ae37e6e84c98da626029f43eec6d0fb640a33dab903eb77a8ffd79cc022b16f987d27396a15829ed3f9b71", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276388, "uuid": "48e10440-4a84-468c-92c8-839c6f01e7cd", "value": "T1B2A423AC26D11A352CD7B294B9153F870770E71F37ECCAEBA60B39C46AADC30054664E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276388, "uuid": "55ba4aaa-94c3-4947-9b5a-5d3b584a2856", "value": "12288:oJAjNngJOP9zYfcEaN9B/Jm0LU0gM7aQv:o+VgQ6fclN9BhmSHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276388, "uuid": "71967244-4f8f-4e7c-852a-f9e50ebcaa10", "value": 467513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276388, "uuid": "b1fec6bd-5a2e-4e19-8442-55faf8aef7cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276388, "uuid": "c0003f05-0599-4fb3-a64f-378a2090e838", "value": "7891d93044b17f4469ef593ff0aea3af5dc12f0b1d60d20cc55c84045f82a1e3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d4e9f2-c17f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288892, "uuid": "7529f39d-3c9d-498d-a3c5-44caecb8840f", "comment": "Malware payload (Mirai)", "value": "1e8f30cf7225f3a4b9c9d37758e4a182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288892, "uuid": "4a1569ee-5a24-45c4-84b3-26dfbb70e517", "comment": "Malware payload (Mirai)", "value": "78929488ab794c9be320203be616b029de6ce635ab15eaf99c0908acf41cca3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288892, "uuid": "49384cd8-c052-468f-bf4e-58e219b5f1b5", "comment": "Malware payload (Mirai)", "value": "8947f427a5874f71c4e37d17d7292babacf75a83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288892, "uuid": "3499abca-4a72-4dad-ac67-d3d79a5ed9a2", "comment": "Malware payload (Mirai)", "value": "fa2ba68bc1f0b7e70dcd70d3dc577bce950d5f7ead0af04e34e0add78460fc4dcc11433eff2ff592984e19a2a78b7ece", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288892, "uuid": "67ea7d56-ac68-4b82-99be-65bb4b5d88b6", "value": "T1C7538D75D15DAEA8C0414AB4A9198E704F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288892, "uuid": "07186154-07c4-40d0-85cf-15cea9becd56", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288892, "uuid": "d8e453f9-8832-454f-b094-3db1d0568318", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288892, "uuid": "212f13a8-a38d-4a94-968b-fa3e860ace5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288892, "uuid": "b1cbc539-c8ee-4463-a1e6-afbf290c0cfe", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625efc0a-c182-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290116, "uuid": "1c74db93-ef1d-4f01-afe4-e41a5f436542", "comment": "Malware payload (Mirai)", "value": "cff4e16d89f458b18a27732531042983", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290116, "uuid": "876c09a9-5b06-41ef-8df0-ff0768777802", "comment": "Malware payload (Mirai)", "value": "78bd5a342734efbb8c5e175c068335a0ae7ff081f9a63b36c08634439c3e9069", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290116, "uuid": "3dcca728-5c6b-4f51-b065-f234466974d0", "comment": "Malware payload (Mirai)", "value": "5403ff2735ed9caf4bb059f4e8f8b5204a5cc310", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290116, "uuid": "ac084a2f-bbbb-4e96-96e5-72c51391a2a7", "comment": "Malware payload (Mirai)", "value": "72107cbb8c1e9e19633f2d500629b116ff7a66115dd61f6a509df29c343d1c23f480a22ba67e9807ba7baa4ac0d46779", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290116, "uuid": "8a7c83cb-f11c-41e9-8ec2-3f5c1e201238", "value": "T1A9C4AF47A77E1890C8A7C0B865E207FC856752875AF7E5DBCF4AE9D2BD25480632C3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290116, "uuid": "e580db4d-37f2-4072-8751-b12b30fd09bc", "value": "6144:BQfzo/0kMJ9JiG6NAD76Wl5UfqvGERmQud8pwDdyrb0KBKVU4CHxLhtSVabAAq:BQfsQJBpn6UufeGnT8pwJyMvWhSVa8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290116, "uuid": "80d1ce97-cdd8-4aa5-8005-031101f0191e", "value": 550828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290116, "uuid": "cfbf9792-a22a-4b1b-a479-ceaa2c6c9f3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290116, "uuid": "72c989f7-0962-438a-9af5-b5290e4c798b", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583f3109-c163-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791276785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276785, "uuid": "687b620d-5e81-4104-bf72-68ece2e4856b", "comment": "Malware payload (AgentTesla)", "value": "54a9991c965d8927b93d110a37accd26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276785, "uuid": "8a1dba80-dcce-474a-8a82-c5fe985627ad", "comment": "Malware payload (AgentTesla)", "value": "78be24965e3c95bcc64de28e51e9ddf7ad91ce920a05a483a8cdf7e1be80294d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276785, "uuid": "2bd639b4-15a2-4f85-a62b-75c6da7da00b", "comment": "Malware payload (AgentTesla)", "value": "8976941573c175f5103d9c8a7ae58321cf2a0e7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276785, "uuid": "614f28fe-8dd0-4428-bf3d-1c343d1843ff", "comment": "Malware payload (AgentTesla)", "value": "f8381b27c443fee52ad78470740094eb00fa727f3bf3f7b5e9aac2458abfe53040d7354ee73e11b95af083bd5ce749dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276785, "uuid": "f980b1f4-34ec-4c8a-9315-2b1b7436b379", "value": "T1C0352339DAAA64DD0E01D162FB167864F2CEB38B4502033B51BD83F571E95E0B7534B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276785, "uuid": "0a18d0a2-d8ef-4204-b472-5f43b9db8bfd", "value": "24576:+/5wtrcrhteXVHtU6NLoz+t7Jj5TEpN1I8BXQ/5:ar3eXvT0Wsro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276785, "uuid": "1ebd8624-f4d1-4d40-ab8a-6a673c8f4708", "value": 1091728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276785, "uuid": "e9dd3049-b7ab-472f-9b86-203b607cc528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276785, "uuid": "b7535b7b-fd35-430d-a86e-41d4c6ffeec7", "value": "classLincoln.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8523d907-c19c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301341, "uuid": "fda09d5c-c71b-4040-8ee1-c00b8452c35e", "comment": "Malware payload", "value": "8844d5c93f0cfa63696e72eb8cf6ec06", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301341, "uuid": "721cc81e-7039-4601-b0da-4fffefa6cbd8", "comment": "Malware payload", "value": "7947b53a9fa4df70d814983ce345a1765a72b1343e2e146f7d589337d548c26c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301341, "uuid": "288448a9-e8fb-446c-877d-cb50d1fbdad8", "comment": "Malware payload", "value": "ddbd559fa93f3aad77ab6a3547e3397b5bb89351", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301341, "uuid": "ac4807b1-7205-43b5-bda2-9a1c4933a98d", "comment": "Malware payload", "value": "f5f1157c92ebb6986ece899fc19b959047f1d6311292139dd89a542d82f5d6ad6904ea711faf00fb5162119bd01eb238", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301341, "uuid": "735fec0d-bd0d-44bc-955f-a6cd05d8e6fe", "value": "T184F533699F3D6849C45BF1B5B8251FB0755248DFE10F24AF285CA6E3C8DBCE80B24276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301341, "uuid": "999f6a0b-da61-4d99-b350-15386795f9ed", "value": "98304:vuwlx/B/SV3ERG0OR3gU6Xwf5v8uQ0qohP612U0:x/9SVfhVBgIaTt129", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301341, "uuid": "0059ff4f-1b37-47e0-b255-164c26968f90", "value": 3433944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301341, "uuid": "f62856cc-16c1-4327-af89-759e410deb4d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301341, "uuid": "0c1cd422-01a1-40d5-a42e-7a1907f6ae21", "value": "Seraphin-v1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2c1a12-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272151, "uuid": "aa526dab-1b5b-49b6-8db6-6425b03571e7", "comment": "Malware payload", "value": "61c3664986becb75abe59f5b61279de0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272151, "uuid": "75ee02ab-aef9-4905-a052-14186043be3a", "comment": "Malware payload", "value": "799504d3ab5ad47e66f26d4c64621148f48b4e55ee3f439a2806f4e6c9364371", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272151, "uuid": "b2da024f-6ea7-411b-8086-2e39a8171da9", "comment": "Malware payload", "value": "e6c346cf2e9bf5a28bb90beed9c62631864ba8ec", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272151, "uuid": "6b23d312-c2e7-4a2b-ac66-c875c1822f10", "comment": "Malware payload", "value": "c2033ae6f1c26db3252635de80b5533fa2181475c25f7133330df1dce20d211f77569f9739eec180fd7def647b2ed22c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272151, "uuid": "01490baf-dab2-4f28-8073-f41731f86909", "value": "T152B423F5A7606BCC9D20522F2F4A27CE19374B41B403C54A1AD2875A421F6FF4E7AD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272151, "uuid": "445f5620-6d66-4c74-8a50-aa244fa8fb08", "value": "12288:iBRdpQ73iBVYWECwvEXgbvM0a4OTHiQIIFzuK9Gd9IUz:iHUw2Wl9XgbM0azTHiQIouDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272151, "uuid": "5a519eab-d40c-45c8-a5ef-9ac99fffd5c2", "value": 542317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272151, "uuid": "39335854-eb2f-42a4-9c3c-9fd0ac82e3c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272151, "uuid": "1dfa51d7-6efa-4c04-b9b9-36c41e6c6831", "value": "799504d3ab5ad47e66f26d4c64621148f48b4e55ee3f439a2806f4e6c9364371.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c37658-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275685, "uuid": "e36753aa-43d1-4a49-8d84-58d5284ed5eb", "comment": "Malware payload", "value": "210430a785b20585c5b474e4dd9edfa3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275685, "uuid": "65c39280-9b28-4434-bd21-552dc13b1c45", "comment": "Malware payload", "value": "79b09ad6b9416780ac12ebb7ffb01e7581641459db671f0ec3b2da3d130e99b8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275685, "uuid": "3a15c21f-a4eb-4dd7-9fe4-31a7bbbcc8db", "comment": "Malware payload", "value": "1759b84226c704a16f4b4425e805a5445232f7e0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275685, "uuid": "8de2e3fe-6a77-45bb-82af-f8391163e739", "comment": "Malware payload", "value": "6446a1cbb17f55f43c0ec47b14ea51520611ac61e44b69c3855888530f171b7ddbe2edf175e63b209a2d049b0ea792a6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275685, "uuid": "26973863-85bd-4dc7-9cc2-4c2d243548fd", "value": "T15CA4239581B983533484E3B5497B1AEA5F301CF28D3D674F88DAC5F81B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275685, "uuid": "2acb7da0-885a-4699-bcad-10a9dd39f4b4", "value": "12288:7ciSCDe0U+m1V6ECbniSPfS3e2R3feeintFck9:9De0wUTiSWzeei9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275685, "uuid": "e6baf1dc-0ad5-4f41-af6a-5e108ee822a6", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275685, "uuid": "5bbe16da-02db-41ef-b336-0e1ae7718fb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275685, "uuid": "d90dbcbe-39f8-4c1f-acbb-78a66f0612cc", "value": "79b09ad6b9416780ac12ebb7ffb01e7581641459db671f0ec3b2da3d130e99b8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc731c2a-c18b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791294240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294240, "uuid": "4a59ca04-c6c4-459e-81f9-64ab8d489aa9", "comment": "Malware payload (Mirai)", "value": "24b5d9a976397e05ad0c3040e589af1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294240, "uuid": "ae6dad80-a7bb-46bb-b390-b972f3761839", "comment": "Malware payload (Mirai)", "value": "7a369bbe9b185c0f2d45e06bbdfe24d162a9eb4e0abb64042dcaa372feed7165", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294240, "uuid": "ba4f9649-ead3-4ee9-ab07-e08a981a5fca", "comment": "Malware payload (Mirai)", "value": "d9efe9afb862d7db16923874bf0e5075235027c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294240, "uuid": "16341724-356f-41ed-8478-782ff5defd19", "comment": "Malware payload (Mirai)", "value": "f67059d1ee44e79822dc68de61c12f54992f8cbf4c076093ea5a3d954b62f6bedd7afcd2cf953516278f4a9b915c4bf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294240, "uuid": "019e9af3-15c0-411a-9a57-c2fbcf5e74f5", "value": "T1DCB2D0347199A0F0CE316434F8798947AB9A45FDD0F97722326710F85A9A88D25ECA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294240, "uuid": "b5cb8c81-bc3c-45fc-a89e-9a0a9377243e", "value": "384:qoBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1MhymdGUop5hL:2aNSq5sOHpTqncvsdDePiAUgefoeDeXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791294240, "uuid": "e459c704-7e46-4869-b03e-787a4252bad8", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791294240, "uuid": "43703e59-8607-49f7-83ea-d2289750596c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294240, "uuid": "1762f8b9-0e70-4c35-8b53-6485a52cf1fd", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ecdc5d-c195-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791298304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298304, "uuid": "149a75cc-d1d9-4b3e-8ada-7f38f38ccb65", "comment": "Malware payload (Mirai)", "value": "b6fef51ccb6c6ad030cd0a93ec38e6d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298304, "uuid": "78037d91-c07f-4788-90fd-c176671b45c5", "comment": "Malware payload (Mirai)", "value": "7b014d383cfedd8877dab5fe084f299999a054838a13cbb82d3b5ef34f29ed9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298304, "uuid": "f1ec6342-0ca6-4d0e-aa7f-b2c680f277d6", "comment": "Malware payload (Mirai)", "value": "3faccf41edbd179de204d0425191f6193f391842", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298304, "uuid": "41744058-864e-4edf-8415-115a415c9485", "comment": "Malware payload (Mirai)", "value": "7f038f06254798aee64ce6e3f655931adcf182850df7dda1ebf27ba8f4b806338670cbc0caf1315f2c2834ae6d9fbe2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298304, "uuid": "2fbd0ef2-a9e7-4a54-9f7b-038590aca26a", "value": "T13BB339CDE606C6B7C4430BB2C697966B4631BA35492ACE49F7CBFCB49B224C871147E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298304, "uuid": "983f995e-ebaf-4d76-83eb-b3dd909b24ba", "value": "3072:W2g45IFRPCai7AmtDLUnM9EniEZ59sDySo4XRZhSvn:W545IHRPmtXuniAMDySo4XRZhSvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298304, "uuid": "daa9533e-9e3a-4414-9898-eea82847669c", "value": 114561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298304, "uuid": "ed43259d-c06e-4fa4-bb99-c71f45d9ecec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298304, "uuid": "d3c24ca8-517a-43d7-8921-fa969d421220", "value": "getty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91e7d62-c181-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791289805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289805, "uuid": "4e9e7cb5-bce9-4232-b78c-fca3d2190b28", "comment": "Malware payload (Mirai)", "value": "2de86dc534bf4c5fc148a7c48a8dc64b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289805, "uuid": "60c89332-8f31-491d-a798-0cc6e8cdc0cf", "comment": "Malware payload (Mirai)", "value": "7b8900bbb7b655f3dea20fff79eb9ec6bb42ebb1d4cf254272d1583d6c00d32d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289805, "uuid": "c8c8bcb6-cf12-4e21-8e7b-16868f21b1c2", "comment": "Malware payload (Mirai)", "value": "b16c4696ea9c26b1471ef204cf7f2e83e1e26bf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289805, "uuid": "7b07a3c2-4c3c-4230-9ff4-c7b44340a95b", "comment": "Malware payload (Mirai)", "value": "35b0b3516c0cf9e04c774df31728a30e938a5dd1eb4e03e5ad2f4810dd321965a5f1a6db22a7c6060d8f063f8926dd30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289805, "uuid": "718be516-ee71-4e96-9132-9a1b3f9ab3f1", "value": "T1D0342A87F905DEB7F40AE73304D307357271FB6249531A22B21B797AAA3A3C4246AF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289805, "uuid": "85e3fe2e-7a3f-4a44-9a70-1111a9b7257d", "value": "6144:HhNbcdy/qsIRTzRzi9/jLiY3K6OOIYqZXjtj/3E4Ptzr4UHk:HHg5zdY3K/htZXjtj/3E4Ptzr4UHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791289805, "uuid": "2d3cc2c0-1322-4ab3-84fc-9c56213033c1", "value": 230971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791289805, "uuid": "05801e1a-112e-41bc-9912-422bfdd47ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289805, "uuid": "0e806834-b6a5-4d2d-8b00-d2451ac47c12", "value": "qv3.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e103545f-c11d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791246949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246949, "uuid": "a08cb226-8bc7-410b-a35a-5c3253e7588d", "comment": "Malware payload", "value": "bf3f944f3863b024b479377b928cf913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246949, "uuid": "91dad5d8-c15b-4f49-ab3e-1e6cc35ed7ac", "comment": "Malware payload", "value": "7baeeb7e96cfe57120a6c99eae938b7a112936642f73846f73feac04022d0f50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246949, "uuid": "7c346fab-5aec-4a2d-93a5-96ff5016d4d3", "comment": "Malware payload", "value": "394f92a547ce5cfbed3e8e941004c26008c68f0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246949, "uuid": "cbd5f51b-33b1-4132-8ef2-5ecfec075e9f", "comment": "Malware payload", "value": "3a2d1e69f18d4413634000990d9e670a8063a3a28e80b8ddf94434f26ffe0f90a150b852bc8447d59c31dce10c21b348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246949, "uuid": "eb09f8e2-561f-4214-88bd-1bc568358fd2", "value": "T15866FA19EDC42BE6C82D5F3484EAC99613B45D104AF1463A26A5FFA9BC772347F4388C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246949, "uuid": "550cacb7-e0ca-4473-801d-1530c1dac40c", "value": "49152:2j1nk9sPjA7A4FQQhL9UYKdnXGtiCw5E44gQYgo87:+b807EA87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246949, "uuid": "88bf5fdd-6e8e-4285-8de5-68519557a450", "value": 6947009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246949, "uuid": "9838432c-31e1-4d11-b2f7-e072a63ccc7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246949, "uuid": "699ed134-bda1-44a2-91c2-5f070e443aed", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ff6b8a-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "c2012e57-923b-4cad-b13c-fba370c4dece", "comment": "Malware payload (Mirai)", "value": "b5644a585e5a60a66f4fee4ba04b7a80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "4de00d33-e523-4b4f-b6a0-376451c07948", "comment": "Malware payload (Mirai)", "value": "7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "ad57f162-90e4-4809-b5a1-5733b4f00452", "comment": "Malware payload (Mirai)", "value": "7ee327a4dafc6acddade26bc5238aa60d6cccae0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "fe1f7e17-3bcc-4b5a-98f5-17c389e5f3be", "comment": "Malware payload (Mirai)", "value": "8bb1b2e522c481ee4b51d41d433818b1067fbeeb244a7fd4845a187454af6beea759e64a3d3348941a22d85f5781ae44", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "5a43077d-3e23-4e64-9b5c-7de5deda4184", "value": "T165F35B0274D0D4FEC8E5C2B84BEFE136DA32B4595174761F23C8AE262E5DF212B6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "b5e48c7f-d88f-493e-a91b-43a903669a03", "value": "3072:wQUpH4VklB1Amd10qb8ODAhv4y1jFg+SVKKE:wZpfYOB25dHKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263359, "uuid": "87b6e9a5-cf14-4852-9b67-0a284ee57cc0", "value": 164272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263359, "uuid": "3dbf6641-48ea-4be2-a5f1-c31aca23da95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "d562065b-3f66-4d0b-ad2f-5c4e057559be", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f426bad1-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274899, "uuid": "6868fc0a-a044-4ac4-9cd5-067c5ba80622", "comment": "Malware payload", "value": "d82d03a1fb778d28a4454dfa527937bc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274899, "uuid": "538709dd-50e0-4e32-a080-ed1573a7d4cd", "comment": "Malware payload", "value": "7bebfade1f479859f114dd633bdcad2cc84c38a66446051a7a7d76aefec42b6d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274899, "uuid": "4b8e4c90-4dde-4b73-b0bf-c8409a1ab4d6", "comment": "Malware payload", "value": "31dc4bcdd852232e01e7fefd087a4b6991c3ffdb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274899, "uuid": "0799ade0-cbc4-4043-9d2f-7a8703eb76b7", "comment": "Malware payload", "value": "c698d820809e01a4e4bd843846cc96e7bf9e8069fa856e3179144b9980c8c6058a9002e10ad013f67b50de433b1c71b9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274899, "uuid": "83c892ca-e2cf-4f1f-a408-7b60764c6b05", "value": "T1D45533D781BC29C44F3D0BA3A7FFC55C72248DFC20060867276985D66A3E79F46A0A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274899, "uuid": "363ba984-c6e4-4aa3-8103-a8a68b7c482f", "value": "24576:5oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRg+a5+ti:5oZ9bq+MmMEL+hcjXHC/wnwdra5+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274899, "uuid": "3db22df4-c543-4e7e-9c57-744843047a67", "value": 1380742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274899, "uuid": "12458e92-a359-4981-91fb-7dd600f21028", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274899, "uuid": "124a1fe3-c4cf-4a9d-a0b9-5633ba03f714", "value": "7bebfade1f479859f114dd633bdcad2cc84c38a66446051a7a7d76aefec42b6d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25aac34b-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288296, "uuid": "08f38242-8103-4738-bd39-cbd2e69706e1", "comment": "Malware payload (Mirai)", "value": "1bdcd933adce6cd1754420bbe16011a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288296, "uuid": "7d1a208f-e543-4bd6-a37c-7e00c7fc94fe", "comment": "Malware payload (Mirai)", "value": "7cfb8b73c29b204146ae1bc122e67360eaa20894e9f83aab4b91d7dc9bb34a40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288296, "uuid": "555ffc6d-a8aa-4bc5-a849-9a1d12fde58c", "comment": "Malware payload (Mirai)", "value": "3e2338e6e253844c1667cf6fdab523dd369489cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288296, "uuid": "7f3c1942-a2f8-4a4c-a737-1e95a91372d1", "comment": "Malware payload (Mirai)", "value": "a2b179abe7746ed05ef3e8bd70345b9be36e9271412414bf571620b1bf31d74a46cb202a40f1429ff7d256fe164d6ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288296, "uuid": "2c02af86-b31f-4354-85c6-5cf43bf4027b", "value": "T17FD45C66BC919B90C5D149BEFB6E437872135B79E2EFB106CA045FA06BC98D50F3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288296, "uuid": "fcbb40d3-69b6-4320-993b-eabcadc269a5", "value": "12288:4t1zy+5SoUBu7TWMYflHtnfNUavAjej25DasGVT:6pTzQU2mDasG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288296, "uuid": "9ea40288-9c6d-4efc-8623-dddc89c0bec7", "value": 652604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288296, "uuid": "66641846-9007-4bf4-8989-04fbb6c800d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288296, "uuid": "7b916eb9-b77c-4b16-9a48-b42d43922e41", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f356e339-c150-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791268884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268884, "uuid": "cd153164-db54-4596-a689-020185cc7678", "comment": "Malware payload (Mirai)", "value": "cb10d6f2db5be43abd4f1263540a2966", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268884, "uuid": "e058df35-06b5-4c62-96fa-209485899e70", "comment": "Malware payload (Mirai)", "value": "7d43d90cbf2dfd54012463848142283ea995f610cbf0e2c21cfd971c8e1327a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268884, "uuid": "46f774ab-1db1-4850-bd8b-bcc54d9b769e", "comment": "Malware payload (Mirai)", "value": "6ec55e6379f91b86ca59a8fdcee4122adf5b1753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268884, "uuid": "5df31a56-9b99-4972-af1e-be30e4dd15f7", "comment": "Malware payload (Mirai)", "value": "615ae8edbc41c82bbed89d2ddc0d35f9e6004d6dd1b3bb1b87780f447b9bebad4bab89f47457e9f1f029380845bdc939", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268884, "uuid": "85484ffc-7077-4e4a-aaba-8b7d8d391162", "value": "T1FFB339CDE606C6B7C4430BB2C697966B4631BA35492ACE49F7CBFCB49B224C871147E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268884, "uuid": "15b891c6-bce1-46fb-9964-1b5120f71c7a", "value": "3072:W2g45IFRPCai7AmtDLUnM9EnieZ59sDySo4XRZhSvn:W545IHRPmtXunimMDySo4XRZhSvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791268884, "uuid": "6f3f969f-32a4-4ca9-ae80-01032df392d5", "value": 114561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791268884, "uuid": "7a1741aa-513f-42d0-8975-98a4a79bf919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268884, "uuid": "91872829-f718-442e-b644-28635c2c8e13", "value": "getty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748d52af-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275544, "uuid": "a79b80cd-f5b4-49b3-965d-632c7f39422b", "comment": "Malware payload", "value": "05633ccd962a53950c86af79699b4463", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275544, "uuid": "9e2113ed-cc99-4ee7-9ec1-2286274c6505", "comment": "Malware payload", "value": "7d62611695299e5da5dc145b607ccf601fcf4a53551d3e4822f4fbcedfecebe7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275544, "uuid": "719e78a0-dc8b-4b62-b028-b5ed9bdeecd1", "comment": "Malware payload", "value": "a423b5ca7d7bcae50f488f8905c14be19a0dc09a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275544, "uuid": "f0f785d0-6b1b-46f6-a967-bdbb1d52e730", "comment": "Malware payload", "value": "fbed0eeae584706960aabba2e35bf414aa4eb4cd4558226ac2d4257409debbe897a1c22c443983cd7c2da81d8cab1813", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275544, "uuid": "f57ca258-698b-40d2-bb04-9de515175f48", "value": "T1C455338AC17C1CC49F3E0A9779FF555CA2248EFC200208636B2A59A7253E74FC7B595B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275544, "uuid": "ebf732a3-1eef-4c1f-87ce-04a5974978da", "value": "24576:mPTJsZg552oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRY:mbJZ52oZ9bq+MmMEL+hcjXHC/wnwdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275544, "uuid": "f26cf54f-019c-49c3-9106-caeeb928becc", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275544, "uuid": "85058ff8-a2f3-4f02-b19c-8314ec5dd170", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275544, "uuid": "a1e9b027-605b-48fc-b38c-3dcdd3c58b5b", "value": "7d62611695299e5da5dc145b607ccf601fcf4a53551d3e4822f4fbcedfecebe7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ba67f7-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272293, "uuid": "f84606e1-b509-4d18-b773-d93f4c615bfc", "comment": "Malware payload", "value": "5b33a7912bbf1cc6c0da799f34e99099", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272293, "uuid": "8f2a5c9e-64d2-4e35-9528-aaefa2af78fd", "comment": "Malware payload", "value": "7d8dfd3cfb6caa9746a2e3cdd50408702f6843f9e3a1fb0f4fdd709f9b4777d4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272293, "uuid": "df502514-5d59-4034-9398-edcc5f31fe0a", "comment": "Malware payload", "value": "1ad5b7116b59f97d869a2695fa6b2c99c6231671", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272293, "uuid": "a4b048f7-6a95-44a4-a680-4116ec5fd8fa", "comment": "Malware payload", "value": "e1a257691afac9ed683ccce5b5ce4d3ba60ee947261f52b4bdf56985513ccfb8111383fcff3febc43d3b823899fe1faa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272293, "uuid": "2fb1551d-8e12-4d3a-a9cd-9943fe1d30da", "value": "T107C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272293, "uuid": "df75027c-34f8-4374-8c4a-cfbfb9a793d2", "value": "12288:7+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byXH9I1P0QKw6FED:7+QqldA/TSO713u7xnXH9IaQKHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272293, "uuid": "29b330f3-237e-4e3c-955b-3a6ee48c7cc3", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272293, "uuid": "149fef0d-7ee3-4c32-a9f1-c98acfb2eda4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272293, "uuid": "9b64cd26-d7da-4e41-a1ae-192110d82bed", "value": "7d8dfd3cfb6caa9746a2e3cdd50408702f6843f9e3a1fb0f4fdd709f9b4777d4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe077fd-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273999, "uuid": "7caab6cd-d8b1-4fa2-ab23-0456fb793881", "comment": "Malware payload", "value": "00534eac6663fabc66969064f2afce09", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273999, "uuid": "5d9a5312-bcc0-43ce-8a16-b30b38b7947a", "comment": "Malware payload", "value": "7d9a7f6c23849da3953d42b5ca8a3fcf3a8bdd6ee29133b52813e11b9b0f97a3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273999, "uuid": "146d4a69-428a-497c-8f62-7f5662652a86", "comment": "Malware payload", "value": "8ffa97056c0173bdf5242a3a2a796c79646ff896", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273999, "uuid": "ead53c4b-25a9-4852-b422-f5e186b09746", "comment": "Malware payload", "value": "78f6362c1007a5053d51ea615eb70a06e185e85517774cc719271d5ab69aef3d739f9e4d69b1514e5d7901f7209c3728", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273999, "uuid": "5a05e2be-c577-4898-ae07-b4aa9c2c06f9", "value": "T17BA42397E39996EC8CC47ABA8B2C0D08B27CE7745CCF06A8537E5335D1688A39E0751D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273999, "uuid": "8fc38078-9e02-43e1-a23d-08d8d3b6d983", "value": "12288:esS5lyFd6d+6sVXkvgSe5yHqr++rVOje+yH56:esgxE6sSvPKy+6eTH56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273999, "uuid": "6154d565-88de-4989-997c-545c83b34a7e", "value": 492541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273999, "uuid": "577c3319-0ed1-40cf-90b8-6f38f51e467a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273999, "uuid": "5f6f45dd-3608-41d8-92d6-347c48dbab13", "value": "7d9a7f6c23849da3953d42b5ca8a3fcf3a8bdd6ee29133b52813e11b9b0f97a3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4635c039-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274177, "uuid": "99242ac6-59b0-49e9-b4c0-caddb252181f", "comment": "Malware payload", "value": "60cfcf16263c40b3472e870d41ce03a8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274177, "uuid": "40af2e80-9593-4dae-843a-eae5c6dfe908", "comment": "Malware payload", "value": "7e43e0f32637de5199df5674e872d2c47aa9b1d4824e2c9731532b165becfe64", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274177, "uuid": "c4a2bbcf-d3d1-484f-b5a3-3671df2d7f32", "comment": "Malware payload", "value": "e594c3aa2d262d750e38adf41f8027d256cce052", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274177, "uuid": "e42a3f4e-4198-4b98-b0a6-cb885bd9539b", "comment": "Malware payload", "value": "b7dddd21688868366771ede188258669fd482bd0c04f18595a01c8d398efeceb0c728ab8827598600fa19582b803028c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274177, "uuid": "651ff506-5e7f-44ef-88c8-aab8a6210a5a", "value": "T115A42397E39996EC88C47ABA8B2C0D08B27CE7745CCF06A8537E5335D1688A29E0351D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274177, "uuid": "90a763d2-3022-4b0f-9406-326a7503337d", "value": "12288:GsS5lyFd6H+6sVXkvgSe5ydqr++rVOje+yH5e:Gsgxe6sSvPgy+6eTH5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274177, "uuid": "5719b024-384b-426c-8dbd-1c55970f165a", "value": 492541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274177, "uuid": "f48faa65-f603-4707-98b6-fe0e46fab54c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274177, "uuid": "adc50724-34b2-42d9-9f92-bce4d7bd15df", "value": "7e43e0f32637de5199df5674e872d2c47aa9b1d4824e2c9731532b165becfe64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163bd5d1-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263360, "uuid": "c4a1fc12-0068-47c4-bdce-ac7e7aea268c", "comment": "Malware payload (Mirai)", "value": "86821726e7ac79e6f6ae202498166a51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263360, "uuid": "280e8092-3d9a-4772-87eb-7247efb616de", "comment": "Malware payload (Mirai)", "value": "7e47c19f82d8a932da2ec9bd42d7b815a05bf4be9ae0e512544fdbfce5f930b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263360, "uuid": "85081b8b-c0f3-4c55-bb6a-5ed87cc9805f", "comment": "Malware payload (Mirai)", "value": "4eda7fb07bce6ae74ee055e42f17c63e8347f263", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263360, "uuid": "ac672af8-1205-43c6-afa5-af08830b534c", "comment": "Malware payload (Mirai)", "value": "de4b0865cfff063452236f64bcc6e345379d2d5c58e3ff36ede1783990c4c53ce7fef3e811a7fa99a0f31bdcbfaad447", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263360, "uuid": "d9ca4936-e26c-4328-a541-a37e75bc03b5", "value": "T173E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263360, "uuid": "f02e6ad2-7329-4ae2-b885-9320e43037e0", "value": "3072:3OtstuCDxzd93OBDZf9Qq94cZwiSXUtgKh8J7/8ZMEh+8:3+stuCDxzd9WFfDCcZwiAUtgKqJIZHhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263360, "uuid": "04284cdf-2f27-4a4f-9d32-1d3697f06f13", "value": 154360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263360, "uuid": "2b84db86-cbe0-42c1-9e0b-d367ee186691", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263360, "uuid": "6fb3cda3-c9dc-44cf-846b-6fb4e5ab99ef", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f03b1c-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273560, "uuid": "56311ef0-dd4f-47db-91de-efc7f0f292a0", "comment": "Malware payload", "value": "cbaffcbd6e3d16e885e27572ae69c5fc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273560, "uuid": "063ddf0f-ecdd-4905-8241-a64a5667ee7c", "comment": "Malware payload", "value": "7e8fe9bcf69d47526d57cfb7bbb1ccc7cff4b1f6751f98467258994db11b69f4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273560, "uuid": "7909018d-206f-4931-8c3e-7b428b50a5ac", "comment": "Malware payload", "value": "bbde0e33a3c4e271f4f6810add155e12c41dfb10", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273560, "uuid": "e8d37d94-bae0-4c14-814b-28ea90341867", "comment": "Malware payload", "value": "677b103df8192872b7cc040d0eb6f57899e63abef73fbab6eeb65e3fdba2998b7dc4976e14c9564ad01888d64b9673fd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273560, "uuid": "a48bf755-d688-4bd8-b9fd-eb0dda30f395", "value": "T1D0C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273560, "uuid": "e366537f-b624-4966-ad7e-9f4fc1acfb57", "value": "12288:b+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byqH9I1P0QKw6FEI:b+QqldA/TSO713u7xnqH9IaQKHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273560, "uuid": "92746dde-e3de-4621-ad6a-9b18d44d5b63", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273560, "uuid": "2acec9a5-9001-4210-bc13-78fb020cbd97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273560, "uuid": "2d484ba1-6c7e-42fe-8fff-c5651b8122a6", "value": "7e8fe9bcf69d47526d57cfb7bbb1ccc7cff4b1f6751f98467258994db11b69f4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b988612d-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275659, "uuid": "7cdaa2f1-2c7d-47bc-acc4-5202557c1682", "comment": "Malware payload", "value": "f30bdf7f408cdb3dbc27d2089590b9d5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275659, "uuid": "fb649dfb-dbda-4ea4-a063-a8c4baeb4f69", "comment": "Malware payload", "value": "7e99fcdd27522760f7513ec61efe9ed86b4783bcde7edac8668ebaadd4e51c55", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275659, "uuid": "f12ba329-8d14-4296-b5f5-aae9ab01cdad", "comment": "Malware payload", "value": "581ae9f6d6f1a3750bafebc67b2d2de861bf9cb0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275659, "uuid": "a9ff50a6-dfae-42c5-b298-b4993ed57d58", "comment": "Malware payload", "value": "2dd29042db7ec14b42d46915d8ec2230282dcf966c1337e0ecf49562e579aafdd2c183cf2ebfc44dab4edb0de44aac08", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275659, "uuid": "74d86a91-cbc8-455c-8cb8-8b15c0919228", "value": "T188B433F5AC68721A176F9D13E762EBD03B7DC3AC265313C42527A2CC404B96B116E3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275659, "uuid": "e48b58b5-f367-47f1-afa9-32f28a67c475", "value": "12288:rrLZ+vPYN9Vr64fQ/IPI2si0Ndqor04rxkF56zm5vH:/LZ+vwN9Z6qQQAHi0pgUmNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275659, "uuid": "458c7d24-5bed-439f-99e2-cfd75c37fb80", "value": 538362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275659, "uuid": "e8535bd9-8ac3-44ff-a1e4-79edc81a5b01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275659, "uuid": "545e523b-238c-42d9-9234-d6beaf345faf", "value": "7e99fcdd27522760f7513ec61efe9ed86b4783bcde7edac8668ebaadd4e51c55.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8cc466-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250562, "uuid": "d45d58e0-3d47-4873-8088-18a5bc8e6ff3", "comment": "Malware payload (Mirai)", "value": "f101b724fe429ff8829c74e0c377c72c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250562, "uuid": "acc4cc36-95ff-4f79-a5a5-6996c4d47c1b", "comment": "Malware payload (Mirai)", "value": "7ee108915d198e238f7b184fe5b34e6d1b4a4a299062709928430e13c5c2ed17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250562, "uuid": "8f24700d-700c-4046-a6c0-5c6b25c5ac1b", "comment": "Malware payload (Mirai)", "value": "5ef7c3d31ab5373e15920de5b67d3e9ffcc65f4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250562, "uuid": "b3b30cec-5e81-48c0-9d26-17f8a3878efa", "comment": "Malware payload (Mirai)", "value": "cefbb8b539227f501adae2d21ec70703641d5e0dcc7fb418ad17a4acf8eb0012ae5ec15317b25cba442807b34e0394b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250562, "uuid": "9fa37bbe-1861-4d14-961b-0d5cce498740", "value": "T16AA2E0A9FFA28099D0C6453C15D3A9BB366BDDE3839C026B6D95D8C609D38CC804FC31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250562, "uuid": "b5a0dee3-11a3-420c-aa45-2ae0ed6cb5d0", "value": "384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chNuHfmmcb4/N7KbxTKqZXcuiFqcJp:TDZ5Dw7RjFjcU+O24sDOuuE/Nmbx+qZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250562, "uuid": "f793258c-5dda-4faa-98b9-8d8adce983e2", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250562, "uuid": "388b1bae-dec6-49d2-a9d2-24e8bc7f0f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250562, "uuid": "b07d6ecc-7d8c-4890-9996-8f8feae837df", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c7c4f0-c166-11f1-927a-4201ac107004", "comment": "Malware payload (WannaCry)", "timestamp": 1791278151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791278151, "uuid": "4fbfdea9-61c1-4837-8363-44ff96799f1c", "comment": "Malware payload (WannaCry)", "value": "79ce4d0c02c4a1c3192615ed9f9b1962", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791278151, "uuid": "be3124d9-d47a-4639-a5a1-53571fd79262", "comment": "Malware payload (WannaCry)", "value": "7ef0b121f0059de02cea8c1280f4fdd0c440b057346984bfcf8606a2a66a8148", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791278151, "uuid": "0eaf5868-e586-4bbf-a7e1-eaefe9e43943", "comment": "Malware payload (WannaCry)", "value": "c123dbb4dc8bae1f797ccd419f9486f8675e1719", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791278151, "uuid": "8ae98a08-0202-4ac2-8f47-68bddd35e8f2", "comment": "Malware payload (WannaCry)", "value": "b1138b529cb31b4a57f09e4058d4fb17474a869c343f414f8558b8e2759654bea436d8c2e3eac6a6f7f51424e55dfcaf", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791278151, "uuid": "bdd57f53-2275-49dd-a3dc-e18923b5047c", "value": "T14E36236A3598C031C413527498A68F65F5B6BC2B1379524F7BD08F6E2F23790E22AB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791278151, "uuid": "80c9afb8-8156-4854-989d-7cedc3d16e0d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791278151, "uuid": "5f9b49bc-ccf8-4300-87ff-d35568051c93", "value": "24576:jbLgBbLguriIfEcQdIVUacMNgef8JAp5So7kBhoq6ydoSfFiLYfupCI0/cShvqoP:jnsnpEKUacBI7MP6ydjXkwhvNtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791278151, "uuid": "0184c1fb-2ff0-4028-8e29-00821644af68", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791278151, "uuid": "0b718f51-87fc-4b93-b155-77d9f95637a2", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791278151, "uuid": "cc440660-ffd7-41e1-87f1-6bd4a66a7b7e", "value": "7ef0b121f0059de02cea8c1280f4fdd0c440b057346984bfcf8606a2a66a8148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455c3de4-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250554, "uuid": "dfe33ce3-ba80-4396-904b-56ed2e80cfae", "comment": "Malware payload (Mirai)", "value": "f57c066a6e348659b1a2dc4e5c228a1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250554, "uuid": "06d51a8f-4820-47ce-a2a8-16be1fa05e38", "comment": "Malware payload (Mirai)", "value": "7f0d96315473eae2fae7991959b70098d6480ee503e8353b187df7688874a2f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250554, "uuid": "660b57ab-98da-4703-aba9-8209b39750cf", "comment": "Malware payload (Mirai)", "value": "41562767a03715da4413686cdd01ef44a1f7c023", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250554, "uuid": "64c9f7fb-c7cf-45a1-a2e1-afc03be06a0d", "comment": "Malware payload (Mirai)", "value": "58029ec5eaf36a42a4facbf1bed7473b81cbf58e342e89973764c9d07ab15864478f3dc4a96f87ba15def2740f8cb755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250554, "uuid": "6b4b6a88-440d-4f63-9fe1-a5cbe4c7d413", "value": "T1E3A2D029E345AEF8DFEF9D9057C1C2C277E587C6278AC8E340EEAF012506046B788D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250554, "uuid": "35377bfc-5461-435a-b2d9-8711fa63da1c", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5EYa3M4uVcqgw05VxJE:mRxsSVsMD6xiJJE5zRWNWk4uVcqgw09i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250554, "uuid": "bb9ae62a-d241-4d9b-8ba9-db3e2d76134f", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250554, "uuid": "fb9fc98e-dd0e-44f9-b22d-f1ebcff1886e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250554, "uuid": "6899bd52-304d-4151-a99d-f40f7795bb16", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69bcc49-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270984, "uuid": "1470b7c2-3d9f-4fc2-800c-010d5a52a26c", "comment": "Malware payload", "value": "820348626131830e6d89ee7666ece7c4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270984, "uuid": "b9810091-9a88-4203-a8d2-84ecd2453f68", "comment": "Malware payload", "value": "7f1b2926631349ed01152cba051deb1bf6acddf0a5f2acda3b2881081732e6bf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270984, "uuid": "b4938497-f51f-44bb-bdef-fff25a3238a2", "comment": "Malware payload", "value": "eb7851673514aaa395a84b8b3f869e19c64cf487", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270984, "uuid": "2d877d4c-a4ed-4a65-83c4-2b1891e243f7", "comment": "Malware payload", "value": "73685c663889a3f26ad1ee30212b3bf3c6080b10557e5f951d7f6c59f44db5c44158982071219e48ac99896ccf5cbef1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270984, "uuid": "1a85cd0e-b115-4943-9a84-2f6de366ee06", "value": "T1C6A4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270984, "uuid": "3399634b-3d49-4ef5-b73f-7f5eeac5c738", "value": "12288:Er068Uv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZi:Er068Uv4t1cNk/wjibhv4b2OnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270984, "uuid": "cf29debe-d616-4083-a98f-dd0afb502b54", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270984, "uuid": "5b96f7aa-ec81-46a7-a04d-7f93dfa14b81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270984, "uuid": "c01df98a-4620-4970-aa3e-2255c28bef9a", "value": "7f1b2926631349ed01152cba051deb1bf6acddf0a5f2acda3b2881081732e6bf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e215900-c19b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791300927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300927, "uuid": "74a4ec92-c323-4142-a346-9a78a81aab4d", "comment": "Malware payload", "value": "1d76e6873408baca9234df8c294397fe", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300927, "uuid": "b2888243-bcf4-4e58-b90f-506cac9f3ef9", "comment": "Malware payload", "value": "7f1b831d45c85235385a1479442939fe89ae210778dad7b9eae6decca334ae27", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300927, "uuid": "c0a34b08-279d-4c03-acc9-4c0bca525135", "comment": "Malware payload", "value": "223df49728c188c2b67b032c45f3623438f7baff", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300927, "uuid": "3391f656-dad0-4a2c-a16e-4f01a3662ed4", "comment": "Malware payload", "value": "d8ca20b55f984140c54600af43d0cd10006e40d4405ed96f29afc8c8757d2d06b8b3c2356e8c098dca7a39ce26d4d694", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300927, "uuid": "31e5a36d-8c93-48a6-9180-10b8b8853843", "value": "T176D63300C56ABA19CEBFB67554608EC3D919836AC44DA01F367860DD24CB9CBCB1A5FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300927, "uuid": "8ab8f1f1-a449-4500-af02-95c4bad0ddf8", "value": "196608:A/QqTxiw3KHK4epCipRt2/31cKCfiKL9WwMxMQjvgax/9ULJ1VgEgTmUcT8:Y6q/pCoRg/ezfTBWxSax6tr7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300927, "uuid": "b57f11f1-6e31-4c69-ad7e-053b6dbea202", "value": 13461403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300927, "uuid": "e6b1355b-d5bd-444b-9d23-95c2bbd7668b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300927, "uuid": "7a134b15-183a-4738-a0fd-047ea649f464", "value": "polardlc-1.0.4cracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb5e1b5-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276069, "uuid": "48821aca-cd55-48fb-bff6-7399d1d04be9", "comment": "Malware payload", "value": "6676ebc5b9e7b7145ba3c9cc95f5beff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276069, "uuid": "a0303540-9091-46d4-aa22-87cdc8eb2605", "comment": "Malware payload", "value": "7f62ad6f3eb274652813f1c3f7f95a8e0db0ffec04c24b495deb990a6e17ce59", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276069, "uuid": "cad8d328-45dc-4934-8516-926d9081064e", "comment": "Malware payload", "value": "3fe82ab22914502b7b8286e488e1bda00dd077ea", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276069, "uuid": "f7667ccb-fb82-4781-bad4-11814d0c473a", "comment": "Malware payload", "value": "7f5ee42e69217e282693c3244a2a51970ff2b2cd044a6eef6114fba296580d92ba7009f7b6efd4dd732fdd0c1328b3cd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276069, "uuid": "8e20981d-9621-4c76-8e76-1947910400e3", "value": "T1FBA423EC4DA10A22AC6BB704690C5F430B65D44F3BDD8DE91A0F3EA4CAD7C544AD92ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276069, "uuid": "ebbda093-107f-4967-9755-4009924de8b1", "value": "12288:DzYfcEaN9B/Jm0LU0gM7aQpSDbvyiXKkFfaK3:IfclN9BhmSH2aCKkxaK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276069, "uuid": "49a8a424-e4a0-4828-a989-28b8821650f3", "value": 462519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276069, "uuid": "bf66207b-f525-4d95-b426-4014255ed68b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276069, "uuid": "b4c7e77e-67cf-48bc-b285-95e3e7bff7b6", "value": "7f62ad6f3eb274652813f1c3f7f95a8e0db0ffec04c24b495deb990a6e17ce59.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5624d687-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271627, "uuid": "20ff5f40-9a71-45ac-9f56-cb9af9f16400", "comment": "Malware payload", "value": "f04d41d94bf77441c40a7533fb0be001", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271627, "uuid": "ad5a307d-1ecf-4c22-888c-4787f3b1e603", "comment": "Malware payload", "value": "7f8129834e8bd6e1fa733d7b6a0caaa1b74c4d9d9cb6b8e6723a3a71389b487b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271627, "uuid": "db72e6d5-5022-475a-bde7-80cb1f192b1c", "comment": "Malware payload", "value": "2a4ec6b6954e37f298d8693c789c97e475323c8c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271627, "uuid": "f0724def-ec53-4f7a-acaa-71fcc1b3f7c6", "comment": "Malware payload", "value": "5245fe253164113eedc867e9cab831ccf29eeac34bee79c85405e8e1af786b02f8f77aca6615fcd195bb89fcb226b0c8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271627, "uuid": "74c2e9ac-015a-4986-b604-d8a16bd506b1", "value": "T1B6553387803C29844F7F0A9BBAAF952C6215CEFC10420C635B6999A7263E79FC77451F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271627, "uuid": "0328d474-47e2-4792-81d9-5b00a8a1259b", "value": "24576:kwzyCmwOAyoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRG:PzyCmHAyoZ9bq+MmMEL+hcjXHC/wnwdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271627, "uuid": "991dfdcb-37b8-42f7-919b-9cca4ca7fda5", "value": 1387851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271627, "uuid": "52f9a925-60f6-4ac2-a530-86b5aed13e35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271627, "uuid": "20ef0ba5-3b14-4d84-b0dd-316decc459c0", "value": "7f8129834e8bd6e1fa733d7b6a0caaa1b74c4d9d9cb6b8e6723a3a71389b487b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f60989-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250558, "uuid": "ea68c72d-cf03-4f61-b787-1f33c8001b1f", "comment": "Malware payload (Mirai)", "value": "ddce7e0447ee57c7dd6ad37e960d0e87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250558, "uuid": "04e593b7-fd59-4b9d-89fa-094e78832ebf", "comment": "Malware payload (Mirai)", "value": "7fc8d09d3b3ea8b79b2b2313b4a85c40df0ebe87ff0df7b3a850f7c9166eaf88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250558, "uuid": "11f87f35-0aea-4af8-9d08-406984d6401d", "comment": "Malware payload (Mirai)", "value": "0ef19cbbd9e334446c021caf6a9575f3087fd458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250558, "uuid": "0dca03c4-dae1-489e-bd24-3c0826e263e7", "comment": "Malware payload (Mirai)", "value": "5ea16640c1a372db223e20bfaecb51ab8d3588d73417682c6d53255847f1fe976fa62f2e78942e7fae827fec80195d08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250558, "uuid": "ab156ec6-fe4a-433e-bb6f-67788b55a882", "value": "T1B1C2D0E0B726ED31C420AC3DE52A4D8A3951067CD1FE353764158C399FC1A9A63F88B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250558, "uuid": "4ccb25ef-8f1d-492d-9274-9f900ee86c61", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwr69q3UELu5:PKy4qfqoeJdXWgvLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250558, "uuid": "85b3ad24-339b-41d6-b572-8396d3137a49", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250558, "uuid": "94f8e140-6475-4d2a-a5e5-c25437568015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250558, "uuid": "19501a3a-acee-4c8a-bbd5-9ccb02ab17a9", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74c9ca2-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275736, "uuid": "48e13664-79da-419c-99b2-485c71967054", "comment": "Malware payload", "value": "5ddca5e0386e6aa3c6c8fbcd4b4b6743", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275736, "uuid": "ea46ea39-3b5e-489f-96e6-a79e03f272eb", "comment": "Malware payload", "value": "7fde8eb73020f8b89a747c1e22825322b6a8d7aca9635da668383ea0e61aa6e0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275736, "uuid": "21730a31-bdc6-459a-a3fb-429117044577", "comment": "Malware payload", "value": "fe2bec3a250c9db666214c77f9e2c37a90411392", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275736, "uuid": "7c6a0273-c791-4942-9cf0-3d9468c6992c", "comment": "Malware payload", "value": "ccf249a1e75648096e0712ee1c292538b1c91360c5579b49c5ec320684791afc81c23056632304108afab94d15f1803c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275736, "uuid": "41a4f529-3d94-4b6c-b129-c340c1adcd1c", "value": "T107B423CCB6C788CC55A63134E6A20B4154DBBF33B2DF73A1B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275736, "uuid": "7a8897d2-70c0-447d-b785-de13e68a2cb5", "value": "12288:KwsK8MG1KnyC/G76u6M0gXar5qduLct2ien3P+be0:KKGcGmuwjDQen3Pwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275736, "uuid": "0a264e8a-15bd-4642-978a-d23111531f0e", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275736, "uuid": "c3ba559f-74de-4238-aa74-2b79ee7568c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275736, "uuid": "d619d720-c702-4edc-9bd0-d302337a61d3", "value": "7fde8eb73020f8b89a747c1e22825322b6a8d7aca9635da668383ea0e61aa6e0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9f67e4-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273864, "uuid": "dbe2a0c1-5c5c-402e-9011-07c9ddd03a0c", "comment": "Malware payload", "value": "c44f4c10b68422e403825f0b4d3f6797", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273864, "uuid": "fa3a6b4b-d5f0-452e-ac5a-74b245600a9b", "comment": "Malware payload", "value": "8008185d31fa4dab4794ecf5bd03dd80dfcfaffef9a23a8aab22195b7134fe43", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273864, "uuid": "b5176299-ca10-44f0-9f98-f3fb03404882", "comment": "Malware payload", "value": "18928b928ea5b5fd926f91e0c72790eea74d05b9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273864, "uuid": "1d1785c1-2ae0-4fa7-9d51-80f180c5a9c8", "comment": "Malware payload", "value": "90705624aaa2552e6a3cb5f7e206e545d205f1c084de9cf53f714db6703175d7acb45814b5595308283b202e192e3640", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273864, "uuid": "65cb36dc-5c3e-4544-b6d3-30ef7dacbc89", "value": "T178C4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273864, "uuid": "c3811fcd-9826-42e6-a337-551d3c7ed49f", "value": "12288:xMU+0xq75aS9iYIp6cP/G2Bku8QtNvC28c5/VTUPkYyJ:1+J71vI/GWYc5/pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273864, "uuid": "c6fc3312-c9f7-43f3-a87e-2beb78bbe042", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273864, "uuid": "675ebb21-b476-40e5-a72b-35abf7f05eb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273864, "uuid": "d3f4f946-aa45-4d2e-949c-00cf7bed2295", "value": "8008185d31fa4dab4794ecf5bd03dd80dfcfaffef9a23a8aab22195b7134fe43.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce538f05-c198-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299746, "uuid": "deae7645-7555-47fc-b416-5c6dd4413428", "comment": "Malware payload", "value": "a3c1609768beacc4ed1b883aaac54f16", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299746, "uuid": "976ce5e8-d060-4f76-af7d-c69f13ed778d", "comment": "Malware payload", "value": "8027e0a2195c416b3b487b1fe39ed594d1ea6e9e913863edfe0154a964f84ff6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299746, "uuid": "9bede6c6-4a4d-44ab-8b45-12423d2df938", "comment": "Malware payload", "value": "ebd577ef252665a1ee833b9e8be54bac11528532", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299746, "uuid": "ef16ef09-ec33-496e-a06d-af152daa7c74", "comment": "Malware payload", "value": "91844a1e8156c682a9943f026e948127b35b11941b9292a0f8a7a5dcad3b6b72177c312ea00d6e0b04e6cafefc0dcc9f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299746, "uuid": "154b7af9-bbe1-49e1-b86a-5c821f1c3e76", "value": "T199421B5CAED1A1B0EB1707DEB3AF24690228A0C7240DC484F58CDDE8BF46BDD4A56B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299746, "uuid": "ab60fd3b-4fcf-4528-9b27-a022e3168939", "value": "192:sQHNsGeTHQpD+da6+888+UV7tDoj/pxzdbqFtCkSIRUzHq:sQX+/DV7k/34FtvRUzHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299746, "uuid": "5f917abd-e3a8-4af3-bb40-6b22adf98dc6", "value": 12234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299746, "uuid": "e553c520-0386-4dac-99a9-1e46eaa3ea81", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299746, "uuid": "0e34cfd4-77c4-43f4-8bd9-063ede790b0f", "value": "fuck_niggers_26.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe659ac-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272288, "uuid": "b552417a-54b1-45a3-919f-ac85ef183153", "comment": "Malware payload", "value": "9a45d88044316ab7d93c41d9152c5d33", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272288, "uuid": "5f343d03-589b-4b74-b1e6-c436240363bd", "comment": "Malware payload", "value": "8081f3cd5000ef335104f7d0ff3a268afa82b4abe24e49c34b26299970fee331", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272288, "uuid": "540f20e6-3ec5-4dec-b267-0e05d14c9b1d", "comment": "Malware payload", "value": "783e60e239db0d2aa7298fc31cc77374ed696889", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272288, "uuid": "b373b666-f3be-4ea1-84b5-e85cea562aa4", "comment": "Malware payload", "value": "eb1c4a9dc0a1877879cb22b749665c9e0844866bcfdaeaf6b554417f719bbac33103d113dcf54f786d20d91efca2d08f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272288, "uuid": "532521c8-bf37-4665-8b0b-dfc2b23af248", "value": "T10F04133AED5536FAB499322AC9F32E4D399C255710FC65DE3262EBCA4C04B845B440BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272288, "uuid": "5063a535-1111-4d9a-b25d-e15bf23a5233", "value": "3072:GH9ZGD/6o6R8AFojXW6Sol1Rl46kdE8UjDZJVD+89RTXc3P5GuWMTtBeFhYDix8:GH9kFI8AyjmslGT5uDLVHXcgi2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272288, "uuid": "4f5eddc7-fb42-44b6-98b9-439f89841ce0", "value": 173813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272288, "uuid": "c67b7bbd-bab2-4fe9-84d3-87dd94f01862", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272288, "uuid": "2dedc9ec-2e56-4095-bb59-0b70d1129ecc", "value": "Social Security Benefit Statement.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e721c91-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250569, "uuid": "fa28cc07-6046-4e09-baa0-c36d44d2d25e", "comment": "Malware payload (Mirai)", "value": "50d86d22e1757bd1be77ee58af1b46f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250569, "uuid": "5be7b4d1-a316-429a-b2d6-ded271510bd7", "comment": "Malware payload (Mirai)", "value": "811c03c8b172cc58d35cc251fbc489c817fb8bb60204be31ffa461e1d33a037f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250569, "uuid": "25f26907-0020-4e82-8ef1-e22602601289", "comment": "Malware payload (Mirai)", "value": "306e57a652ff2f62e05e72027c205270366675b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250569, "uuid": "f9f2f406-748b-455d-acc4-6cc98d3ea761", "comment": "Malware payload (Mirai)", "value": "77094a81312ba6cef875b8fe1c0be94b377cc053abc8dff4c4a61537767cedd50db9521451215becebfe5b6a35ce7cef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250569, "uuid": "6e0ed686-83e9-4a37-9338-895f0cb937a3", "value": "T1CC230261880F9EB165303C76DE99939376E11A71C6673023D6280B386FA97231E57F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250569, "uuid": "975faa75-e370-4423-8981-c1b9410bdd2b", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3+cL9q3UELbUXfi6nVMQHI4vcGpvK:DECFd+A6YHAx+FLRQZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250569, "uuid": "e04f9a91-5af7-4810-a7d9-b9cbe99769f0", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250569, "uuid": "d2eefb38-aeb5-402c-b66a-0337d05b553e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250569, "uuid": "a02d8619-5c01-4223-a714-10927d5e6e0e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b9e33a-c155-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791270893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270893, "uuid": "1247a0b0-e882-418b-afdc-3e75017ac0bb", "comment": "Malware payload (Mirai)", "value": "467eb478900271fc9b284ba3767da1ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270893, "uuid": "7daeec84-f18c-4a44-a928-158fc1a266b1", "comment": "Malware payload (Mirai)", "value": "8210a2ece70747f8ffd4de03ce4288893f3ecd34e14fd5598efc8657ffebe98f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270893, "uuid": "f529268e-c7be-4519-9b0b-d5d88de90f48", "comment": "Malware payload (Mirai)", "value": "c4bf300b2db27c9c762a3b68ede649f9411197ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270893, "uuid": "c979d6fd-dba1-4446-99e3-fdda288dc5c6", "comment": "Malware payload (Mirai)", "value": "d60c2129984b394c2ac35f84ecd23af9d0ec8b431d28edb3f224490e1f1e2b2a250c2cf4a54c3ff2cbe4cf918920360a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270893, "uuid": "d54cde66-5352-4a01-af8b-92bc9283cb9c", "value": "T15105EA076F409EBBC42FDD3705B9861235CCB8837265363A3174DB5CBE2A94749A39B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270893, "uuid": "29ef81ed-8d7c-4695-8c19-8bea202970bc", "value": "12288:ua/LCdG70o5QhwOZfAP8ninLyjYHXKUNEK0QsclQR:njC470YQh33eKub0vP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270893, "uuid": "90ea9e9f-40eb-4fd7-92f6-c890e06e84e9", "value": 830756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270893, "uuid": "9690f632-8c8c-454e-a78c-1fa1ca7e9b51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270893, "uuid": "f63d8508-7fac-43a0-938a-1a29be59e0cc", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb6ab66-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274834, "uuid": "080a48e3-7103-480a-8890-3a4e665b0f4c", "comment": "Malware payload", "value": "4673cd331e840ce9c334987d5293060e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274834, "uuid": "fdf28c68-a4df-4658-afe2-e0df644ad5cf", "comment": "Malware payload", "value": "826e72b5dac3311fcad8dda44a0d40788fed28c25d9fef8c6f0f2209d4771f37", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274834, "uuid": "ed75f340-ed65-4905-b421-8b54b945e926", "comment": "Malware payload", "value": "4cb5f9a9674714db88015d599b219a6c845b5c64", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274834, "uuid": "f9d3d796-b729-4fee-9aba-a50c4db4183d", "comment": "Malware payload", "value": "dcfec520c75ad448470e80d614c09b680dbbee2d9bdbd9ea80eed7603f8207ff006f74b5cfc542d28fe1d04ef04ed023", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274834, "uuid": "648a733f-528e-446f-b00a-aa902299c810", "value": "T151B4231AF4D078CFD68ECDA394292C785F6C96C9CD126B7246C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274834, "uuid": "84a3f4c2-5295-4a46-a981-f0fc5ba52bd4", "value": "12288:ZTibgSMFBOBSlqrfKu7FxPbzJTVBU+8JM9hAC8Z3+VOBRkbKQDiUbpK4:wcSMFYhKkxpTKJM9mCw3+VOMWAPbpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274834, "uuid": "214cfa8a-a1d8-4d4f-bed3-86368be9f39f", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274834, "uuid": "49b43cdf-f6d2-49ba-a367-4ef1b0215d40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274834, "uuid": "57e81254-7537-43ad-86c5-d8c6d6c6be6f", "value": "826e72b5dac3311fcad8dda44a0d40788fed28c25d9fef8c6f0f2209d4771f37.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b4bb79-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274368, "uuid": "52c388c3-aab1-4885-828d-7c5c914e3f74", "comment": "Malware payload", "value": "54847eaa4c8d7aa7ba488a710bc0daed", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274368, "uuid": "ddadd035-5e14-4c82-81cb-0c98dc882938", "comment": "Malware payload", "value": "82a06bc531e71811802b8c659c6ba5ba66ac0e24768b889b6528654782ab8de1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274368, "uuid": "43361fb1-fedf-4774-b935-bd21352230df", "comment": "Malware payload", "value": "9aa37ea7f18c7c2fea53390a16cd4c5291fd071b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274368, "uuid": "e37152fb-463c-484c-bcfa-4e9699e9bbdf", "comment": "Malware payload", "value": "a70c7e1a3f7e75d28af134d870f24a13c8800c78a188b176eeee453d575a09f96a1de140d4359fc50b484ad52220f145", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274368, "uuid": "bde98119-493e-4029-8de9-79294cfda830", "value": "T1C6A4232CED518A3279E7B6A4DE5C5E020170F6432B95DA768C2F32C8D96FC241DEA18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274368, "uuid": "52dabbf3-1e95-479a-b7f1-404265ff3bc7", "value": "12288:fzYfcEaN9B/Jm0LU0gM7aQ3GmVCSkZ0HbJi:cfclN9BhmSHtGuFm+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274368, "uuid": "50f3d155-c77c-4235-8597-897283de10af", "value": 475735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274368, "uuid": "7420bd2f-c568-45c5-80ca-c727cc9935a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274368, "uuid": "a7f580b8-895d-4043-8249-f0a90ef95016", "value": "82a06bc531e71811802b8c659c6ba5ba66ac0e24768b889b6528654782ab8de1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b58cbe9-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275582, "uuid": "341ba39d-3fa3-481c-9e57-350f665db0f8", "comment": "Malware payload", "value": "8b579e7322ecdaee6eb959bb2fd8b6d3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275582, "uuid": "ee4bebd0-6317-425c-8e3a-482ae6b47943", "comment": "Malware payload", "value": "82c95a86ad06bd9a6d36d40ef41d2ead21a4ab8f17e7a8c261604b8aaffc9e7e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275582, "uuid": "4245832d-614f-410f-a737-32e0a6cbfeea", "comment": "Malware payload", "value": "46e4bf28496fee7a813a0f5ed0dc154981171417", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275582, "uuid": "059131cf-fd1f-48dd-b7aa-c374fb62a0c6", "comment": "Malware payload", "value": "91973cec7ffafb1af073088e9d70a7d9cb2299bc72bff237e54d2c6b34f8c02d5f68cbd203d1c8c91b2a7d651f89c1c6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275582, "uuid": "9bbac9d0-af0c-472d-b10f-2c90cde14dc8", "value": "T16CB423CE5A286CAC5BE89E838F5DBFDA2CF8413F861411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275582, "uuid": "2b684dc2-2341-41b3-8020-ca0a72027bb4", "value": "12288:zGRl4nbDDGIabs/7iiEVwYg2l3/2NHuy+wK8a:rTabs/7iiWw0K5xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275582, "uuid": "bc2d4fee-699b-480c-81da-0b9911a31412", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275582, "uuid": "59bb4cbe-cacf-4464-b5b1-633cc325c304", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275582, "uuid": "8b1b14cd-b322-4b3a-a749-b22482416f7b", "value": "82c95a86ad06bd9a6d36d40ef41d2ead21a4ab8f17e7a8c261604b8aaffc9e7e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49d1bdb-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303112, "uuid": "f6ff01e9-2942-4d93-a383-05b2c040b744", "comment": "Malware payload (Mirai)", "value": "1dcc039d5715eb5b8f90aeb42c3446eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303112, "uuid": "fedaaaf3-ae74-4146-86d5-3e0daa83d5bc", "comment": "Malware payload (Mirai)", "value": "8329b5cc22f4fca514575565c7736998520256a980cd49e010862c297c836674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303112, "uuid": "86dccdc5-1c52-4d35-a5d5-80f3f4ce8bce", "comment": "Malware payload (Mirai)", "value": "96fdbfa40c21e5671b4bb4109a5101c7c83064b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303112, "uuid": "f7aa2f44-c756-4b40-bb9d-9ff5e5968d88", "comment": "Malware payload (Mirai)", "value": "35424fe6a87d5fad9ba5328b4d4ba1ef9f33af9bb437c3368c84501dad3df8f113631a4c82fd451ab57cbcc515484511", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303112, "uuid": "0b579068-143a-42f0-9db9-f5c3ea5d34b2", "value": "T161148D3177264953C7621BB48A6B17B0E3A1549100B4E62B2F49BB132EF377768CFB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303112, "uuid": "15b700e1-b93b-4481-9a08-7faf3e30ced3", "value": "3072:t9e8y0Zwo2q76sO3XsGlT27QlZMX0ViC0LCW42g+IB1zmjXzIiCFNPfoKagVCT1i:t9e8IxtucD2CeGaXz6OMV4i0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303112, "uuid": "c50921ac-a759-45ce-8345-fea3ae88ff90", "value": 198392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303112, "uuid": "4aa2424d-69e6-49fe-bb81-6e7d90514c90", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303112, "uuid": "bf51bc3a-0518-4f61-b177-d765edacf0f1", "value": "flutter.ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bda1215-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250618, "uuid": "56a8dca8-7538-42d5-a649-bbb3b9385a38", "comment": "Malware payload (Mirai)", "value": "4aa0bae3b7457387ccab188e1efa2917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250618, "uuid": "56669806-02b9-4c8a-98fc-69e3fcdc03b7", "comment": "Malware payload (Mirai)", "value": "836779b889eb95b448d74c2704f05bddcb7e621dc3a6a45cafe2634f9ba6def7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250618, "uuid": "5565cb0c-021d-4c32-94a8-55bf5c568126", "comment": "Malware payload (Mirai)", "value": "d44ef65e72e2462e676966786fe43915d0a2b357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250618, "uuid": "30fa0827-7cff-40dd-b343-ca9737c327a7", "comment": "Malware payload (Mirai)", "value": "d7e66c1f080c04340468de4c4dd4e4fa8ff7f94490f08e48214f97015621c4d7ff850b08c081aba8f8e70ed9626c994a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250618, "uuid": "d8b236ab-416c-4fdb-8576-2883b0358768", "value": "T13D63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250618, "uuid": "6bbc4db0-7c74-4706-80f4-55f25c7aafb2", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAE:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzPL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250618, "uuid": "787bdcc0-0ed8-4e28-92a1-4e83645ed3d3", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250618, "uuid": "14c5a966-d7b8-45e6-b5ac-68bd8f3fcce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250618, "uuid": "b64581ca-42f6-40d1-a45f-a75ee89a1317", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a4f710-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791273422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273422, "uuid": "31a07fc7-d259-463f-9cc5-957b6a322540", "comment": "Malware payload (LxBaseRAT)", "value": "2eb971d1148db1c5e8f776e59f651329", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273422, "uuid": "fc774477-0322-4218-9af8-1a6fa4052edd", "comment": "Malware payload (LxBaseRAT)", "value": "839a16c3221005c8749339391b83580ae447138016dd8443bf19eaa1b23e2fc0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273422, "uuid": "f168dcc2-23f0-4cad-9d3e-ab1ba219270d", "comment": "Malware payload (LxBaseRAT)", "value": "32a7770f3ba4d2e6e319773b13ceebd4977a8ce2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273422, "uuid": "a155e6cf-fb20-4356-b3e5-1cfc04cfcf44", "comment": "Malware payload (LxBaseRAT)", "value": "f51e2488f0a0895446c736b2e0b64d9ce571794d0f6fa3be64c91df191bd60a1a6ad3124e5cb087cdb9d2f152a2b1268", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273422, "uuid": "2db940ac-42c6-48af-a657-a57c0fd29fcb", "value": "T186355A5203851BBDF68D0EC5C95B245B20F2E9677D241258EFB36EE7BC3B984943063A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273422, "uuid": "8c562438-1c9a-4d06-a11e-467229d72608", "value": "1536:llBHdCjZRuoVL1h5JhytpaoHsG0KyMjZvNGH3AYfam+PXjMQwDAMXyMJTpHcn2rK:GrJ1DmtHXknyZFm1Y/Lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273422, "uuid": "747c29e4-9c3c-4e83-959e-0c72fa3fdcc2", "value": 1115484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273422, "uuid": "2533b0d9-42d6-47dd-824f-bc21c2e70db3", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273422, "uuid": "7468f09c-5cbb-41b7-861e-f5fe5c92c955", "value": "\u0391\u03a0\u039f\u0394\u0395\u0399\u039e\u0397 \u03a0\u0391\u03a1\u0391\u0394\u039f\u03a3\u0397\u03a3-_c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fc7449-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275444, "uuid": "7b34c0ae-8aa4-4b02-a3c7-6092901b86d0", "comment": "Malware payload", "value": "3343d326196c7a32b52eefb33f27c2bc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275444, "uuid": "3cc005da-3f2b-435b-992c-8a4d7f3c6c25", "comment": "Malware payload", "value": "857b9e024b62a78f9fb472c8720032b76347be6193252ca11f5cf2e42b731b25", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275444, "uuid": "31ddb8c1-fcd2-4a98-b35a-7b2bb83adcae", "comment": "Malware payload", "value": "cc587db21d9532e151418fa8c085e086cadccd8f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275444, "uuid": "634782fe-56a0-40d7-b88b-03f0de092bb5", "comment": "Malware payload", "value": "0ee2b268f98f7ccf1f2d63048eb16a330d345de68d451990bef0d55f3f5f8e847bf528f7739e2f1a4542cdf821ccdba1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275444, "uuid": "06a5be9b-5754-4236-8323-3d24db6bf62f", "value": "T1BFA4238274716D06D096CFBDD4C1AACAD06A023D352A3BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275444, "uuid": "88807e62-75d5-49f1-a2a1-4012d058b5a9", "value": "12288:sr06AUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZm:sr06AUv4t1cNk/wjibhv4b2OnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275444, "uuid": "c40d7586-6add-4e44-9778-334a0bcf5327", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275444, "uuid": "d20acca7-42e9-492c-a17f-a8afd42c2404", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275444, "uuid": "41763217-0053-4bf6-bc43-7eebc017393e", "value": "857b9e024b62a78f9fb472c8720032b76347be6193252ca11f5cf2e42b731b25.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50648a51-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275483, "uuid": "0721e72f-c3b4-4960-95e9-e2b702616df0", "comment": "Malware payload", "value": "e273c8f146482bb5a29f6a160e71ebd7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275483, "uuid": "f3578674-7717-4ee2-8f77-1afede3f45af", "comment": "Malware payload", "value": "85897d4d060fab413867fc8f9569758cf028abd45893e52ab67b19a053601802", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275483, "uuid": "b7174cc4-d588-48ab-8a8a-a751ee9d5cd2", "comment": "Malware payload", "value": "c3017eca6136620c0b7e4b2db703bae0c353ebc5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275483, "uuid": "8b167273-004c-430c-9ce5-fe7c83fc4f41", "comment": "Malware payload", "value": "606695ce1669be660b0d387cf7c72f1e0dd80afe21cbedcb58f427f0cad5b4320ca652dbed4dda0e9526c223154727a7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275483, "uuid": "1c9222eb-9468-43cf-ab47-0c839f254e5d", "value": "T1FA55338B413C28C44F7D0B63BFFF855CA2259DFC104208676A594996783E7AF8A7099F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275483, "uuid": "453ef760-043b-4360-84d9-435a47b1b51b", "value": "24576:lw0w5MeYoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRc:3w5MeYoZ9bq+MmMEL+hcjXHC/wnwdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275483, "uuid": "868c0b51-ab52-46d1-bef1-e1e068b5c5fb", "value": 1397727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275483, "uuid": "5e1d8dea-1e45-41b6-8d6a-f4fef49e1d70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275483, "uuid": "8a7d782f-af5f-4361-b71d-6ab45be4d35e", "value": "85897d4d060fab413867fc8f9569758cf028abd45893e52ab67b19a053601802.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e645c701-c147-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791264997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264997, "uuid": "993898b0-3a94-437f-ab0e-5eaadb9b96d1", "comment": "Malware payload (Mirai)", "value": "5e2ef33a0f149f056123160a01706b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264997, "uuid": "1d9af86e-db30-46a0-8156-f1ac75ae8d72", "comment": "Malware payload (Mirai)", "value": "85bbef10b9c34d871c3e88667b0f02b012bcb731a2f9778f204b4099c9845902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264997, "uuid": "2ca7c9b6-831b-451b-98eb-174eee24aa75", "comment": "Malware payload (Mirai)", "value": "6c411bc221f4df832b6e206f3a8057d8cf99bc08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264997, "uuid": "a9d91299-09f9-4475-bcf0-a1ece1914089", "comment": "Malware payload (Mirai)", "value": "a1e98431b465f300b943db6d6a86cb96c2fbff4324f0e01f1aab3a08680f6163da6205de751a0be32eaefd76d3415c48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264997, "uuid": "409c0591-257f-4395-8c1b-9a4cff411c23", "value": "T1ACD309CEF801DE7AF50AA63AC4C30A17B270BB750A52D62172C7F96699371D43826FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264997, "uuid": "f5290cae-703b-46e8-94da-6598db9112b3", "value": "3072:0sJuuKdUMSpCvoTjjm9I+19+ky2BjZQvD7JoYWBthL15:JuuMzSZfm9t1py2XQvD7JoYWBthL15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264997, "uuid": "121f10ff-a365-4e9f-9777-46d798a88d01", "value": 134934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264997, "uuid": "18904f40-9b3c-41a7-bbf4-e334ec2b6f69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264997, "uuid": "854e32af-25c5-4778-bfc3-1aa80b30556a", "value": "kernal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b310da18-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271783, "uuid": "fc54724a-9326-48db-b815-3d6603291f6a", "comment": "Malware payload", "value": "25659c081229e6b95045276d5f010363", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271783, "uuid": "c5681033-4148-4114-ac14-d39bc45af26b", "comment": "Malware payload", "value": "85fd26b65b25652c793969c3244b06da8a3259c347c94410c8d7979e51123217", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271783, "uuid": "e83834df-71f9-4684-a464-4e99fb39a920", "comment": "Malware payload", "value": "dd6a95dcc589e0acdbc11ae894653f025e57955c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271783, "uuid": "6273c64f-bc4f-44d9-a957-ebf721c7c47a", "comment": "Malware payload", "value": "729d8baaee0855c48587370e7e59c64cad9ad41338a04413b939dc918ad8ad494b90cb639b94aa6b21f6c385866fa696", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271783, "uuid": "8227fbbd-4298-47e6-bcdd-9eebdae108b2", "value": "T1DDB4230A85D01FFF899ECB9946D4A4672FF467952F93565BC0CD20700AEA203E6EFC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271783, "uuid": "9c4ad159-7253-4ff3-853b-96e783345d1f", "value": "12288:7vOi3UDYXndLQ/jJOjB89RitlR0XjuIkVp69d3iY829uhBebY7vPpCkII:7WiEGnlQ/jwyil0X7kWv3icYeb9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271783, "uuid": "77e5a4d0-4fd4-45bf-bbba-2c47e90d4d2e", "value": 540419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271783, "uuid": "cbae6a4e-ea44-4f95-8813-5bb9f50bbcd5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271783, "uuid": "c4e035b1-4a37-4ed6-890c-9495ea4932ca", "value": "85fd26b65b25652c793969c3244b06da8a3259c347c94410c8d7979e51123217.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f106a8e-c12b-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791252610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791252610, "uuid": "e78c348b-5fca-47ee-8478-6b02e3207134", "comment": "Malware payload (ConnectWise)", "value": "3effb7b4d5b81a4936d3254f01093d11", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791252610, "uuid": "4dec062c-9983-479f-a402-9ccede4ec9a6", "comment": "Malware payload (ConnectWise)", "value": "86313a101f0fd884ea5bf11bb281b4e0c9faf4155cf1c46a4ddb0b8ba376632a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791252610, "uuid": "4b160b0d-fe17-478a-99b8-491b4447df2c", "comment": "Malware payload (ConnectWise)", "value": "3bcdf0127603aae16ec3839cb5600f0f6faa5056", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791252610, "uuid": "b1d03293-16b6-4e73-86ea-bd1344e62232", "comment": "Malware payload (ConnectWise)", "value": "fa88a1a92d7a3f70bb856d891422d88ffffc77fd718dad9c73ff77f8948e1dbf91e0211f2ff15af5306ee15b268b894f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791252610, "uuid": "162956fd-1089-4078-92cb-4430c1238786", "value": "T13146E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791252610, "uuid": "83404fa2-740b-4792-bf7e-3d45d2b86e33", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791252610, "uuid": "10946a01-e3c4-4811-98d6-27a1525ce296", "value": "98304:UzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:UhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791252610, "uuid": "74ba63c3-c9ee-44c9-b13a-f38963cf2235", "value": 5642216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791252610, "uuid": "53c70858-bbbe-4fd8-8c77-99b9b66af3c2", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791252610, "uuid": "592fc4c5-7562-4a13-96c3-6eea800d789b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f07edc-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275494, "uuid": "a05562e4-0e8d-4da8-941a-47527e94dadb", "comment": "Malware payload", "value": "5c347016f97d9f5947c4bae7865c0e0b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275494, "uuid": "d94755bb-b2b0-4bb2-a25f-a1abb3b40b87", "comment": "Malware payload", "value": "865f16471d7edcc551afb809883d415536a4b35df3af4e2d3aed97aed77e2bfb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275494, "uuid": "7bc3d602-74ec-45f8-98a4-3b3614124285", "comment": "Malware payload", "value": "8e4bbd4c18684c804138fc365fd3d0ca68d8c322", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275494, "uuid": "fa6cc239-9aee-4edd-a4f4-5c70cb290ad4", "comment": "Malware payload", "value": "1b0a3d97b66233fc71d76e6a7d539171cca84d012cce45966f13b4dd2c34c930a6213a87c2cf774f42e024b99bc0f8ff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275494, "uuid": "833083a5-63cf-444f-9e29-9e0281e5f8f3", "value": "T109A42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275494, "uuid": "8f5d719d-cd1d-48fb-b17f-b8113a20785d", "value": "12288:+SCDe0U+m1V6ECbniSPfS3e2R3feeintFckqTsuC8hHw:+De0wUTiSWzeeiKsP8dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275494, "uuid": "188f27b0-b85d-462b-b6f3-1caec8df6f94", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275494, "uuid": "fb84ccbd-2d7b-455a-9992-db0dcc3712f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275494, "uuid": "f055798f-f0ad-42a3-a640-37995e5fc710", "value": "865f16471d7edcc551afb809883d415536a4b35df3af4e2d3aed97aed77e2bfb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d5f339-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271679, "uuid": "08ca112c-62a7-451f-b39f-618e67f789e5", "comment": "Malware payload", "value": "6c250c075959e7da743b28bc714e2393", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271679, "uuid": "73e076a6-7a0c-417a-87ef-5194ceb3c1ec", "comment": "Malware payload", "value": "87e4fd832dfaa1f31f6511a48fda3e89a7c74f84fe9aedf9b8800056c709f6bb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271679, "uuid": "53c35dac-27be-4a03-9204-4db6ad2e5705", "comment": "Malware payload", "value": "846310569c06a98758f9f2eacfc92082e331fcfa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271679, "uuid": "b190e0cb-b567-491d-b22e-1adc9c09589c", "comment": "Malware payload", "value": "4fcec13bbfc645f8fe0465746fe014302f3779a49c2f7881f0b8394589680d15c911f9e9998ee81467de0c287d689f35", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271679, "uuid": "06fc3f7c-8722-4030-b02d-d4c6b90cd9d7", "value": "T1B87733F1B043895A9DC19CE0E6C5C144E28A41E5CA743EB7D17A53F6C2E7AC7A4E73A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271679, "uuid": "c12f869b-cfaa-48a4-839c-cea7d77bd691", "value": "786432:FCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ea1:UxbXnfCJMAYDi4D0C5Z9nT3D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271679, "uuid": "2fe0e8df-6a1b-4bfc-91bf-c2d5383b67ab", "value": 32868742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271679, "uuid": "1ee62b8a-a2be-415a-9088-6564616f4b34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271679, "uuid": "b956e594-37ad-4e67-ae56-a5c1aef022cd", "value": "LocalOffice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17660ce-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275646, "uuid": "ebc5dd0c-8a5c-4445-b384-253c8a9dfb28", "comment": "Malware payload", "value": "b2662fb8b18df05bd87f9501899fdcce", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275646, "uuid": "e9325928-1a5b-4d28-8d4c-21e679325b62", "comment": "Malware payload", "value": "8866a1de635151f0be9c2136d04d6fc49ac47abac93424b728742f5cb2ece1ef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275646, "uuid": "8ec5b68f-00e0-4193-a920-7e0a1907dfd3", "comment": "Malware payload", "value": "ff47a3a45379990efda3a248665dae39847e1e19", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275646, "uuid": "cbc7627a-cdf3-4af4-87e5-ee1b14b08dce", "comment": "Malware payload", "value": "608ac9902023594c5e624b8da428b9e2abf922028e06208cc7a457b35fb9f45ebf75295a325a1d8ec1d3d09a161d5e03", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275646, "uuid": "c80931b4-1179-4a6a-b679-dd53c80c6fda", "value": "T11EC42304340641D5835A2B1EAEC4E7E0BEB560DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275646, "uuid": "214f48e1-502e-4e99-b1ed-a031354ce70e", "value": "12288:D6wlOMWROC/FTeHo22Qm7NzofOr68mEeA924EwCu:74MQOC/gHozN7NzomW8aA9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275646, "uuid": "d8a1186b-5eb3-4b8e-b8e9-b93d793cbb24", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275646, "uuid": "200d0b3b-d815-4697-af54-a168ec3f203a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275646, "uuid": "ec5cfaf8-8441-4384-85b2-e5569d589c13", "value": "8866a1de635151f0be9c2136d04d6fc49ac47abac93424b728742f5cb2ece1ef.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5d2d62-c186-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791291802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291802, "uuid": "3ee644eb-e306-4647-a6d0-8a758ff45d4d", "comment": "Malware payload (Mirai)", "value": "96c0a6cc957ee2acc6a4c9deb7fecd64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291802, "uuid": "f4fe9c81-5057-405c-a76d-72835314633d", "comment": "Malware payload (Mirai)", "value": "886ed743464405a19ebc94656f03e79cac5285f2681ca4b184b790bc9af570b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291802, "uuid": "2b92dd83-0a2d-4b28-a62c-63db473596e1", "comment": "Malware payload (Mirai)", "value": "c0250f519e6a6fb336fbbf3d6cd3a7abe9871971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291802, "uuid": "979b7824-d2ef-4767-a2eb-a3518e323372", "comment": "Malware payload (Mirai)", "value": "972ea0b4615bea7a2419e541cd108d4c6dbb79df95f41e4fab9ce3259a87afa5e81dfedf285332702a93e0d91152fba1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291802, "uuid": "aa348ad4-3e66-4dce-8ae8-ee0c26e79b45", "value": "T1D583C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E640BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291802, "uuid": "efce2c1e-26fd-4887-acac-98e9bc08b13f", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoACEG:x/8RHTgMcJ0fmqJZOpkM/BG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791291802, "uuid": "837a6a19-27a1-4176-8088-2a283547d942", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791291802, "uuid": "5f797004-7aa6-4849-bd5d-5e9a0fc9f650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291802, "uuid": "5499a973-e2c1-4204-967a-728b85a01b57", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124cf17a-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274949, "uuid": "58ecca1b-e190-4a04-af0f-0b63318bd688", "comment": "Malware payload", "value": "c4e7b2e86b66d2e4746399cba22cedd0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274949, "uuid": "ce694aac-fbd3-4cfc-ae36-3d7654657953", "comment": "Malware payload", "value": "890aa4d5b8d4a0712f0ef9568dfdfbddec4fdbdc1ead1c31f4ec909a37f3e327", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274949, "uuid": "fbda9ed3-6669-4630-ab6c-6f88eb3c2d61", "comment": "Malware payload", "value": "d2293cfbf211640e2e77fed6ea38c906c9fba5db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274949, "uuid": "a92f7ab5-5796-4c7f-91c2-0302f4d03aa8", "comment": "Malware payload", "value": "bea583184c72ecae48e366aa1a5de3aa5d3f41fa389d9ac1e5f1df7f5f3faeef47342d534896c7743c01207f623676c0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274949, "uuid": "903ce17b-4da6-43ec-96ea-d6e4d295a513", "value": "T1CAC4239603689664787407B197BF9F8DC6028E1329921BFD9FC8BF0CA1356489D5FBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274949, "uuid": "2e2f8171-8c5b-4ab1-bb66-2b9626ab4c58", "value": "12288:mOCBcIqBNliubzqtYBpfsz4TKPozt4CTo4Pl/2Ar5G:mZ+mubzqyB9sz4TKPE1l/ZrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274949, "uuid": "97bf015a-61f1-4407-971d-9074d3810137", "value": 546982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274949, "uuid": "2d8765b1-7925-42bc-b42e-dacaba629eb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274949, "uuid": "d3932e84-80f9-44fb-a16c-2b0c093902e1", "value": "890aa4d5b8d4a0712f0ef9568dfdfbddec4fdbdc1ead1c31f4ec909a37f3e327.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd57550-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274163, "uuid": "50f4dc2a-9a03-4916-acca-ac4a4c2917b9", "comment": "Malware payload", "value": "1ed98198afb5017dafdbe8e3cb0d06d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274163, "uuid": "32889eca-08ee-49f1-aae1-e92a23fd6709", "comment": "Malware payload", "value": "89c47a8491ab94ec93803b5b164a4deb2f54ee4a94c8699dab496fb1ac7caa33", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274163, "uuid": "0f2d8ed2-dee8-4d22-8ec9-a2148f6f570c", "comment": "Malware payload", "value": "d7570e2cf03340b248cb6f877c1746dd6b20fb33", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274163, "uuid": "af8cd3e2-a370-4091-8cc9-6320d1caf85c", "comment": "Malware payload", "value": "309f0a90ed759803d8c43afa63a335f8fde41b69106da22e8687786b453f1cac0ee46c65e00de34e072258b849b37f4c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274163, "uuid": "ff2ff974-2011-4afb-95d3-5fcff80aa3e9", "value": "T13DC42304340651D5839A2B1EAEC4E6E0BEB560DBFA1CF940AADE7FD06DE52A173C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274163, "uuid": "277a6c90-4aa8-43ad-8c2f-a40303f0c445", "value": "12288:z6wlOMWROC/FTeHo22Qm7NzofOr68mHeA924EwCZ:r4MQOC/gHozN7NzomW8hA92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274163, "uuid": "56002f16-230f-4ad3-b01c-b54c41d024e5", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274163, "uuid": "44aa3225-ac8d-4762-84d3-5e83218c17f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274163, "uuid": "cd64069b-6e24-4e02-a892-3b81bf71b849", "value": "89c47a8491ab94ec93803b5b164a4deb2f54ee4a94c8699dab496fb1ac7caa33.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b164519-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276333, "uuid": "0def0bfc-200d-4a08-b212-d30753dfa1fc", "comment": "Malware payload", "value": "4e69421ba429e362a32bfd5ce6ea8e8e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276333, "uuid": "fb9a464d-a9ff-4b06-9644-f6d02d02fffc", "comment": "Malware payload", "value": "8a4099f3f17c991dd5dbf942455d217bc03aad48334960419615a4ce96bae8a8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276333, "uuid": "f0bf620b-9ec7-49a3-92b4-d71dde5fdee8", "comment": "Malware payload", "value": "586e29db285192ab870581ea5da1936ed1c7f9ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276333, "uuid": "3ef35822-2ae1-48dc-aae6-dbfc01503d24", "comment": "Malware payload", "value": "dd716a019520fc31a47fa91e3f6a9843180cac4e02bc98cc46e4a37da48b4f75eea171f4a307730e807b8925673914d1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276333, "uuid": "c4057dd3-3082-4483-8e50-4194ca49c88e", "value": "T183A4239581B987533484E3B5497B1AEA5F301CF28D3D674F88DAC5F80B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276333, "uuid": "b855a8bd-5e3b-46ed-89b7-fcc36b8a732c", "value": "12288:PcbSCDe0U+m1V6ECbniSPfS3e2R3feeintFck+:QDe0wUTiSWzeei+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276333, "uuid": "25ee99b9-9c0b-480d-b0e3-85cfc12b7d1b", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276333, "uuid": "bd402d7a-3994-492a-ae5f-e2f6a685579b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276333, "uuid": "7ec4dc95-9137-4c9f-ab76-8470a32f18ed", "value": "8a4099f3f17c991dd5dbf942455d217bc03aad48334960419615a4ce96bae8a8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d756da63-c17c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791287735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287735, "uuid": "860fa6c5-82e2-4464-8b6a-d35f77e473d6", "comment": "Malware payload", "value": "c23720bc3f8b79506f75e2b0b16e77ec", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287735, "uuid": "38c0ab73-2a3a-4912-b9fd-d7bee39e7972", "comment": "Malware payload", "value": "8a46e1e6618195522b92f36336334029a0c6ddecc8212384403a7517023a1461", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287735, "uuid": "4549588c-3092-4763-ba10-19dc8b12f1a7", "comment": "Malware payload", "value": "fa8e8927f9a2aefd04e65353b49037b6c6ac2aca", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287735, "uuid": "d8e3f2b2-955e-44a9-9304-602baea7db59", "comment": "Malware payload", "value": "3af3129d722ff572f20529a458eab0806fdf25eb30c5e8f5442f9e3671c2180836e90747bcd9ac118ae3de0ddcf83151", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287735, "uuid": "3d110ba6-bcfa-40fe-9d22-7acfe1e476d5", "value": "T1E25683DB3BC807E8AA688EED4206359A1AE1D17F2EBF114C52E1492B742FD1375E0D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287735, "uuid": "76d82800-1e98-4738-af1b-1e66063dfb5a", "value": "12288:A3t1v3fiCUT8FShN4eh6q7zzEH7q25DXblO1d9sxHN01+szWNFLzcTTMwXXTTwny:e1vuTrbQm9sX0Tz2zcTTpTMt+HtlDfgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287735, "uuid": "0b7acb87-e029-4c6e-a49f-6327868cf63e", "value": 6368573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287735, "uuid": "1e53e721-9e12-4eea-9c66-a2fde7b3db7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287735, "uuid": "03b439d1-5919-41d7-81d8-a70d8929e857", "value": "cinstall.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aad0bf4-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273326, "uuid": "ae56c57e-fe6e-418b-b1c2-7176ccbafc28", "comment": "Malware payload", "value": "f517bb124f0b76b32ba7998860a1d61e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273326, "uuid": "7544e148-4db6-4776-867b-9e070ebe0b1c", "comment": "Malware payload", "value": "8a5633acd7fb03ea8fe71e3c2ed06aa61796340a2b23167417b1472553791259", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273326, "uuid": "b310bdb9-4670-4dee-9ca6-ee31ce8e04d3", "comment": "Malware payload", "value": "9d6b0e42a84c1939f86138a41e6756165c768e39", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273326, "uuid": "f9749134-999c-4672-bf20-7ef1bc37cea2", "comment": "Malware payload", "value": "3acb1f7a50c92d52101fc3eb8a6650c8f43801d3b052f43921aa94d3a113492b1e44f607aeec240bcf2b86adee25b75a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273326, "uuid": "5c1d2e41-b473-44b7-b396-1ad28e202c98", "value": "T100F0399126FA5208B2B7B708AE7624310E37BB96E574CA8C4254291D09F2E588DD3F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273326, "uuid": "2cf36e0c-09ba-4a56-b16a-1bf6e8fc198e", "value": "12:QqE1cCRcx8wRLBoXI/QFx9IWN1cCR0l9IKvR+yIRAKlfv:QqELaKg28JfKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273326, "uuid": "a4dcb9e8-f81e-4348-9d0a-6f78fee42011", "value": 480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273326, "uuid": "ccb900f7-d43d-49c4-8ed3-e3b19d0632d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273326, "uuid": "23b80485-a3fa-4717-8457-33340d2da0f7", "value": "OUSTANDING INVOICE 1052026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff78e29b-c186-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791292098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292098, "uuid": "b09cdd0d-49e7-4239-85c6-a71043a5f30a", "comment": "Malware payload (Mirai)", "value": "299ba05745bfba3bc0ca811d3bd16259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292098, "uuid": "2195cdc1-04d4-4e79-a824-2f1d028cdbd6", "comment": "Malware payload (Mirai)", "value": "8a91cc58d4aeee7e1737a41c762824dfb80e240ada91cb2e3439da71eb008bd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292098, "uuid": "aebf4e82-e3e5-42be-b7b4-9f0f3a1991a4", "comment": "Malware payload (Mirai)", "value": "abf057060b2c460f7d2ce65fa10abc98ae2cc8e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292098, "uuid": "3dd2fa95-e79f-4a75-af3b-3a2d2edf48db", "comment": "Malware payload (Mirai)", "value": "13459a9197c17b5a17dfee172cfc9e9618a419518944096b3cbb3a048538e834f50656b5f98ac63e4e950b1a642c2650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292098, "uuid": "f8ac4029-9e90-4d35-9213-a6821345e2ef", "value": "T1CA732A57BA4180FEC499C03843BEBA36D87274FE1379729A13D8FE366D56E601E28C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292098, "uuid": "781f4c60-1937-44eb-b7ea-052c482435f4", "value": "1536:BzIDxEwvZ8b7RRINkGIb/+w4HnC+8l8AnzcUS:BUxEyZKDIWGIf4HT8l8AzcUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791292098, "uuid": "d30a04e9-ce69-45e0-9453-b369346dd709", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791292098, "uuid": "8667b579-932a-4355-96b4-056f15ac471d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292098, "uuid": "e15eb7a0-5c56-416c-a80f-19187cfb4136", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be261ca7-c141-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791262353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262353, "uuid": "6a1b4338-af77-408d-9518-26b36482c34d", "comment": "Malware payload (ConnectWise)", "value": "b11a75c9d60e50866ba0d84af1a155c6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262353, "uuid": "548db575-4aea-4fca-beff-e836e627195f", "comment": "Malware payload (ConnectWise)", "value": "8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262353, "uuid": "1c11f1bc-8a86-4456-a79f-3276977c3f4f", "comment": "Malware payload (ConnectWise)", "value": "e8dd5f0906fca19559908d27f0ed3c55fdfdfbed", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262353, "uuid": "f95f74a6-d11e-4b64-b199-3d2bdb6964d9", "comment": "Malware payload (ConnectWise)", "value": "f29c8cd6feb0e2c80d566cfce5215d8b2807bc4b2ed2d765be1d85a1a99a56d0e75bfd0e4684a99454d5bf833b52f155", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262353, "uuid": "fd54c4ce-7517-4523-8e83-88c08e147f3f", "value": "T166646C11B9C48432C673383107B9E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262353, "uuid": "e57ae791-c5f0-4467-b65f-177b8a74d77d", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262353, "uuid": "5c54d4c3-f550-42c1-b2d6-51a1d161d635", "value": "6144:dmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti99d:Y1iw7gryNkSV1hy1Z1u2JLI9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262353, "uuid": "bb7e4a36-2fa1-456b-a321-9079225963dd", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262353, "uuid": "3dc3cd71-4835-46eb-85b8-15e81b0310a9", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262353, "uuid": "afeca29f-a754-411c-b8de-7e1a8a9f07c7", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea95de5-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275024, "uuid": "06029078-a254-4609-8be0-3e6f82f9c323", "comment": "Malware payload", "value": "1a143828529af52bb5a7cb47125906bf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275024, "uuid": "f9ba834a-2f10-42dc-871a-8d23b2b43bcb", "comment": "Malware payload", "value": "8b176b819aebaacf33e9f4b74694add8fe9d842b2c1b079a1ab76d47979b5068", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275024, "uuid": "fd8c0465-729f-4e25-bfee-4080eea2f32e", "comment": "Malware payload", "value": "b506618f60e44cc8643abe36f1b3023b3d437de4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275024, "uuid": "7cacc83b-a02b-488e-8270-768e4142ac52", "comment": "Malware payload", "value": "baaa6a28f7e84e4f862763c6f797ef8eb25f7602f8b0977622202d71a18290d2933b12ac23fff92446a1bc08b063f0e6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275024, "uuid": "2be2f461-396a-4d49-9c3c-53b03b5c260b", "value": "T148B42369227F71900C7543A94B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB195638E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275024, "uuid": "643ca4cc-2d7e-4916-ae9c-c12496811818", "value": "12288:87JZAaFpePqO3g/ALyYG0ZaDajTCXMO8xzDOe3WM:4LpeDA/f0Za6TCXKBxmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275024, "uuid": "da5e03e6-0c32-443c-8f53-80c8c8047c40", "value": 542164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275024, "uuid": "e15886f6-9ba0-496b-98ea-e2711a6b4993", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275024, "uuid": "8c27fa46-4186-44f0-9283-1cc2ca426bc5", "value": "8b176b819aebaacf33e9f4b74694add8fe9d842b2c1b079a1ab76d47979b5068.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae8f6c2-c14e-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791267689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267689, "uuid": "754cb98b-5f31-4e20-b8c3-f40386435eb1", "comment": "Malware payload (PureLogsStealer)", "value": "453bd433529cdfa321bb191dd7e0731d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267689, "uuid": "e1184f89-2141-4b5a-ba97-4b87ce965581", "comment": "Malware payload (PureLogsStealer)", "value": "8b1da96018438afda26a12929595da9fba9f20ec7359eda0643937c4fcb4a31b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267689, "uuid": "2ce5bbd8-32e8-415a-83e2-cb92049c2bb9", "comment": "Malware payload (PureLogsStealer)", "value": "2a2d9af7d151d10f4f36be17fbc2055dc0b0d915", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267689, "uuid": "8498d240-46d2-47dc-a52e-5cfa9880d206", "comment": "Malware payload (PureLogsStealer)", "value": "515288743a66bcf6f41a3fa8c31dc0acaaf28620e5ae7e3e0368c7b82491da58e9eb90f3451b02fb090eee52b657a9ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267689, "uuid": "c47e1c26-5985-43d3-819e-09d33e5c5e5b", "value": "T16B651259123605E50FA843A71AFF0B0A55FFE9C39B0CD6C5D1BADAB52268487C0F2DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267689, "uuid": "43a55d74-a63f-4d65-9543-2e16d59a5e4e", "value": "24576:dX5ByVjf2O1QLEjxHYoA+I8UBI3AUZFfjf3RApgqP/mfBcsKTpvCm137xS7G:l4zQgjxH9AU1JhM+hIpX13D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791267689, "uuid": "b2d835ce-31a3-4afc-8fdd-cc50786b8d4d", "value": 1510063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791267689, "uuid": "9679e47f-4dfd-41e0-a647-ff5ea4c21a8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267689, "uuid": "4e332029-8e0f-4da8-a3e5-fef64081a2e2", "value": "Sales_Contract_67992_for_Approval_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca813b7-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275960, "uuid": "8db4c132-b948-43d2-88ad-cf648d030b2c", "comment": "Malware payload", "value": "31266a63807af13662abfdd5e3f463dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275960, "uuid": "21b7f936-93d3-4c3a-ac50-5d284ef5563f", "comment": "Malware payload", "value": "8b45abc9be1e58a1c083f85016c5df2b57e0a2059605a9c5a3746fbff8c3fb9b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275960, "uuid": "f846c55f-0b79-4c4e-9b34-790fe516c3cd", "comment": "Malware payload", "value": "e8e9f0454b1f05a869a71e4e79df4a0b1a121c31", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275960, "uuid": "326bd462-e633-403a-9db3-df5476c6f544", "comment": "Malware payload", "value": "933c5f67e802ed64aa9e8e57659e3b96fd8f212452bcae50b3e3b386fe3d7893dcea9d044b70410acc5ec0d34b210b73", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275960, "uuid": "78ac9502-564c-4ea3-8dd0-ead4fe069915", "value": "T100553387813C29884F3D0BB367FF955CA2248EFC100309675E2A9857363F79F866599B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275960, "uuid": "d35f8110-a0e0-4fb5-a171-d8682632d10a", "value": "24576:6jqZmcpuioZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR+:iioZ9bq+MmMEL+hcjXHC/wnwd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275960, "uuid": "b1fc0c9c-d399-4255-9d56-313937e7d38b", "value": 1394887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275960, "uuid": "114d2262-b195-4865-b29f-5ea95e63ad80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275960, "uuid": "ee74cd27-cb7e-4e03-afac-f756f78ea18c", "value": "8b45abc9be1e58a1c083f85016c5df2b57e0a2059605a9c5a3746fbff8c3fb9b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d153d08-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275075, "uuid": "9d5ae329-a596-4abf-bd92-8777b76c042c", "comment": "Malware payload", "value": "34513aaa4f36ad70aa35ab757d9ceedc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275075, "uuid": "b381579d-b444-4545-84e7-118b3934b9d5", "comment": "Malware payload", "value": "8b76e3aff0b62df40b08873c41944b11d5c386ed3f1a35e2dbdaa7830dc30674", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275075, "uuid": "4e0c90de-f8e0-4ace-a1ee-379314b79762", "comment": "Malware payload", "value": "5900de6c1493f9f9a8dc449f1fff99bb9eadacf9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275075, "uuid": "d59672f6-0f37-4ec5-9a02-14e87f051ec7", "comment": "Malware payload", "value": "d41c190c224d50caf9be20927d437ec7f3eae2ed45c09908f6e8e56a2b282f3d329234c8a8589c71e5c02ca6108cf375", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275075, "uuid": "3508489f-f39a-4a07-98c2-9b1442ad8126", "value": "T13855338A817C19C84F7D0B56B7FF865CB10A8EFC100218B32B5A44EB793D7DBC26459A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275075, "uuid": "ca952129-0412-4929-acdb-11dfa37c0e57", "value": "24576:FPsS0kJQHhpjsoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRt:4kJQrsoZ9bq+MmMEL+hcjXHC/wnwdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275075, "uuid": "25f51245-8f76-4e1a-81c0-58a7be4234ba", "value": 1394813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275075, "uuid": "93448db3-fe8f-4737-8d2b-0a2c183b3f7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275075, "uuid": "396c926b-814b-4a1c-a8a6-ddd5a9ad8cb5", "value": "8b76e3aff0b62df40b08873c41944b11d5c386ed3f1a35e2dbdaa7830dc30674.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fc56a8-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273915, "uuid": "7019381f-3f45-4e32-b374-46f6bad620d4", "comment": "Malware payload", "value": "83b87f28cc87df895c16043b1c64acfa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273915, "uuid": "4bb767a4-3865-4ea5-8a40-99a6835cc0d8", "comment": "Malware payload", "value": "8b89040e0fe0b31459c1cc84871e2be7f74dc3e25184904fafc673e311add822", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273915, "uuid": "e3cdbfd8-a167-4477-ae23-fa10cf1ff5d3", "comment": "Malware payload", "value": "5bd2ca69a9a1caea0cfe184a9c68bbc17a40acf7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273915, "uuid": "96fd73c7-2940-4a5b-903f-1e2f0d332943", "comment": "Malware payload", "value": "ed2432e0fdeea1616654d6f3c704d95cbf403e2127ab0f3cfd550eb74a7e64f17844fc02f7af76effecdc2cfbb3ba838", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273915, "uuid": "13ac885b-6aac-4ea7-a70b-ef4bde54f9f9", "value": "T145B423CD64BED0A87A658DDA9FD8FFD30CFC00366D7526F2A51C1A13A1C404B64E958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273915, "uuid": "96e5ce4a-0eab-4505-b5e4-e51ccb18aac8", "value": "12288:WB/e4pqNFTFbEXkNDoGbDDGIabs/7iiEVwYg2l3/2Nyq:WBm4pgTXoGTabs/7iiWw0Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273915, "uuid": "d70fd732-1656-45a6-8a98-e6d7addc6878", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273915, "uuid": "5319d11d-1087-4de7-b71c-b9704c671a40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273915, "uuid": "3284fcb6-1a7b-4448-b1ea-d89d1835fcca", "value": "8b89040e0fe0b31459c1cc84871e2be7f74dc3e25184904fafc673e311add822.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4942baee-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274183, "uuid": "ca362278-85d2-40d4-8258-ef83611b150e", "comment": "Malware payload", "value": "c4221c3ae67ac3c6b7efdf6fe343103d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274183, "uuid": "5382c1c2-c49a-4062-9604-94ed73cab481", "comment": "Malware payload", "value": "8be7ba83a9b487ed92b0e6da5af8f937f0c8507f7683881cdb9abacb28f4b737", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274183, "uuid": "bde6a00f-96e3-4686-a3ff-9a4c79d61390", "comment": "Malware payload", "value": "4721babce70af2dd85c08b9690df29d7c4422666", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274183, "uuid": "b9b09b1a-138a-463f-9ab1-4fa1200d1bf6", "comment": "Malware payload", "value": "b0c40f3998054c75f7c9f0afc4eaf961e49f155595ee86654eab15901c8a4a8b6fedd0b021f0dc00327330d6626e8a00", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274183, "uuid": "d285034e-a38e-45e4-a02d-30a033c3d806", "value": "T19E553387817C14848F7D07677BFFD46C62248EFC200608261B6A189B693F79FC6B596B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274183, "uuid": "bfdd1703-9bf0-4139-ba56-a18cf4b275d1", "value": "24576:/emeYTqfYHoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRu:/eVwqwHoZ9bq+MmMEL+hcjXHC/wnwdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274183, "uuid": "71c7239b-27c7-42ce-9f79-72011fc59fd5", "value": 1388883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274183, "uuid": "0a6f9880-e435-4598-90e2-4e2864d2f02c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274183, "uuid": "64641c86-e0a5-4799-9daf-17b176063829", "value": "8be7ba83a9b487ed92b0e6da5af8f937f0c8507f7683881cdb9abacb28f4b737.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e73d19b-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791273386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273386, "uuid": "7cd546ee-9488-4227-8de2-043a77cf5447", "comment": "Malware payload (AsyncRAT)", "value": "64af200cf9d76ab0731f04e6cd88f4bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273386, "uuid": "d31bb818-ea62-4313-a952-171688bcac8c", "comment": "Malware payload (AsyncRAT)", "value": "8c122ed08af392482b311e02f2a432044e8f9f7cb027a9f31f959a5d7286646b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273386, "uuid": "a980f862-803e-440a-a3f6-d7e10a3a4c3b", "comment": "Malware payload (AsyncRAT)", "value": "914d111b88fe352220dbcc5723daae569b47a220", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273386, "uuid": "1610c104-944d-44b7-9a17-5e0be26bac6c", "comment": "Malware payload (AsyncRAT)", "value": "aaebff7dc03b6abfe60d05db80968454ded67354517c2ee53feade508131151e64623a9b170f18745e997e703312a13a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273386, "uuid": "a7811c2b-a101-4ab9-ad19-6c19d35a160a", "value": "T171E226A059722038FE71DDD03EE650680EBF5C59B47F0A04BA880BAE4F929CFE5F9515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273386, "uuid": "1fe67e5a-8313-45a0-93d9-b62b7591531d", "value": "384:3Yy2mKsnCD4tDan6ucJ6G538+H5UsohXFL:3YQmj6FJd38+H5V8VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273386, "uuid": "2b25d930-5506-4ecd-9f5a-a857085c4433", "value": 32030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273386, "uuid": "3f38d304-8a5f-465c-9fae-0be06d7bc71c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273386, "uuid": "af04d09f-a0e0-48da-9c4d-6b1932e5b09d", "value": "Sinoma-PO-349091.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f8cfe0-c190-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791296137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296137, "uuid": "c8d7f6b1-5dc3-455a-9362-0d5ef2452db8", "comment": "Malware payload (Mirai)", "value": "4a20b11ae3a3ea9dd35a1310bf30e4ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296137, "uuid": "9b930ac3-ad3b-41a4-9950-48e6775ee65d", "comment": "Malware payload (Mirai)", "value": "8c926fe5d9c9df2dfaf1a9ba47d956425b787d94e030c6e21b47d081bac2ebe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296137, "uuid": "089fb07f-66a9-4405-8f81-9bd83a213d63", "comment": "Malware payload (Mirai)", "value": "abf96ec563526e8b6251ff65e8fde0f8d1221d52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296137, "uuid": "23facabc-5668-4700-8195-4432e09142b9", "comment": "Malware payload (Mirai)", "value": "59a6f9ca7e4e646f5c80c0a80db858bc590626da26a623bf4ac1fc8a4fe0a61f5bd57ff3d1ae30440449b776192b7929", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296137, "uuid": "03757068-7815-47ac-920c-8a0755ef1c4f", "value": "T118C48D03AAA3EDB1D4A380B151565FBA4971D537247BD84FDBD62CA4DE205C0A32C3BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296137, "uuid": "324040de-571f-4b27-9889-62c65099bc56", "value": "6144:aolk7SQmUi5P/wgejLuqvSjuaHWy+UsJtEvwaZCkdd4rlp7EqTTfJbu:5lknIP/wge2q8JGOlT3dqfxbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791296137, "uuid": "8ffff0d9-e046-46c3-ae74-73f637b21d06", "value": 582968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791296137, "uuid": "a532340b-e0e1-4378-b509-d776cbed3c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296137, "uuid": "548d7cb0-e0dc-492c-bb89-8bc34ac7e253", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e864ce-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273375, "uuid": "9bd08ea8-8928-465e-a4d5-8f28a84aa816", "comment": "Malware payload", "value": "a721d3c2ddebf994b77d825268024ab4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273375, "uuid": "8e0d3220-b3bd-4a96-b6a3-796f1482042d", "comment": "Malware payload", "value": "8cccf870b895a32fde36e5215d83435785e44d77c7fe5168f572d53e98e09f8c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273375, "uuid": "c3788184-5fd4-44a5-98b0-e478d6d7484a", "comment": "Malware payload", "value": "0b1f3b4e62560d21b1fa99c6c844a199b720a2cf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273375, "uuid": "bb9d712c-53ac-4868-a90a-4de2183fe194", "comment": "Malware payload", "value": "843df6ca190c6508e069f18f3376d2ef2a501e25f17de7ff0803729e5841cd626ad85055558fd52394e357a94d21364e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273375, "uuid": "8b6be6e1-d743-4c07-bf85-cf1f57d22133", "value": "T1D555338AC17C1CC49F3E0AD779FF555CA2248EFC200208636B2A59A7253E74FC7B595A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273375, "uuid": "7b0b308b-ea30-4393-8ac1-6ce22120bd39", "value": "24576:CPTJsZg55SoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRq:CbJZ5SoZ9bq+MmMEL+hcjXHC/wnwdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273375, "uuid": "f519d644-173d-4a17-a5a2-749e46d4a730", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273375, "uuid": "58f7f241-b9a3-45f2-84b2-35d3621674ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273375, "uuid": "76af0502-e6ef-466c-8efe-96c3a5db28f8", "value": "8cccf870b895a32fde36e5215d83435785e44d77c7fe5168f572d53e98e09f8c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737a2670-c19d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301741, "uuid": "7105ae16-493e-422e-a5cb-fde6c3c3eef9", "comment": "Malware payload", "value": "a3cea4476fbcfa0d4ae7a333927882bf", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301741, "uuid": "c9392b64-e5fc-4852-ac94-336b04ac6c9d", "comment": "Malware payload", "value": "8d4a8f45d5af5f016bbb1b89705fa8b0c745dc7f390176c82c8b0ab18d1ee512", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301741, "uuid": "5cc2e42c-d809-4028-b27b-4c490c347c7e", "comment": "Malware payload", "value": "938ed6a5ff87615f028af29a692763b67afe6e3e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301741, "uuid": "0ef747cc-a256-4136-867c-5432f40f74d7", "comment": "Malware payload", "value": "f9daca8c1fd3830ab5861bb157800ca0256f3dbc43b2ed03fc9749d38db8f4f9efa18ad34f0f0625dbc695f9a1d344ec", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301741, "uuid": "7a8e47f6-8d5a-4def-a420-cce5bd5cdaec", "value": "T1E8B5235AA25C45B5CC6F727373218EB2E98F058D8509F07702BD05CE08D7DA847EEAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301741, "uuid": "3ad24648-e4c2-40ce-bd3e-8086dcf6bea7", "value": "49152:HzXAk8j60r+pjcup2YYNy+582DLtpoceXek9Sr8:LAk8PKdKLo7eVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301741, "uuid": "4b615372-60eb-4f02-a8b0-d8d250035f16", "value": 2342629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301741, "uuid": "9b4b6745-a052-4322-8bdf-8d1485bc0f59", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301741, "uuid": "a2b9cb52-9ea7-4ebe-97a4-a409134f09a9", "value": "WaterClientV6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c51bdce-c14a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266081, "uuid": "cc8227f8-4c49-47f5-a816-db1a234c1f35", "comment": "Malware payload (Mirai)", "value": "1edd275ed2019710a00d3d07491d631b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266081, "uuid": "c94c3ff8-9253-42f2-b605-e89d593d3d9f", "comment": "Malware payload (Mirai)", "value": "8d56b20bce22253d24b1a33ff703e4b25bb3ab9bce0d066bcf3b861a38936f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266081, "uuid": "9c6ebceb-4e68-4a74-8072-f1e8e7666a6c", "comment": "Malware payload (Mirai)", "value": "d0612a04b94a96dff2cb63c30318d9cdf16ce70d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266081, "uuid": "73250b3a-fe5c-493c-b444-7e89201b2063", "comment": "Malware payload (Mirai)", "value": "ac6ffd0880941c7705b19f0109b53cd0e7cd80510e9367c9199f13811e937646c39329c4fe34019e7763f413500b1a92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266081, "uuid": "afedebd7-9e71-483b-9699-1573eafb965d", "value": "T130E3B5BFEB271E23C0C51071D1E30233A5B9D67838A9D797A8D3EC692F1A98034157DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266081, "uuid": "23d5a3b5-8e34-4c26-b12d-422a5ac84cb0", "value": "3072:aNh8gQdkF8J9jEN9qhEbtOpcDahJIY4BAhRE5:KG0OtE3nOpcDahJIY4BAhRE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266081, "uuid": "1126dec8-95a1-4c88-ad6d-c9899dc1f53a", "value": 153331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266081, "uuid": "03573503-9b12-4a34-b933-3f4724c473a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266081, "uuid": "a73aa0ad-1448-47ae-8bb6-2fac9f5cf2bf", "value": "systemd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5353c51-c193-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791297583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297583, "uuid": "16875d51-c500-4e99-aec7-1031a9e4c43f", "comment": "Malware payload (Mirai)", "value": "a4c3c5b41d3a34fcf2033f72d91298c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297583, "uuid": "fa7a0f67-1136-4e4e-ba46-0d2437ff6ca1", "comment": "Malware payload (Mirai)", "value": "8d78e6516a035cf59a96486b467db1fc0fafb989440046510004f41935975b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297583, "uuid": "87180af6-c3e0-4db6-b4f8-d9e68fa2a94f", "comment": "Malware payload (Mirai)", "value": "d3081fc0cf702d298f4445607cc24c62802094cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297583, "uuid": "b4276c42-cfd7-42fb-913b-04ab7d3ae0e4", "comment": "Malware payload (Mirai)", "value": "1ce94ef7e8349d0f63d52f7348f095e01bd00c5f065fc4267759790e563e0d173dd599a1291e60268ce62afb3ae3c5a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297583, "uuid": "c0eb3486-6579-44b6-a01c-9501ee197bab", "value": "T117C48D239D766F95C4B7C1B4B4B08B780F11A89641EB6EEED6A2CDD59443CC0B22C3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297583, "uuid": "dc18d1d6-0d7d-4cc0-803c-c60192f1212f", "value": "6144:HFPBV3C9Nr4rlGoDaFCgSRYeBivD72HpfbQjOT0FIzzMmGk8ME+6qXDuNHv8xZ:lpJKNrQcDeYuHpUjNs5Gk8MEcyHvsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791297583, "uuid": "82e72fc2-d25d-4bd8-baa2-9a5da641f10d", "value": 590952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791297583, "uuid": "b58c14fd-519d-4ef3-8444-9504327424e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297583, "uuid": "90260e02-5628-4c57-86e8-262fe0f51b0e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae58a89-c17c-11f1-927a-4201ac107004", "comment": "Malware payload (ACRStealer)", "timestamp": 1791287527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287527, "uuid": "d8d9e49c-77cf-4489-8f5a-e9f47d997676", "comment": "Malware payload (ACRStealer)", "value": "1f75cb137ec2c546b8b825d243cd0e4b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GETWELL", "colour": "#269344", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287527, "uuid": "b3dac5b2-2350-46cb-a37c-d1bfd09a998d", "comment": "Malware payload (ACRStealer)", "value": "8e0300cf9eccdc1225289fa643514c9aa006d29b35a16ba97f57bcd168deafd0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GETWELL", "colour": "#269344", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287527, "uuid": "5f694774-0a44-4b51-ba4f-ea6b3379aa14", "comment": "Malware payload (ACRStealer)", "value": "db49977076537a449b6ef10556c317ab1b13043b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GETWELL", "colour": "#269344", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287527, "uuid": "b0ee4582-910f-4688-b29c-2eab24301b1b", "comment": "Malware payload (ACRStealer)", "value": "417955a709c7acfe2a6032c97c57f049a62313d4e3e599bfe1b2aef8894420a580bc183423aea588bb88f3d1ae283b90", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GETWELL", "colour": "#269344", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287527, "uuid": "6c2a4250-db28-48cc-bbfd-a091b4d71dae", "value": "T1E6E49E85E2C383F1CCC364B6761FB33BABB16D15C435DECADBE124929933250695B8A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287527, "uuid": "dd017343-a4a8-4880-95c9-e574146ddf8e", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287527, "uuid": "7948894d-8c38-48c4-a9f8-56ea91ef745b", "value": "12288:28ki9TBYBAbKzD8er24K7mI5ivw07X9TWXUsSeft+:28fHCD8erzI4w0r9mUsSef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287527, "uuid": "5c504875-33ae-42f5-b868-591eeffaeb1e", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287527, "uuid": "3d4df2ba-2541-4081-895d-c25c1dd65c41", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287527, "uuid": "f5a8a98d-5878-4719-9dc8-79863901fb70", "value": "RtkAudioService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0cddcd-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250622, "uuid": "10dbfdf2-6540-477f-aa73-f37015a7a181", "comment": "Malware payload (Mirai)", "value": "1972e4cd18e5e1790b9ab28b7047c726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250622, "uuid": "bc917fe8-edee-4673-9379-77ffb4afe90d", "comment": "Malware payload (Mirai)", "value": "8e35b445becb01d1fee8e4327a003ec0d9a1ed66c1dfe2dd541316f47a780de2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250622, "uuid": "76c67463-cc64-49b3-898e-7038b1b1aa80", "comment": "Malware payload (Mirai)", "value": "ca1d2c6247086f6c8aee4f3edd2ab36070c6f86f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250622, "uuid": "1a73caf7-c539-4b2b-ab74-3b4bd76d1c86", "comment": "Malware payload (Mirai)", "value": "bb9da7ba63d06749e2e08469386a6d07e66402fd5a46c6b5eab12c3ead23969c7783dd9b8bc5d5f7879b80fea6794269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250622, "uuid": "8e3bd6c1-7e7e-44df-a2e0-e7969eec5cc9", "value": "T1EC23F791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250622, "uuid": "78ef8981-a154-4a00-a48d-390b55cb0c0e", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THJ:5DmKF7Gxyk8cqoHAmWurAufsG5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250622, "uuid": "897b6670-f497-473f-975b-529f875d72de", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250622, "uuid": "410dafd0-cee6-433c-bc49-dba8a6f09cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250622, "uuid": "021f1529-2760-4fa8-b5ab-8fdfac162877", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed9c819-c156-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791271454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271454, "uuid": "e52dc95b-a572-4958-95ec-93bb7679e653", "comment": "Malware payload (Formbook)", "value": "e211f7e993c03d6cb35862b57559efc2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271454, "uuid": "5195ea2e-2b05-4235-ada2-70a39d3a2866", "comment": "Malware payload (Formbook)", "value": "8e4772e7850006e760dc57a6382b0c6d14e97bca18f684cc7ed28c613ba5f054", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271454, "uuid": "e5adbf36-df79-46d5-ac48-b35382165ce5", "comment": "Malware payload (Formbook)", "value": "d939c7c03ea581ad1f4da4aeef4b52e1712488fc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271454, "uuid": "e0a55c4a-b7ad-4f97-b523-74b97a11ece1", "comment": "Malware payload (Formbook)", "value": "56243aff072e6ac6169a5ae6d87e1e44aecf4c7164b9a038a1b8e7a091dcbf1d0627ea0bba42017f2432ceb4e1b0193f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271454, "uuid": "10b9aff8-fd79-4390-a1a1-9e7cd27e5b1d", "value": "T16565233C6599AACF090172F77127B85172DD53864DCA122B336C86F03BA95F42EB3E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271454, "uuid": "7da18a5c-03da-493b-8671-623256fb3918", "value": "24576:JlEeKOz+SV5wqiazykZwNYuxuBh+g3wld5DamOyoJK0tgUVe49gSU8:DLziG2YBfAhKKIgez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271454, "uuid": "fc6cf116-68b2-4a80-aee4-664c8c560062", "value": 1535095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271454, "uuid": "ea3fb016-c9fd-4edf-a069-b4c06ce8ea14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271454, "uuid": "42cb4ff3-6193-468f-86ee-e151d26b068d", "value": "mlsecured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e524d7-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271041, "uuid": "83be02b7-a5aa-4f87-8745-45643da8f650", "comment": "Malware payload", "value": "03b56909c20ed913b29bb99d40466c3a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271041, "uuid": "e47db8f4-0260-4fd8-8eb3-82980d41ab20", "comment": "Malware payload", "value": "8e5a9ed982dc13efd1b526fad8db307201dab1318ea840b84f6f1bade4834b59", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271041, "uuid": "a595d6ec-ebe3-4c6e-9e7c-4c4e6a61e2f4", "comment": "Malware payload", "value": "3dfda3f97b82c03d8aabe31f640b0cf89bda53ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271041, "uuid": "ccbf7517-8402-4f9d-a291-a06d7b9806f9", "comment": "Malware payload", "value": "a875a7211cfe3a126f41b4bb322a5cf722bb37b8a477a8e0c69c7c24b5983bb3bd143feaf4e020f1d0b9a4f22b1a73d3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271041, "uuid": "0df8b7cd-2526-49f4-8e24-23428fa57e9f", "value": "T13DA4238274716D06D096CFBDD4C1AACAD06E023D352A3BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271041, "uuid": "0339aedc-db8b-41b7-ab36-1511b7042de0", "value": "12288:Er06NUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZ1:Er06NUv4t1cNk/wjibhv4b2OnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271041, "uuid": "84c38707-2d3b-4073-93cb-87bc9ea5909e", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271041, "uuid": "daf8d2c2-b752-4341-8038-f362979268d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271041, "uuid": "4cf4ab4f-90ac-4412-9340-f7dbfe8a3989", "value": "8e5a9ed982dc13efd1b526fad8db307201dab1318ea840b84f6f1bade4834b59.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5f24ca-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263876, "uuid": "3885ea3f-4f45-405c-b28e-c72e227a170c", "comment": "Malware payload (Mirai)", "value": "2ec93199fdc0e7040baffec813b41665", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263876, "uuid": "47d79a9e-8d51-4cd6-9e57-e56467fba3c5", "comment": "Malware payload (Mirai)", "value": "8e5ee2064361cd9120243df601a425911819edfdb25ac0b136e3fdaaff06274c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263876, "uuid": "df7171fb-e4cb-414e-8f22-c4db07a4b677", "comment": "Malware payload (Mirai)", "value": "954d2011914a8e3ce29349db029366685ffbfa3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263876, "uuid": "6c094e43-9f15-4429-8f08-a27febd90603", "comment": "Malware payload (Mirai)", "value": "19c6dd763f819de395cc9b249b026d3ff5b88c392e6dea0270520bbd85309c1856e9d8d254b72462af7b036302f32224", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263876, "uuid": "32e8bb11-4b05-4b99-a9bb-f8a924b8cdd7", "value": "T1C173190BF593597EC0A1C430479FE671F47278645733092BEA9097393D6AB248B2DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263876, "uuid": "4a0e4dd0-713e-42e8-9879-1c7027c018d7", "value": "768:9DaeBOym6NyVsIxOXb/DIdA3af45dJFzZigQEXLHyvUYs7DmdTIRfOynPe:1asNyV0UdjQ5dJV7Hyvhs7qhryW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263876, "uuid": "1cf864ed-b179-4e64-8a24-8f06c5c93a1d", "value": 76192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263876, "uuid": "91665026-fb97-4ead-b3b8-43dc581de206", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263876, "uuid": "18a104ec-c33f-4a1d-b56f-f74b635635db", "value": "qv3-host", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450bad9e-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276323, "uuid": "50b56194-0dbe-4d91-b278-e05f6dfd1341", "comment": "Malware payload", "value": "86ff48187faeb6dd9f7f0a6e9b0b7650", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276323, "uuid": "b6418f26-1ba2-4714-9530-0ad809c35ad7", "comment": "Malware payload", "value": "8e9fc2bf84fc14bdae753a2433fde96f4192295682b620a79b24daebd1e1b916", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276323, "uuid": "ee920b0e-dc96-461c-b401-7ca3a70cc1ae", "comment": "Malware payload", "value": "822a40a3ef595ba552a36a29115a4c984f9417a2", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276323, "uuid": "98e7a822-8660-4169-98e5-6ce8fd20a367", "comment": "Malware payload", "value": "279bd092f5762950086a28a7fdb6a5c12e4bc8014943dc992b5fcecbc53fca416eabcc9c3ce44400ca8348d524fe18f1", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276323, "uuid": "dbb6bf10-c80d-451d-8468-8b4c77381d31", "value": "T11E350211CF2250A6F4CCD734376F9E3B8E257550498816DE63A32A849E353D3F2672AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276323, "uuid": "20812702-8dbe-437e-98de-0777d315a51b", "value": "12288:WQtJGhmE9YCW7vS6FFEUtvxnc2yvCPDK81Bhu0fs9DwuKV8zhGQhEdq3U57WA3RS:pEDAZSrChvfs9uSMQhsq6BcNktbn8dWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276323, "uuid": "08eaa25d-9c90-4325-b525-fc3fe350ac91", "value": 1084720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276323, "uuid": "a6635907-a4a5-437e-a62d-121e9e12d7af", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276323, "uuid": "7aa40cae-b657-4c25-a3d1-005b841dee87", "value": "8e9fc2bf84fc14bdae753a2433fde96f4192295682b620a79b24daebd1e1b916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c8bad6-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263362, "uuid": "1d50fc95-106b-4e5d-8960-72185029cca5", "comment": "Malware payload (Mirai)", "value": "cabc0156e6ebeb0e9abb2926ca999311", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263362, "uuid": "a597a26b-8e48-4867-8732-a89f92455748", "comment": "Malware payload (Mirai)", "value": "8f4c0563e9fd8901e1c6282740685c4521b877bb0e2bdfd792510672e2b007c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263362, "uuid": "9bd375bb-5f89-460b-8bcb-7506b3f27a93", "comment": "Malware payload (Mirai)", "value": "2df58cdc0b3d45fddb86a79dd5e13de5a3c743f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263362, "uuid": "98ffa3b3-ac9c-41ab-b8e8-fa06a3f6ac61", "comment": "Malware payload (Mirai)", "value": "b9bbc41ddf7dccc8d97880f94b6d8ef92988179125492ceea8d1ae350569ae5c0b3af1252f5e2a64d08d11641480c6d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263362, "uuid": "dc39a5e4-b646-4863-acc4-ce3ec053d27f", "value": "T191246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263362, "uuid": "26153bc3-06cd-4c56-9c94-2f7f5e7e9427", "value": "3072:MwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhSzboqN3y:vuOScKRz0mayvhPIyu7HWwnKbzboq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263362, "uuid": "d0eac6ef-918e-48d2-a13f-ee2c6449be3f", "value": 210936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263362, "uuid": "84b5e101-0f6f-406b-be00-83f9d3140f87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263362, "uuid": "7aab46af-2399-4519-901c-07288d3a7242", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcbae7c-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272395, "uuid": "b85ab989-62eb-416a-96aa-de5d27738a24", "comment": "Malware payload", "value": "332839078229eac692279e3ab7a48434", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272395, "uuid": "b557dbaf-a62a-41ae-8859-a647e7aca707", "comment": "Malware payload", "value": "8f54782d924bb4b5c7d97aa221ce60fd0a3c86517c2ddd18d0feaf9cbb652f5a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272395, "uuid": "b916efa6-205e-425b-9cda-4476dd80f6de", "comment": "Malware payload", "value": "8890f8637bb5aad8d37aa85995eccdfb92efda9d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272395, "uuid": "9e067b21-1971-4c81-9cf3-09be1ac771d6", "comment": "Malware payload", "value": "9f8b91b658503ffc05a6eeca02ead13848b090e4a0d1374d1d43a75ecb056cabb4b89118d77c4ecb21ddcec0a262b600", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272395, "uuid": "2695ae74-2b16-4aa3-91cb-4294c72a1ae5", "value": "T1F055334B813C2DC89F3D0A57B6FF856C62148EFC21421C371B265897753EBAB867894B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272395, "uuid": "ae735680-9966-4dc3-a1a1-eac74d09bf25", "value": "24576:6oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRat60BwgG:6oZ9bq+MmMEL+hcjXHC/wnwdX0BDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272395, "uuid": "84c8c250-77f3-4b8a-b993-c6cb18d86fb2", "value": 1394759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272395, "uuid": "cc2c5823-463a-477e-ae11-5ee991b7fbaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272395, "uuid": "e4b6e2f5-4317-4a08-b1b0-ea529cfee19a", "value": "8f54782d924bb4b5c7d97aa221ce60fd0a3c86517c2ddd18d0feaf9cbb652f5a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502333b4-c1a7-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791305977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305977, "uuid": "cd6f16a6-d672-4e7e-96b4-0157c6f69331", "comment": "Malware payload (Mirai)", "value": "34b6ebd70604f675d8c70da0eb9e80d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305977, "uuid": "fc848e56-4531-4e24-97f5-d47dd7c27f84", "comment": "Malware payload (Mirai)", "value": "90438e02b7f3d87ba0d832308efe5f20d895713d52f614fd98e7fc3eb643b3b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305977, "uuid": "dcbffead-e00d-496a-a36f-9ae48d71e11e", "comment": "Malware payload (Mirai)", "value": "b46d0faa7aab8552f8cbca517c032d6fffba5300", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305977, "uuid": "9e742395-ac57-4e04-b69d-7042df3c0c16", "comment": "Malware payload (Mirai)", "value": "45751fd5635c78e8b8a4a1788b6966e3bd4fee597b4a2dfff440be80c4f553f6c0440ad3147deb7fd708ed034e6b7520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305977, "uuid": "9e8ec163-39ea-4146-bcea-6e4b0a5334f6", "value": "T1EE534AC5A643D8F9ED1605762137E3338737F1390029DA87C769E936ACA3940EA5739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305977, "uuid": "df54e568-09cf-4fc3-a29d-9e281e39b9ad", "value": "1536:+dvZ+2sahNerPGx9VzK6zbxZGeGJc4YnGxat0LIEmZMJShsq9HmFmarAX7:yRrsaheux9VzKZzJFa6MEVJRiHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791305977, "uuid": "ba6d73d0-352c-4de4-aa79-d5817f49583f", "value": 64336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791305977, "uuid": "981e193f-a9f4-478b-b54b-385214bf5a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305977, "uuid": "8ba68896-1b74-4185-8469-0044c2848bd3", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9650060-c154-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270559, "uuid": "5a306393-96af-4136-a408-2fa9eca22f73", "comment": "Malware payload", "value": "55168c55fb37ea6fabaf4c037e89e70a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270559, "uuid": "efbd18a5-ac1d-4f7c-ad14-f9309aa60449", "comment": "Malware payload", "value": "905ddf88ac7af118300afe5b1b1525021305555e007953e16ca1da919ec16f1a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270559, "uuid": "535cfa2f-7f7b-494b-83c9-b0f36cd8800c", "comment": "Malware payload", "value": "2c93abe5f7e4918a99d7df1fe845562cb6a96c2b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270559, "uuid": "bac23cf3-8ace-425b-9d0b-475b55abd8d8", "comment": "Malware payload", "value": "b7dd78c02623c2883a54f3c32a038a6877f13f4bb569f6a6394b118bbf7e829e37658a074468d868c5216a8a8ab1eadb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270559, "uuid": "809884ad-8cd2-438b-b599-4e51b0e3e237", "value": "T13F55339A817C18C40FBA06A3BBFF849C612589FC10420C671F678597293E7DBC775E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270559, "uuid": "e4d2ea52-ec4b-4d56-b0d8-a9c148314610", "value": "24576:344FoyAXe1AJ8oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRg:o4FVAuAJ8oZ9bq+MmMEL+hcjXHC/wnw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270559, "uuid": "936ec39a-9fbf-448c-b822-0b7e74084fc1", "value": 1387979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270559, "uuid": "ea6750ef-07f1-46ec-a9c0-df8c46a55520", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270559, "uuid": "35f8f209-0582-48e4-ae9f-ff05992a0efc", "value": "905ddf88ac7af118300afe5b1b1525021305555e007953e16ca1da919ec16f1a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e0179d-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273447, "uuid": "d594f77b-61be-4bd6-a348-904da9cc007b", "comment": "Malware payload", "value": "a28ee8265f46b3baebc6ee76e6b683a3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273447, "uuid": "1f89a94c-13ef-4e51-99fc-d0c02879d520", "comment": "Malware payload", "value": "90f26471abba91edfa4b501c11bfeedb1a2eee79e6361dc730f8944f0c3dd52f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273447, "uuid": "8371bd17-d61c-4495-9a9c-d7abb1fa4aa1", "comment": "Malware payload", "value": "67d2b099260c6f2a4860d0c29daa0c1babd123b6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273447, "uuid": "c7528b53-8515-4854-9461-33e643bea3c2", "comment": "Malware payload", "value": "890780b6bdbcfd562f7eb473428357c496c9d63c6bd3200c8763d7e9134256d941afdfa2824d4c1b0530dfa31db29596", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273447, "uuid": "fc955954-4c92-47cf-8b92-3ac0fa48d781", "value": "T1DFD243D688058BF01A263B56B55F741AD91003B57C39794E3A8BD18D3F7AE10CBD34AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273447, "uuid": "7bc06f41-0621-4959-859b-c561371f0ba2", "value": "384:KLkY0UchCa18fpsWK75ORqZ8RaIoHW17Lz6/wcXTA8bI7pzFRYSsZLLx3OIpIuqD:K0vDlxFWpLriT4DWwc2O+2dcSEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273447, "uuid": "4458243d-e3a0-47ad-a68a-68f8eb8e8d50", "value": 29763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273447, "uuid": "b68af4b0-baab-4a2f-bf6d-efb7362231b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273447, "uuid": "4fbe15e4-9cb3-4335-8311-d27296b144ad", "value": "Booking-Batch-C-17819.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b47bdaf-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263878, "uuid": "1c846608-5e5e-4d62-b266-a1b5138d10f1", "comment": "Malware payload (Mirai)", "value": "c6a07f9855621f15643dbd48da3edd79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263878, "uuid": "ef6defda-bfee-49a6-a009-647c25748070", "comment": "Malware payload (Mirai)", "value": "9100760866770b6dd90dd38f84adfc39581b7264fc5d0b07b604f7c8eef45e32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263878, "uuid": "b61b366a-6296-4ad5-bc4f-4b75c97c8388", "comment": "Malware payload (Mirai)", "value": "4ebf9d5e538c2be7090b55fb6bbc0a41dd0ea3bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263878, "uuid": "6939bfa7-db73-4e00-8ff3-19d3b3973134", "comment": "Malware payload (Mirai)", "value": "6cf005148212980a9957391bd5b5e93d552ad33d5db473288b65e0b3244f397ef0a9a6f7cf99caa14a0e8166ca0139e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263878, "uuid": "d99b6ae2-8c3f-4f38-b7eb-4b0b7bbf1a8a", "value": "T165240A01A9114F53C5C32BBBB79F469937326B25D7EB3302EA19BFB42F4668D0E29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263878, "uuid": "c92a8dbe-f00f-4707-b4b4-9d84f9183fe5", "value": "6144:qw81N71/nu84N2BymGv2Fj8oNIULzee0aNSXjIjo+APPyVBOAmk:qwMFu84IFF4oNIULRNSXjIjo+APPyVBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263878, "uuid": "b0c3c102-6db7-4158-af07-d169ef4f5b46", "value": 214438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263878, "uuid": "0fafbdde-fd7f-4630-911f-d3ffb611dcc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263878, "uuid": "7abec731-d5dd-4a09-9058-d4984119752c", "value": "qv3.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13d98ed-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246037, "uuid": "c006574a-f8fd-4fca-8b7d-89b6ba02f3d2", "comment": "Malware payload (Mirai)", "value": "f24a09c276e0a88b9c6fc09ffa4f2bbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246037, "uuid": "a01f0ae8-65ee-458f-a728-cd660dd46b3a", "comment": "Malware payload (Mirai)", "value": "91233d4d5de4c2d4c484b6af77bbb5b1efeb9cd6447ee783995efb221615ba74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246037, "uuid": "913f40be-56e9-4535-a845-04bccfc10ce0", "comment": "Malware payload (Mirai)", "value": "833f09a3229fd8f547edcaec812da7ed9f80b5e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246037, "uuid": "c542344f-e76a-4e7c-ad2a-9b0f1672f6ae", "comment": "Malware payload (Mirai)", "value": "f6f04726b56be7153eb56e75343556ed55f6a23ce0a2ae340efee0b7b802deb5f47282839a95f2e87fa5954a10ad7ae4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246037, "uuid": "62e4bc2d-e592-41bc-bd9c-73ad3d3dfff0", "value": "T1BBD43903272D0F83E3A75DF0777717F487DEA89621F5E588AA0B69C69271870224D6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246037, "uuid": "208f5635-70ad-4694-9767-460b09220e6a", "value": "6144:i46jQIElFXyaGknHGmx2sF41h49gSIlo/ESCHYni0DSwIOSbHyo96xOp17M3G67C:i46jXEld1nHpFxCQC9dBM3hhK3uAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246037, "uuid": "df3d2203-c66d-4c11-aa43-d0cea405263f", "value": 641424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246037, "uuid": "5fe630a5-0561-41b4-b6e0-074aef5b8b00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246037, "uuid": "2287d2a5-58bd-4dd5-adf1-44211e7b944f", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f84d321-c182-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290111, "uuid": "13b47c7b-58a4-4c6f-8161-470c9a12c73e", "comment": "Malware payload (Mirai)", "value": "1e0f825ffbe6b100c146ed4fa95cb39e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290111, "uuid": "f5f1dcb3-b335-4834-b5ed-bd1a487702ea", "comment": "Malware payload (Mirai)", "value": "913fa444e065e601c150f1afe24176a8d8ff2b6bd966c9c0398179dd9233230c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290111, "uuid": "a1489a78-5187-45ce-b57a-702c0b7f8332", "comment": "Malware payload (Mirai)", "value": "8cf1732f1532bd9836a8f5e9d782f99adb32dc99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290111, "uuid": "079897c9-196e-46a5-ad2d-dbec89a6265e", "comment": "Malware payload (Mirai)", "value": "34caec61f7f8abf71fd7855a27421f4bbde7e05338ff54f9591760cbba766a0ecf976867932e5fe9a201ac518cec04d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290111, "uuid": "4322d611-98bf-4cd8-bb55-af442fbf38ec", "value": "T1F3D46E66BD919B90C5D159BEFB9E437872035BB9E3FFB006CA045FA06BD94850B3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290111, "uuid": "d6409a1f-d107-4972-abab-644a28a6d991", "value": "12288:9TwH53s1tu4dNHN4BOQLS2Xa5Ii7lQHIKskkK9dTn8vx:oydNtJ6codTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290111, "uuid": "62169d27-6eab-40a9-a133-67baf3929b05", "value": 626312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290111, "uuid": "4e294566-a171-4a71-bd7d-59fcbfcc35ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290111, "uuid": "5eb4284a-19ce-42fb-806b-d6477bed7e96", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2184b069-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273257, "uuid": "45299782-3402-4dad-9cf4-94cdaa360a04", "comment": "Malware payload", "value": "8af6373275cc0228075627909781b0fb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273257, "uuid": "1c098037-8f57-48ef-aa0f-dad28eafba37", "comment": "Malware payload", "value": "91683a4fd2c77b3dfe87f162b2987415ecc5dab8f1fe8ab94a6f8f3a5a2bfc89", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273257, "uuid": "ac0af38a-bab3-4f06-8874-ec47cfbfb124", "comment": "Malware payload", "value": "3a11e7e294009ac64ba4e19115e0469f94aad2b7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273257, "uuid": "889f9a2a-6034-46bc-8156-2f761d643003", "comment": "Malware payload", "value": "2546316495e84be7ddcb326438ce05b15df1ce819e2a19074faabf42a41651acf4af9abe545172478b48db93bfb5ae67", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273257, "uuid": "f49cdeb4-7058-4293-be26-ef34d766a24e", "value": "T10C5533D7813C28C49F3E0A5766BF850C62188DFC204308B76B5A89A7663F79F876495B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273257, "uuid": "b89647cb-91bc-445e-862f-223f4945a46a", "value": "24576:EoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRZX0nv9AbdA:EoZ9bq+MmMEL+hcjXHC/wnwdaKbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273257, "uuid": "6f03fa13-e0fb-4e77-86b9-eaa86c921e5a", "value": 1386685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273257, "uuid": "a45b213e-7b11-4492-94af-c642f37c4b97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273257, "uuid": "4f6555c4-eeea-4a15-b150-63b5d9d20a17", "value": "91683a4fd2c77b3dfe87f162b2987415ecc5dab8f1fe8ab94a6f8f3a5a2bfc89.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7d85a2-c163-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791276768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276768, "uuid": "a9cd5096-4cc1-4828-8e1e-5b5b5984538d", "comment": "Malware payload (MassLogger)", "value": "5aac69de7eb20d31c62b190111bc902b", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276768, "uuid": "9136343f-7c55-44ab-b7dc-045c3c846481", "comment": "Malware payload (MassLogger)", "value": "916d8062e6c56c7a4ade3e95db1ba11e9e55733db7e67eaa5f793ff881deaef7", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276768, "uuid": "44188b36-169b-454e-b33c-826b5b89feff", "comment": "Malware payload (MassLogger)", "value": "53076b0a2661211749df1ed6172082ac0b7856f8", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276768, "uuid": "9428e519-46cc-45ef-ab92-18ede7931242", "comment": "Malware payload (MassLogger)", "value": "cc1719b7b3724fcd27c69daf8677f542c574c2e880c83edf59df47a7f56598a590d0a1cfefcaea5653c0971bb14a2941", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276768, "uuid": "f988f18d-8122-4502-87b7-94a739819e33", "value": "T14F4523280E4973EE0902A2F5709AF58F679E128B0D46962B073C87743BFD571DB52CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276768, "uuid": "5dde0d28-9318-455e-8e8b-dcf6fc80b6b2", "value": "24576:LOL/znL5JNdaKm8CWQgnH462RlQUNGOqSSA8GEFneEc:yHkWpY6glQ1fSSA8heR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276768, "uuid": "67a45633-4156-4788-ae7f-45f76cdabe10", "value": 1238511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276768, "uuid": "18a66ac6-416b-4179-b110-e3cd80f3b0f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276768, "uuid": "ce10226d-6686-45d1-8654-18e10b2a6fd2", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c5af0b-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272455, "uuid": "1e01ad3c-4026-4f96-9ab9-3dbf3ab92b72", "comment": "Malware payload", "value": "46a416b4066ff9600495d5d7cbc1448d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272455, "uuid": "624880eb-71b8-4030-850d-fd27dafd889d", "comment": "Malware payload", "value": "9239cde89c0113c0d929183377fea7a4f3709e2fe6f7d3d69c7b8b2bcfb33417", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272455, "uuid": "734a5bb9-0fed-4f52-8eb7-3cdfa03d8584", "comment": "Malware payload", "value": "ac2b93fa718ce79f2111a8a9caac3db257289a60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272455, "uuid": "2159eaf6-0b0c-481f-ad7d-6fec60e083c8", "comment": "Malware payload", "value": "fba5c45ab3fea65c09f3e3375aaad4a791b7417fb74557f5520647ec14093c536eeafd2d5536c0bc69bd287556da8bb7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272455, "uuid": "475cf9af-6faa-4c80-96ba-abe9410515a4", "value": "T1A3C42359B2B7498EF261A0E5A8CFBFB8A2E7CD55EE4BDCC477C052D41221701389075B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272455, "uuid": "b19993bc-4688-45c3-bcda-06d7ed49ec3e", "value": "12288:uM+Lkjyqu1SXyFf7onLGbQUsANywcFhG57yuiX:gtqu1BFf7miQUrNQgyuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272455, "uuid": "a37b34b4-a9a6-4b1d-b578-6b5573bf25c4", "value": 548743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272455, "uuid": "0e608d5c-e447-4f85-92c2-ad75136dde0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272455, "uuid": "cd0c9983-e5e6-4005-a705-28979dde649f", "value": "9239cde89c0113c0d929183377fea7a4f3709e2fe6f7d3d69c7b8b2bcfb33417.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40775854-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271591, "uuid": "0bdfd024-9020-4e50-a427-c60e57ecfbd6", "comment": "Malware payload", "value": "995999419cff4446e82e05fff7ac9a90", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271591, "uuid": "593be37e-5289-4c5f-8ae2-0c808c32b68d", "comment": "Malware payload", "value": "92487682109fa28cd5e167d4f0a9760dd9f67d77f3ed2a7400a7c303006cc876", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271591, "uuid": "65fa024c-63ea-4f33-94d2-92fd42e65b3a", "comment": "Malware payload", "value": "f315acb2fe2c6fa925485bc3ef6b262d98f05fd8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271591, "uuid": "fe7dc532-9d70-4398-ad0d-76be037afec3", "comment": "Malware payload", "value": "872ea45aec0cd95ffe4a093e4ad194e8ef7ed8d768e8cd40c4570bdff4fd5abee2721dc777ffdcf4e99f590f44a814f3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271591, "uuid": "8ced8b16-676d-4ef7-a6a3-b0671a046977", "value": "T10EC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271591, "uuid": "8b521bb8-6cdb-4cfc-910a-9e9f8bd4a609", "value": "12288:D+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2bymH9I1P0QKw6FEs:D+QqldA/TSO713u7xnmH9IaQKHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271591, "uuid": "1bcbd9c3-4c0d-4aa3-aa4c-29b2bc34f234", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271591, "uuid": "20d7c5d1-38d0-44a0-b9b7-54d589def105", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271591, "uuid": "fd5427cb-c14c-4f0b-8e91-aa7c71bfdfa6", "value": "92487682109fa28cd5e167d4f0a9760dd9f67d77f3ed2a7400a7c303006cc876.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69924b9a-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272948, "uuid": "73d9c175-105f-4b2e-937a-4e202680eb64", "comment": "Malware payload", "value": "fe127a9766e48caa450133514b838c58", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272948, "uuid": "6a94a51c-3414-40a7-90a4-13c669459435", "comment": "Malware payload", "value": "928485f843d1fc772155d87107987355d80c7d8cd8aaf87aa220e0075bb54fac", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272948, "uuid": "1c123115-425f-442d-8d78-6b0c6f4b3c28", "comment": "Malware payload", "value": "291c8b960319d8e1f3869e89a4e922805f400e1a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272948, "uuid": "b268feea-f1dd-44e2-a9d8-fa3b4ddd5de9", "comment": "Malware payload", "value": "2bfde07f2668a29cc7aa86853a6a50d0aa6e5c3f0dc0f0e61bcc644cf6115a2240dc98708fae68a477ff23758ada7da2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272948, "uuid": "1cc656bb-8595-40a7-938d-b30e60477bb0", "value": "T1C4C42304340641D5839A2B1EAEC4E6E0BEB560DBFA1CF940AADD7ED06DE92A177C1433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272948, "uuid": "513431b2-e61f-459d-ba07-abee99fac587", "value": "12288:/6wlOMWROC/FTeHo22Qm7NzofOr68m4eA924EwCO:H4MQOC/gHozN7NzomW86A91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272948, "uuid": "ed31dab1-5a23-458e-b85b-b172c49e98f5", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272948, "uuid": "e4212dfb-026c-4e42-a86c-a1fb21cf235e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272948, "uuid": "d664eca8-7746-4192-845c-301f574f3155", "value": "928485f843d1fc772155d87107987355d80c7d8cd8aaf87aa220e0075bb54fac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063dc00e-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274929, "uuid": "86aae70f-6a80-4ee5-a4be-704867c200f0", "comment": "Malware payload", "value": "8fe88796e507e04c1b44aebaa8393611", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274929, "uuid": "b6ea51f6-e016-43b1-8d62-2fef730c4db7", "comment": "Malware payload", "value": "929c6f2307b33bd0c1911cc2d327063b1fcd7c28439c79772d454eb30eb56c71", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274929, "uuid": "701833bd-58b7-4ef6-8e12-9458ffad1a40", "comment": "Malware payload", "value": "06e4e5f553812880c396ddfda45230ecb2cf7a45", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274929, "uuid": "44d5087f-5cf8-45a8-be58-1e6d51d419a8", "comment": "Malware payload", "value": "8709755eedb14967ca2a68f53bb26b878c0e743f0f53a69c2bc70b5ca7bc211219fd96ef9a348483d156c690a7f2eea7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274929, "uuid": "430bfc29-cc21-4e94-b13d-d2f67805149c", "value": "T18DB423F193429E0B23A4DAB457A3DB3375CE7292769D9301CA06CA9F4C7072886DC16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274929, "uuid": "3160912e-5899-4438-bb24-c5d1434f3c76", "value": "12288:fkmht7DrvdyiTCCH1oHF9nJ/qjuyAgoJrrzTPwkR:fkmHzMUH1ELnKAgoJnnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274929, "uuid": "7b2aa6c8-f28a-4311-8c05-e22c1890dfd6", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274929, "uuid": "4c3b5b68-5b0d-4666-8cb2-776313471e5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274929, "uuid": "1970daf5-6297-42a5-8942-53ea9ad02b6c", "value": "929c6f2307b33bd0c1911cc2d327063b1fcd7c28439c79772d454eb30eb56c71.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba3181f-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275180, "uuid": "97179c4a-7a62-4eb6-83dd-8753c1449d4b", "comment": "Malware payload", "value": "65fcda162872abd15fb1eb59da4f9d10", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275180, "uuid": "db9c65f8-9d28-4bee-b357-2f9083243271", "comment": "Malware payload", "value": "92a2fff996a78a7292442f5ddee4bf4473f862f8668d3b0b7b83b096efde34c0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275180, "uuid": "619da724-d5ed-449f-93fe-d23bcc235d7e", "comment": "Malware payload", "value": "d77e2daa4ed98b72a96210c78dc48f1e0498157f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275180, "uuid": "ee066839-eb81-4824-894d-5e302dbf3b4b", "comment": "Malware payload", "value": "fe40934c18726091e020f68d09fe9ec33ed419c8b1aecd0bf3cb86161695f575831fda22f376f888a05f506764b2885d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275180, "uuid": "942ba98b-80e9-4e08-b8d2-706f8ea1bed9", "value": "T1F3C423195942D2CE83D43F7E8EC0BBA03E7990EBEB0DFA0416DA35917C95251B3D492B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275180, "uuid": "d2b993f3-9dcd-4794-b744-378faead033e", "value": "12288:6devMEkFmHkE6wlOMWROC/FTeHo22Qm7NzofOrAHmS:Wemw4MQOC/gHozN7NzomMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275180, "uuid": "05c62793-344a-41f8-bbbc-cd5bab6ec2b4", "value": 585382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275180, "uuid": "6568ea48-25c3-43dd-9fc4-1546933f590d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275180, "uuid": "4f939fc3-c705-419f-b2e4-9817f38f0d4d", "value": "92a2fff996a78a7292442f5ddee4bf4473f862f8668d3b0b7b83b096efde34c0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa83720b-c17a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791286801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286801, "uuid": "cf379d53-9e3c-4a49-974e-dabafbf23b65", "comment": "Malware payload (Mirai)", "value": "21cccbbaa4aa6a98be1d50e67d00a148", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286801, "uuid": "1d423163-d23e-487e-b88a-9e33e4b3018c", "comment": "Malware payload (Mirai)", "value": "9360e621e2a25c4bb8297dcfc6269c0901e1e9901f3dcbb67657f77a46cbcd5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286801, "uuid": "5736bb63-2ee3-4991-9973-6b7e2ce8f5f4", "comment": "Malware payload (Mirai)", "value": "92f648d338116d39ef051379db2e2abe5dcaf89b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286801, "uuid": "8a2304dc-1e8b-4a69-b15f-325af596fc7e", "comment": "Malware payload (Mirai)", "value": "e9aaa88a73001510844467fe6adfffa492ca06dc87ba99ac8160c107f1d06f2038fa178806e6e166fba0a884d54e7efa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286801, "uuid": "4fcdaaa3-d137-481b-ab96-58e626df5914", "value": "T150733981BD815B13C6D112BBFB6E028D372653A8E2EF72079D226F21378795B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286801, "uuid": "10191f20-5a1b-4fa9-b977-6f76f92774e7", "value": "1536:4Vp0Jqjx80OOfV3YFDHLfA+T20at1jLv/s/hs:cp0gvYFDcw2fF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791286801, "uuid": "e7e7eedf-80ff-44d7-8ff4-152cc3e5b988", "value": 79488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791286801, "uuid": "90e533d6-1bef-40ed-acb9-628e2dff307a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286801, "uuid": "87546dbe-3099-4960-9ca2-2390ff08e85f", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85c2848-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275631, "uuid": "2c371e75-4ff1-424d-8511-bb904fce47b5", "comment": "Malware payload", "value": "dec2d21f658e631b8ff0e2ad93b53943", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275631, "uuid": "f1d3f388-f12a-421b-b97e-b02d1618bedd", "comment": "Malware payload", "value": "93f30c927102a3b1ce28dea5d486525aa5030d129b9eecddb810418483543029", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275631, "uuid": "3979c123-347d-4583-8960-df0121d102b5", "comment": "Malware payload", "value": "324717fcd5f0d7bb88b6c1863001fa62dc78b2de", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275631, "uuid": "e53b656a-1cc3-4d12-b5da-d94d58fa4541", "comment": "Malware payload", "value": "00242c9be8e4ecfd1111d7d61dfcfd9a7bcbf4a89a121e87b1ff89c44c876973fdf880ce2310cfafa9d41abe0500e90c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275631, "uuid": "821989f2-e4ab-4bda-98ef-e0e9ab09c07c", "value": "T1F8C423052521C0CEC3891F3E5BC0AAD06DF6509F9B48F5843ADFF91D79C0AA536E9B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275631, "uuid": "da09960e-e561-469d-bfd4-377d76bbf230", "value": "12288:/+CGvJAevoAVcAN6wlOMWROC/FTeHo22Qm7NzofOr/mSh1:BWJR9cA54MQOC/gHozN7NzomLmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275631, "uuid": "037ba797-f985-4d8d-8aeb-ffb9132071b3", "value": 584667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275631, "uuid": "c23eecbb-1ccf-4bb9-80d1-87a0ed1cda1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275631, "uuid": "cff420f1-748d-45a7-bafb-5990af0ab65e", "value": "93f30c927102a3b1ce28dea5d486525aa5030d129b9eecddb810418483543029.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ffac64-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274581, "uuid": "8de7a72f-1cd0-4daa-b1f8-6f8d1fef4e40", "comment": "Malware payload", "value": "95d75cd90abd56c1a346c741c600f992", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274581, "uuid": "7f713304-dc5f-45d8-adce-2ff853cb49a3", "comment": "Malware payload", "value": "9495719bae8b8156b127eb50fa2b03b326a1451394c3379f61e5f6e259cd52b5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274581, "uuid": "b890ebcc-3158-478a-bac3-3a7a54f147a9", "comment": "Malware payload", "value": "f38cd46ce23605f4dc11d1f7d3ef43ec4bc2424e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274581, "uuid": "71428b42-346b-4c08-90c1-546bc510edcb", "comment": "Malware payload", "value": "0b27a85be61be9188833d180a4207b8faf960210688febe0d4279856c99e4b28bccfc8968176b239637754c0e93e22e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274581, "uuid": "9884052a-ecca-44ab-a05f-7437c31e4692", "value": "T167C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274581, "uuid": "20b85bbd-9256-40e1-bf9d-b515d390b565", "value": "12288:b+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byaH9I1P0QKw6FE4:b+QqldA/TSO713u7xnaH9IaQKHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274581, "uuid": "245b0b3f-aeb1-42f3-bafa-c5eaeb0cbdda", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274581, "uuid": "7d5afc75-bec7-48c5-9494-a4ebab5bfa6a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274581, "uuid": "77aaf0d0-8854-4598-b319-a43e838cfc95", "value": "9495719bae8b8156b127eb50fa2b03b326a1451394c3379f61e5f6e259cd52b5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec0efbb-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274192, "uuid": "42d8a53c-d654-43f9-b468-daf540db6df5", "comment": "Malware payload", "value": "b6f020ec7f84e45d5637160aa5b268cb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274192, "uuid": "e18a2974-40bf-4d55-97ed-d91e2bb029e8", "comment": "Malware payload", "value": "94e0ea9741e6167dab7b2608ffa6e8eb2402a249ba2446f313bcca78d0eea38b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274192, "uuid": "d3be3d3b-1422-4fd1-9ea2-887269bdc2ac", "comment": "Malware payload", "value": "64136ac531bd0bd0ebb1bf222ed36d761ca83049", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274192, "uuid": "f69bfdc4-fcb1-4af1-9785-41e96d7c0700", "comment": "Malware payload", "value": "946bf385c79321d3d16a8baa6265f8440111f6be584c33fdf79f51f9dd35e97669bd9f145e7dd5417e33276e64c2fe8a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274192, "uuid": "27f75410-c16b-48be-8b41-b1bd4c977637", "value": "T1C3C423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274192, "uuid": "9551cfdf-1e1c-45f1-b037-cbc3f8b25893", "value": "12288:0A7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWRSFyorOIic/7MP0:fm6Jj6ESfUxZ91kmY/99z8wFXicTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274192, "uuid": "e6dd0a3b-7f77-457e-b126-c74e6a23a0de", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274192, "uuid": "360572a6-47d5-4e1d-94c8-43e52c3beea3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274192, "uuid": "cf5e7e5b-fb18-40d4-b50e-1c2e1257f901", "value": "94e0ea9741e6167dab7b2608ffa6e8eb2402a249ba2446f313bcca78d0eea38b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86ee240-c19e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791302340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302340, "uuid": "213f3e3b-ff04-4a05-a06a-dece2d2a65bb", "comment": "Malware payload", "value": "fa98d7de4581fb4e50ec76eb124c158d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302340, "uuid": "bb8555a3-e6e6-4717-81f8-32251fbc7fa3", "comment": "Malware payload", "value": "95799f21336e25b094130e03533c6e5eb7b0a537849edcda5baf8838bf149963", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302340, "uuid": "af3c3de2-f901-4dab-82ba-cd2c01670106", "comment": "Malware payload", "value": "1e13512b3e87227cfd6c6cdb77f255a98ee78b76", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302340, "uuid": "1521bf2d-2228-47a2-8483-9d2d089ac719", "comment": "Malware payload", "value": "f562d71352b9edc03b1fe31136b0cfb64c6374793b0f1090db388d48f4daaaa0deb88749fc27e4225cc90a5932354738", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302340, "uuid": "175bc81c-7fe4-41f8-b158-975d7c13b8f9", "value": "T138E52331E1BD6579EDA34231D0D60E173B5E23C5AD066E3F3FB148272863A8A6BC4764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302340, "uuid": "c902e34e-3532-4cc7-9316-0a23585793bc", "value": "98304:4X66goEiUHetka0gyLmH800Dx+KyksqYjq:06Si0UM80S8KMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791302340, "uuid": "841e266b-7bb0-4d87-89fd-0c73a772ea8e", "value": 3188444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791302340, "uuid": "d5b984eb-44c1-477e-87be-a23d71190b31", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302340, "uuid": "f8d8881e-e21e-40cc-bfc1-ac4448a334a4", "value": "krypton-crackbyserenity.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14077336-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263356, "uuid": "f0980d09-1d5a-451d-aa63-37b018b70a14", "comment": "Malware payload (Mirai)", "value": "42709e8fa9d67494d2dd8135a9e26b8a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263356, "uuid": "c62908aa-9244-424e-9f33-1c0ac593d4c4", "comment": "Malware payload (Mirai)", "value": "95aff8f144f665a442574864787b4f7f81988631946e9a8405abc7cc1116cac5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263356, "uuid": "803d7f0b-b6e9-4a55-aff1-6a92c8cd0089", "comment": "Malware payload (Mirai)", "value": "323e07180bc82779e4850536e8dccea1ef394954", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263356, "uuid": "873e9ae6-1a22-4092-8796-526dcbec2f07", "comment": "Malware payload (Mirai)", "value": "661323fef7b2341475e1d6304a6cff05f4dfa644937f62126e192940d0b3a21fa1ee4de453912a5ff9d59d2adf2f62e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263356, "uuid": "8743c71d-c15f-4a3f-9425-b607fbc547ab", "value": "T15B135D328679491BC2C0E77B11A79372E0F62B845190974F7E5A0D8EFE5A340677B3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263356, "uuid": "1cc0b848-7c87-4ef8-b509-5ffd2f3c4b51", "value": "768:t6jQLYeiLEKRBTMjONrElzbFjUDK1JviVIoX4M+DoIwS3ZhP3XRcqPbM+svy:BEbMjOU1hKIoDI9JhPnmqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263356, "uuid": "09a51e24-f656-400a-bcaa-0fedf26daf9d", "value": 43832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263356, "uuid": "5814b0c9-5b70-4a3f-8004-49a408ebaf68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263356, "uuid": "fbc5925f-5fa6-4186-ab9d-8a0e064e144a", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33942a4-c198-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791299781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299781, "uuid": "332c17ec-e6e6-4604-a227-e3500e145515", "comment": "Malware payload (XWorm)", "value": "f5bc7bd9c55012072f8760b377594eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299781, "uuid": "c4409152-6e4c-4e93-9be7-190fca5d0c97", "comment": "Malware payload (XWorm)", "value": "95cc71c5246d0cd7501801374354157f495002999ec8b0e372cda28aa31782d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299781, "uuid": "a0d8d3dd-26dd-4197-984f-3058a6e14e3e", "comment": "Malware payload (XWorm)", "value": "b82028f00ea85fcb4ad5af0c6d52e956597e73da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299781, "uuid": "99538ee6-4565-45b3-a42c-8a77f48e7a56", "comment": "Malware payload (XWorm)", "value": "fe63ef70ea154e369efa4bee570b3ce253ca6200594b86fd1ad5e77312fdc5917d15e8ee320e9f49584b116d6009aeed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299781, "uuid": "f5fbc1af-b941-4363-a8a3-7db24bb51a96", "value": "T1D1C280A67EC71DC68C686F2B6F2217743D042509CC3ACB9A767ABC3216A35F1C735A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299781, "uuid": "4a82b137-5901-4dbe-835f-0abd400cc4fd", "value": "384:daC7T9mDR0uFZVcddbUrwVeTXsOBU7EkCZwQn+BfDdSemDIzEvwesM2:cUslfdnMSsSSXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299781, "uuid": "a2ff1ad7-380f-476f-af83-038e4b5261e8", "value": 26788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299781, "uuid": "aafb4955-b967-4151-8828-95620a6c1a43", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299781, "uuid": "601b6755-e02f-42cf-9bca-49a43615292f", "value": "cxcscv.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f276be0-c125-11f1-927a-4201ac107004", "comment": "Malware payload (Vidar)", "timestamp": 1791250275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250275, "uuid": "d25f0cdd-f637-42f3-9562-1134b1b1808a", "comment": "Malware payload (Vidar)", "value": "f39df780d3a02dc4524ec85c8c38ce55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250275, "uuid": "0dacdd3b-b34c-4126-9f0c-6a8bb3ba6764", "comment": "Malware payload (Vidar)", "value": "960b0b1d55bbea03966505540d6ddff28a3400206621c73bd9e0627f47cf8349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250275, "uuid": "feb2a8a6-5014-415b-9e7f-4198a42cbd84", "comment": "Malware payload (Vidar)", "value": "6a2075ceb1266b1819e9ff8ad2c508235af9112e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250275, "uuid": "4cd329d3-ed26-4f83-8d25-f12da850fcb6", "comment": "Malware payload (Vidar)", "value": "c8d1b77d97cd01c33699afd0795b4721d866476e988315f7ca93b96a3b69a4d5f10601fb63ac2af035267343d6f8aed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250275, "uuid": "f544eb01-612e-44ba-9366-53f10cf1f644", "value": "T18896D75A328410DCCA4BD27544F05D7A23B23DEE1633B78B0A99BE952F12BD56F74E08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250275, "uuid": "eafdc7ff-57ef-443d-8b8c-8e1587114355", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250275, "uuid": "03a9771d-72b2-466e-9864-3fcf56f73c9c", "value": "49152:J/pheB9pMZzFZXPXyTZ1SEBV0BYWKDvMiVNuRWC6K:DMpwHQVYWCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250275, "uuid": "0297dd3e-98aa-46a1-b749-84f87a454939", "value": 9037176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250275, "uuid": "c15f69df-07dc-4767-9c0a-30505f5d8e29", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250275, "uuid": "3bed7e78-f2d1-44df-a2d4-c7ee3fab742e", "value": "S\u0435t_U\u0440 [U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c97d320-c182-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290106, "uuid": "b0a66d35-fc74-4df7-891a-81afab6a615b", "comment": "Malware payload (Mirai)", "value": "e645614c7ebc29824c49a18c93c21d27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290106, "uuid": "2450c087-d8df-4153-8e87-62a314d2df75", "comment": "Malware payload (Mirai)", "value": "96146ec777583371a9a11e40184cdeb4612532c977a2fc5f2925a84a23758178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290106, "uuid": "527b33c2-4840-4520-b1c3-027965c7af36", "comment": "Malware payload (Mirai)", "value": "c10e643ca1f92e570ff8ef73e68f0ec466b079c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290106, "uuid": "7053fe7d-d014-4aa1-b6ac-92c6d5192b33", "comment": "Malware payload (Mirai)", "value": "5c01c20a1eec992ad839cc9646698c057c28ab5ca5c20a9b04adc5b939d5a6ede46dc0a76e42b048f378059ffc66376d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290106, "uuid": "8159f364-4451-4988-b8c7-0fc549aab7e1", "value": "T15005F75B6E329F3EF579C7308BF34A74D69962D726E0C588F19CD20C1E2024A651F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290106, "uuid": "f10740ee-a688-4567-87a4-cded70ce4b0f", "value": "6144:6r8zqNv89CfFrO7RrAgH1tkR+o6sUB2kryHAx3p3f+xl76GAVHHDiAS2RCe6R4Ul:nziacROtsM3zSkMT31IE8OwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290106, "uuid": "df794dad-750f-45dd-8645-6b0adba770ed", "value": 858200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290106, "uuid": "9540a749-3f3e-47dd-b34f-9eabc92fdee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290106, "uuid": "010b9796-47b1-4982-82bf-6835bcd1ec0d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253ccbf0-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273263, "uuid": "158dfdbf-0b8e-43a9-8923-12d56ec1844d", "comment": "Malware payload", "value": "ce61f6c0011b016a145067f7d0c13b7b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273263, "uuid": "9a1195d3-3677-45aa-9705-d0eb5db142f7", "comment": "Malware payload", "value": "9616ba638e572098fb9aebf5b26f9496df5f25963b0e2f05e76e947d8f35c81c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273263, "uuid": "9b7e71e9-e665-401a-86a2-b53a2885b52b", "comment": "Malware payload", "value": "98cf55446cdc195336ad70a3fbf3601cef0f3b9d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273263, "uuid": "15ab72ab-7155-4491-ace2-b140915fc33f", "comment": "Malware payload", "value": "1308d8f72425957e2515139cc935a79e0b69d8be14c0183b1aad97ababcf7c631bd4685011fe839b437c2a7477ebe9b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273263, "uuid": "50d13fa5-c897-4f68-ad30-5d8823e23ab4", "value": "T10FA4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273263, "uuid": "86fd8266-2477-4499-a8c0-b3851464fe0d", "value": "12288:sr06zUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZH:sr06zUv4t1cNk/wjibhv4b2OnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273263, "uuid": "951017ea-b167-400c-83b9-813a1dc3b60b", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273263, "uuid": "ecd6fc70-c2be-470b-a283-6482e18d72fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273263, "uuid": "210d6101-43ab-47ba-878f-518a95b157ae", "value": "9616ba638e572098fb9aebf5b26f9496df5f25963b0e2f05e76e947d8f35c81c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d173e12-c175-11f1-927a-4201ac107004", "comment": "Malware payload (ACRStealer)", "timestamp": 1791284524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284524, "uuid": "87ad1990-54b5-4857-9d9e-b4359a818b91", "comment": "Malware payload (ACRStealer)", "value": "74988746f9d86290da22718e4462b97e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284524, "uuid": "1e0bfa1c-c7e1-4708-8ef9-51d1ec328e91", "comment": "Malware payload (ACRStealer)", "value": "9672cec466c2949af8b00a4a514a0a7a8a810040dc18943b46bc629266517a4a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284524, "uuid": "f6a9c55b-0c8e-424f-a8dd-501f80dc87cf", "comment": "Malware payload (ACRStealer)", "value": "6c81fb51fcd4b1933937a04dc9426bae556e9801", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791284524, "uuid": "289df399-e75d-4ffb-a794-d3130b1a818a", "comment": "Malware payload (ACRStealer)", "value": "23588409e1af690b7e6ea7f40992739415d66a147656f9d451344cca0e53fea4d3276db4a966e083de44a609c191d388", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284524, "uuid": "aa40d819-53d6-4c5d-ac7f-ea8599d41945", "value": "T12637330674D43E34F4AC6FB21122DEB2C0861D9A8721D85F518EB04A76F8FF44779BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284524, "uuid": "d3da3ee4-273e-4021-b69b-2a83e480315a", "value": "393216:UYTOrjQbwj5pntGHxzSkr5+NMUYR9AsIYORgi62e/ykM:XA1I+tYTAs9KgiVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791284524, "uuid": "95977f1e-08d5-4916-9ad9-79053e747f30", "value": 22351872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791284524, "uuid": "b4d04d00-5bd8-45c3-aa7b-f43ef7babf0b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791284524, "uuid": "f17addf3-eded-4cb8-8c95-a45b9f16238c", "value": "ee47.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232de359-c14e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791267676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267676, "uuid": "cc78b74d-e297-47e5-8624-17387df3cbc3", "comment": "Malware payload", "value": "2512a3b8103238d77ef60cd380dbd771", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267676, "uuid": "c2a55d03-84a2-4c5a-850a-63d6c1650a98", "comment": "Malware payload", "value": "96e267383f12e5cbd538fd2b5428b9e575995f3058304913cd819d962ed51e05", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267676, "uuid": "aae4eff2-511b-4bdd-ad44-e1866a6fb66a", "comment": "Malware payload", "value": "9b231fa1b1a630ba37ace25226eaf222b9e50d99", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267676, "uuid": "9ba99129-dd11-4fef-b17b-ccf2bf6eed77", "comment": "Malware payload", "value": "8d98b2991fc3037db30b9006543d8fc5e301c18b38840a22eee0f9c4ffca9984acf12917c9f3cd927e82727876b21e59", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267676, "uuid": "053ddd04-6a25-47d3-be64-335f75239203", "value": "T146E2111E7805CBF0DA293555B65BEC15ADF003A97838697B3D9BCD4D3BFB9108AC00A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267676, "uuid": "812e0a62-bb2d-4da8-a7d0-129c53cb7783", "value": "384:K7Qmr/U8OA62qzelp/PLYxu9gllqYNqJVsdNw3QftTr9f/xAZTvJpC506/dXPqCw:KrUpAGvmYYwNeZ9UW6ZyOOA35l7LccW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791267676, "uuid": "97cd7a5d-16ba-41db-b0b1-82f95465e563", "value": 32016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791267676, "uuid": "56aea7a2-8cb1-4fb3-baaa-b53ee630cb18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267676, "uuid": "78f3ff73-792e-4e64-869f-2c174d43f925", "value": "M.V. BLUE DIAMOND \u2013 Vessel & Cargo Documents.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf64fa27-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263670, "uuid": "09d64151-c5d7-4787-a34b-ffda8ced0f33", "comment": "Malware payload (Mirai)", "value": "c4bd600476305c5f2864cb47ac89ad6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263670, "uuid": "79943425-4567-49b8-91e3-155e13a3c1ee", "comment": "Malware payload (Mirai)", "value": "96f0ce2154f0402382d3e4d689810ae24efc756684b6d261f63dcd05338a97c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263670, "uuid": "0d72d8f2-2e5d-41e4-bf02-46df2af0e4d8", "comment": "Malware payload (Mirai)", "value": "799310df62026bc1edefb6a0d53a5ec59800b6b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263670, "uuid": "d0855def-9b28-4adf-b6b5-8864ea2073a4", "comment": "Malware payload (Mirai)", "value": "e457acbd14598e3e63a01cc524bcf845e7f16f71f69f2cf7822e8dfb36772794913ade5b1e6d19215ec01daa54f560e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263670, "uuid": "c7404cf2-2294-47a2-bf41-c17b2765f862", "value": "T172D308CFD4914EB6C055B975E9AA2533071AE4341B0FDA8660FBEAB0424F5DE700F6E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263670, "uuid": "2a3bf5ee-11ee-40bb-96b8-72a31c5ec1c2", "value": "3072:NOfgHjF188F/47sxodUc3Pws+R9uQV0jfDQJoYVfThLo5:JjF1T/4QLc4L9uCifDQJoYVfThLo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263670, "uuid": "e1da44f1-715e-4e89-8225-41df47b58fb3", "value": 134942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263670, "uuid": "ae6e1a19-5d18-4678-8f54-b8a0ec0d32db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263670, "uuid": "41a29a6b-bac2-4343-8cf6-a1caf983bb1e", "value": "watchdogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f93596-c1b8-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791313241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791313241, "uuid": "40086b0c-a944-46db-8141-1b474dd1d185", "comment": "Malware payload", "value": "a229a2a56784b769c882a0b78187bbc7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791313241, "uuid": "ae7ec904-3c11-4097-ac82-f4b822233fa4", "comment": "Malware payload", "value": "97a7cb9173bcef716a999ff6968805d416c02ccfa29a5f4f6fcc31e9a9878fba", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791313241, "uuid": "228ab24c-3dc0-457d-a0f7-dcf5a7bbb3a1", "comment": "Malware payload", "value": "5b33c89b9c63fd91a35edb58906d38aab97b3e5f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791313241, "uuid": "d350d2ca-dfc0-4222-9193-98125a227b94", "comment": "Malware payload", "value": "c41597a02ab9e4569fe096ddc0ee6248f3d382a545463d9692b8e72b6f5d52a2078aaac9295181f3949141a77257edb1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791313241, "uuid": "1f92abd6-aa96-45ec-b1bc-ceccdfcb2023", "value": "T15755F1018F72A0D6F5CCDB30362A8AAB9E617230844E11EB5B922E559D353D3F45B36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791313241, "uuid": "a554de30-b133-4757-b084-aa8d43941638", "value": "24576:vfhnGbjwruYm7N0qudA3FCPlxYZhhbdwBjuMsjN86ud83FC7zZWvHNbA:x2j15yxsrdT1RyZqpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791313241, "uuid": "251c38c9-4e9a-48e8-a635-c0628b0b1b86", "value": 1298096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791313241, "uuid": "4c498d1c-e839-4975-b90b-9ad8b81a7bf3", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791313241, "uuid": "1e82dac0-a0eb-49d0-b9c1-e8f6fe2e7fa5", "value": "macho_97a7cb9173bc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b091b2-c163-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791276754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276754, "uuid": "31da730d-3752-499a-a0dd-2b813b3dbd48", "comment": "Malware payload (MassLogger)", "value": "c28e997956b21b6c60c69faf7d92d1ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276754, "uuid": "7e7b00ac-c6f9-4e74-9ad4-a8f876446c83", "comment": "Malware payload (MassLogger)", "value": "97af6722f0dd949ea71cdbcb96d9da4907a0f0c4b5d802c02049f47c0b6bcca8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276754, "uuid": "2d5e5196-d970-4633-8c84-5e0fd1a18ae4", "comment": "Malware payload (MassLogger)", "value": "e6ba8f12b7043a7404177a708f8cbb010720c757", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276754, "uuid": "46607500-313d-4779-a675-7f01ca6bd537", "comment": "Malware payload (MassLogger)", "value": "c6a87c75e92d7dffa4023321550c8e878edd53d561ddbc4f1c493fa45ebe875097a8b08d0e9ac056d6f70573d75c218e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276754, "uuid": "ae212ce6-aa6e-4a98-88ea-e7bc3384beab", "value": "T16103FD046582758453736B7BAB2AA8E8F77706AB02814947B87C7490EFF1D18DEE0DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276754, "uuid": "2ccb0050-e56c-4d1e-a164-60d8aa085fed", "value": "768:DeftBPKB4EDX3zGLDtUtG5A76x7eIXZ9OLmgBUfP/ggS4NpiF+NWAmgAzUXCSPrC:0fEnIP4FyrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276754, "uuid": "6c4af8bb-c492-44a8-a3c5-9c35fadd1e62", "value": 40650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276754, "uuid": "c5a843b9-b118-44dd-b68f-39c5d5b603c0", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276754, "uuid": "953e6caf-476f-4c21-ac2c-872ed4131968", "value": "wjXowhdyTfqgNrm73w23CbvRhy6fw4HE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a629bcd-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271715, "uuid": "a0db2738-898a-42c9-8541-78d321c62f71", "comment": "Malware payload", "value": "adbd579cca9062fd06baeb28d53f73b3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271715, "uuid": "b52a4c3e-39e7-4c3b-863b-5951d4b91d23", "comment": "Malware payload", "value": "980cb84c8a9bb071a4fe536a877a8b939995fe5e1979da28ef0cca2db6d151f1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271715, "uuid": "86d2400f-2805-4402-a05f-936967cf813c", "comment": "Malware payload", "value": "886fc41cdd492e03baa3d45a5ea4b4f78ef6564a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271715, "uuid": "95ecc5bb-9447-4a92-9c0b-bb1f017de359", "comment": "Malware payload", "value": "b0149eea470b3a0116e9dd95bfe0579c55f596636bd8b31dc56aa5b349d60fe9810eeab354f1b3f63ec5b94d05922c77", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271715, "uuid": "19e330c9-19d1-47b9-8be0-5b2b5d89bfe9", "value": "T19355338AC17C1CC49F3E0A9779FF555CA2248EFC200208636B2A59A7253E74FC7B595B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271715, "uuid": "9ca24e7b-ebfb-4fac-b5d5-2b8139cf92a2", "value": "24576:aPTJsZg55qoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRK:abJZ5qoZ9bq+MmMEL+hcjXHC/wnwdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271715, "uuid": "5265f3e0-5efe-4b11-895b-d71882ed9238", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271715, "uuid": "8da44a40-9d9a-429b-9634-b5a96f8be929", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271715, "uuid": "8d3b10ad-6705-4727-905e-0b9a331d2315", "value": "980cb84c8a9bb071a4fe536a877a8b939995fe5e1979da28ef0cca2db6d151f1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941bf5dd-c18f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791295783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295783, "uuid": "f8c18782-e330-4e51-9a83-282c24c5096f", "comment": "Malware payload (Mirai)", "value": "a134b72ddb8d936e960a99e02085ea40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295783, "uuid": "a0170fbc-f65a-4cf8-86d6-abaff30e8039", "comment": "Malware payload (Mirai)", "value": "981188f75a785a16f604f4ccac7d5baa51cfeb0efad42820287c4a778e2506f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295783, "uuid": "894124a3-3189-4b86-831a-da8171125263", "comment": "Malware payload (Mirai)", "value": "d1d36e9fcf8a2b76b25d9add6f6434984a74f599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295783, "uuid": "95dde3fc-13bc-467f-9ec9-e5b41f8a6fc8", "comment": "Malware payload (Mirai)", "value": "d530ee660323d4f6c5ab6feebf5015dfc0114c5a2d693cf65aa81ca6e8598eee6321848d367f6898a8ae55ae7d3df34a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295783, "uuid": "3d4ad41a-19f8-43fa-9e50-3af15836ec5f", "value": "T10134C606AB511FFBD86BDE3702F90B0524CCB81622A53B753634ED18B54A58F5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295783, "uuid": "19c333cd-156f-49a8-a72e-d6d6ac8942b5", "value": "3072:TlfzmtDgU87UZEUfvEdr+X5DN83kgHXbqw:hfzmWUZEpx+XzVabq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295783, "uuid": "a9443bdf-3056-41d0-affd-a75889a8e75b", "value": 248984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295783, "uuid": "791f68ad-a723-40ce-98f2-95a157c02e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295783, "uuid": "1630374c-c4b3-4a1e-8d27-b4c1a48d745c", "value": "vcimanagement.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012b60d0-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275350, "uuid": "12b91cf3-b4f3-4d70-803c-30e244d7ebe9", "comment": "Malware payload", "value": "7069f1ca18a47885f0c944603719bb91", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275350, "uuid": "0f4338a6-ad55-4976-a251-2e42fc7c8da0", "comment": "Malware payload", "value": "989dc0232b71ce6d6aca5b336abcdbb8484634b19bde26bf06a8b3c31014ed0a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275350, "uuid": "d60e56bb-c9ec-4f27-a18f-8e6e2cf7a85e", "comment": "Malware payload", "value": "a5a1f8ceee572025ea4d18b6a9f1e761572b1579", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275350, "uuid": "e860086d-dbfb-4481-b62c-4ea5a53eb4fb", "comment": "Malware payload", "value": "47302c77006988ad59b30bf6cbc33c0d607e04cd06d65739bfc50a1c3c45b2ea7cc7c076c951760fa2c943b5358d33c2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275350, "uuid": "b81547da-6a74-4ea7-bf23-4f4817f12199", "value": "T193C423443911C1DD874A6F3E9DD44EB46E7D80E79A5A790027CEBE827C85AB033C9D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275350, "uuid": "ff8238c9-066d-439a-8fdb-b5957dca21d7", "value": "12288:dqwEDcCCXs6wlOMWROC/FTeHo22Qm7NzofOr/mShs:KgCCw4MQOC/gHozN7NzomLm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275350, "uuid": "5be42514-e3f4-4990-9f31-f8860671b577", "value": 578949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275350, "uuid": "eb766782-743f-4169-9e47-59eec194a3ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275350, "uuid": "cbe7f8f6-744c-4b4e-a6e1-2809a7ad29b4", "value": "989dc0232b71ce6d6aca5b336abcdbb8484634b19bde26bf06a8b3c31014ed0a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb001a47-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272226, "uuid": "56a57780-deb3-488e-bd88-a5fb680dd0ff", "comment": "Malware payload", "value": "ed1a61582d1e1adfd6fbb584bd0ba064", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272226, "uuid": "a9b83d81-930e-48e5-9910-e31b1bc51035", "comment": "Malware payload", "value": "98d3cfaf58bedbe0b0078a641780ed3ecc48284261dec60679ad9e98c9f87b83", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272226, "uuid": "6d5468a3-c3b1-44d8-9d8f-726fb2078dc9", "comment": "Malware payload", "value": "d34eb9845f1b7ebd9700a4833b1c32e41297f29a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272226, "uuid": "adbca19c-8a4c-4323-aa3f-4260c682f3c4", "comment": "Malware payload", "value": "3bcfa9a0a3a0a7569c7449b72b8100ea3b59fa0940c64ee585d3abcf11b8df12646435301a645298b684de49b73c175a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272226, "uuid": "b8e7983f-de93-476d-90bb-3cab07580824", "value": "T1FBB423CD64BED4A87B658DDA9FDCBFD30CFC003A6D7526F2A51C1A13A1C400B64A958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272226, "uuid": "c4f39db3-7df9-45bd-88c3-c4df87696a4a", "value": "12288:RB/e4pqNFTFbEXkbDoGbDDGIabs/7iiEVwYg2l3/2Nyb:RBm4pgThoGTabs/7iiWw0Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272226, "uuid": "b5822481-d31a-43e6-844f-3f8d8ef6dd84", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272226, "uuid": "24531866-34b9-43bc-9e61-f7a41e122034", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272226, "uuid": "a7162d3b-c4af-49bb-ac9b-41ba885452b7", "value": "98d3cfaf58bedbe0b0078a641780ed3ecc48284261dec60679ad9e98c9f87b83.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d638c7b2-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273131, "uuid": "660a2786-8b86-40b8-8a1b-cf3d6102a2be", "comment": "Malware payload", "value": "14df6afaf689e6614b57ee730548a23a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273131, "uuid": "f447a8f2-4bef-4a47-88d4-97953262ba98", "comment": "Malware payload", "value": "98fae314b26127e4653d68522881c7b83e454989ea7674e88985725ec022a0a0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273131, "uuid": "e829bb43-d525-4fa5-ba5d-151fbb17a640", "comment": "Malware payload", "value": "d5a18cd31a16635428dd44489ba838025571fcc9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273131, "uuid": "5670ca06-77a8-491f-a41b-f4086eaf9051", "comment": "Malware payload", "value": "3c5039ac78a9d83edc98abfc3f63ba709efd7a4698a55aadfb083f71f2b45ff8901f31b223c59a6ad880d99db9962eae", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273131, "uuid": "326a3b6a-a3e0-4e12-ad42-559bcf8a2912", "value": "T176B423F193429E0B23A4DAB457A3DB3375CE7291769D9311CA06CA9F4C7072886DC1AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273131, "uuid": "4ba86ed6-07e0-4f2e-b0c1-fde6de4f72bc", "value": "12288:Tkmht7DrvdyijCCH1oHF9nJ/qjuyQgoJrrzTPwkh:TkmHzMMH1ELnKQgoJnnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273131, "uuid": "10366447-f977-46df-a42f-b9eae745e36c", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273131, "uuid": "a7f1b95e-d916-4fb4-ac73-7824542c40f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273131, "uuid": "2b6ed1bd-410f-49e4-96e6-2ed029a6222a", "value": "98fae314b26127e4653d68522881c7b83e454989ea7674e88985725ec022a0a0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936e08c8-c149-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791265717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265717, "uuid": "5f4e3da0-f3b8-4620-ac9d-0295f0d79edd", "comment": "Malware payload (Mirai)", "value": "01abd7dbc38746598ba633f31e269a3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265717, "uuid": "ac5db55e-2a0e-4bd4-a6a3-55c818804c4b", "comment": "Malware payload (Mirai)", "value": "990b3aad88cb9453a0d2d83ce8c203259811e59f44dda1e720eb576c17c87177", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265717, "uuid": "b1a64cb0-2c15-4749-b951-4c6d0447f300", "comment": "Malware payload (Mirai)", "value": "21b7b94b4e68647210d80e98453691cc2a119b64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265717, "uuid": "b0ef7a72-cde9-4694-820f-410463a98f8f", "comment": "Malware payload (Mirai)", "value": "b6d9352078318c58fc13d9f3869ec2baef4031f35bbffe1e3bedbaaae65da251c937aa0aa76d69dc9381ad8ae6918602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265717, "uuid": "e554e3f5-c0c5-4996-bf80-2d48311cb74a", "value": "T10E1429CCEA50475BC5E323BAE68A428F33334B74A397F31559ABEBB027C27595D21181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265717, "uuid": "808190de-62d7-42a6-91c9-01a3aa184f88", "value": "6144:IOrbtBaJpPh/9PBnMzm+GM/9sPWmy3CwZU2Sk2:IOdBaJpPh/HM/n/uPWmy3CGU2Sk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791265717, "uuid": "bda0d7e4-9de4-4ddb-ad27-a5957e96561a", "value": 207316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791265717, "uuid": "42d73b14-5f48-48c4-bba3-d6b126ed9058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265717, "uuid": "f2d7a183-4688-4151-b0d0-b1370eaff71b", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2321f7fe-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276266, "uuid": "85df3422-bea3-43ef-b850-39474446ffb3", "comment": "Malware payload", "value": "4434659944c43586f99edf917ccf063d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276266, "uuid": "6af44519-c534-4330-9b1d-d8361ee67e6c", "comment": "Malware payload", "value": "99176c241059e37309b7dec1a22981c40a1630ff3613861f4dc4591e1612b580", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276266, "uuid": "ba10f736-2562-40ca-bdc9-2c869dbe2bcc", "comment": "Malware payload", "value": "641191c8d5e2e06e6e453e37ec5604445a8ab81e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276266, "uuid": "bf1cbab4-e567-43db-846e-78270cb4e884", "comment": "Malware payload", "value": "df3c3d0262704afd39c1304d3c2a9c249a3411271673e3c7637cb436e24c7fac9820b6e31f5d580c9b7011f7b3a7b776", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276266, "uuid": "808de7ad-89a4-4b4b-b446-f8ce4cd0c03e", "value": "T11FA4232C59610F367DB7778089395F02472098073BDDABEAC70F3AA84DDEC909A66748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276266, "uuid": "2222c27a-e96e-4682-a02d-9c5554233509", "value": "12288:J/pj5tFltx5309/CzYfcEaN9B/Jm0LU0gM7aQX:HjPFj30BhfclN9BhmSH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276266, "uuid": "9a376fb5-cbd3-4218-8aaf-dbd857dc5d7a", "value": 467527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276266, "uuid": "90941373-9c72-4ba3-af32-b86726d46e74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276266, "uuid": "a988f158-077e-456a-aee4-bcd36408e2e6", "value": "99176c241059e37309b7dec1a22981c40a1630ff3613861f4dc4591e1612b580.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40f7ab7-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272697, "uuid": "e9844e57-7ace-4f2f-a5a0-7d53fe397b1d", "comment": "Malware payload", "value": "f1a58712c5421bd4bec8170a9b4d5fff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272697, "uuid": "fe0df28d-4a8e-4bfd-8efa-3ff2907169a4", "comment": "Malware payload", "value": "9922ce6fb0ec820a1eaae7e3a96643b6e7bdb43f7bba8d19095a60a33b12a0c7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272697, "uuid": "0b6b1955-fb2b-4e44-b2de-73c07c9e53cf", "comment": "Malware payload", "value": "f4b1b6fc409af3f1d106241284c3abfd1807ca96", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272697, "uuid": "f2790424-227c-453d-8638-869eb675ecd0", "comment": "Malware payload", "value": "c0d99d4790a70c265198b00421b0dbbf56ff13ef77d93d050903cfb74351969afc86ddcea144dfe1f7d8a63df77cdc9c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272697, "uuid": "2cf65906-9a0d-47a2-b00f-8b4eb31d611b", "value": "T128B423F193429E0B23A4DAB457A3DB3375CE7292769D9311CA06CA9F4C7072886DC16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272697, "uuid": "4f7c723a-ce15-4ccb-8e00-beb9634d53d5", "value": "12288:8kmht7DrvdyiECCH1oHF9nJ/qjuyHgoJrrzTPwka:8kmHzMFH1ELnKHgoJnnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272697, "uuid": "8e93cb18-b3a5-4d10-8b7b-58f9974f822b", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272697, "uuid": "b677a8af-b997-4736-b5a4-06110f6fa2e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272697, "uuid": "5e17383e-dac2-4367-b5bc-b28646b10ccf", "value": "9922ce6fb0ec820a1eaae7e3a96643b6e7bdb43f7bba8d19095a60a33b12a0c7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa663da-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275965, "uuid": "a9385141-06de-4e15-8bd1-37375ff4c1ed", "comment": "Malware payload", "value": "c0f13ff7406f012634843d16bf9138c6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275965, "uuid": "6b436f2e-db64-4d24-bf1a-a1fe460808a7", "comment": "Malware payload", "value": "9979fd4035e441512ead4e438b1c1a01c2713fb649ddf747dc469250255da04a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275965, "uuid": "ba8c658a-bd29-435a-9e38-968128c9ab75", "comment": "Malware payload", "value": "a73fd4f43155ae3359a74213f7794cf9bff1e347", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275965, "uuid": "2a110f16-898f-4c11-8f5c-2332687be4e5", "comment": "Malware payload", "value": "297274d72bfb1b2d2884bad59fe377b1f5a1a784b023d1fda6687b410d77a6a94052aab73cce369220dfc6587a2bb486", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275965, "uuid": "1ce733f6-4c65-4b84-8db1-9f73c2068f3d", "value": "T132A4238274716D06D096CFBDE4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275965, "uuid": "5d508554-3419-4d7a-a638-3e5b34ccbbec", "value": "12288:Ar066Uv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZw:Ar066Uv4t1cNk/wjibhv4b2OnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275965, "uuid": "0a3892a6-da78-4fb9-bf0d-0be1c5d7c9ae", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275965, "uuid": "9d860a99-9500-4cdf-b862-536488629f4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275965, "uuid": "4d602b50-7f71-4014-ae34-c8a0b3926097", "value": "9979fd4035e441512ead4e438b1c1a01c2713fb649ddf747dc469250255da04a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3203ddb-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271327, "uuid": "e2eae03e-97dd-4458-ab47-359de1396c4a", "comment": "Malware payload", "value": "2c161ae8741327a435f861943f7dcf1b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271327, "uuid": "4c619872-db39-4245-a0a0-b59bdb42a2c4", "comment": "Malware payload", "value": "99ebc3a47de2fd9bd0e42eb7e679c8a9bd8301fdc0af50b6aec8987ffc50cf3f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271327, "uuid": "a786ea8f-061e-4876-8392-f3441b15a0b5", "comment": "Malware payload", "value": "da5a4b9cdeabd331daa0728e6f94a4dd9529225e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271327, "uuid": "eb757e72-7d10-4c85-b1ba-2503dc40bd82", "comment": "Malware payload", "value": "d725928835cf297b6aa351287b484dbc70d94ee7f92267533889c5d1eb120ea6884b06b1d34466e2f972421f8c961bd6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271327, "uuid": "35d6573e-41fe-47ee-b77d-56f5644e7f2b", "value": "T184C4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271327, "uuid": "43d437bd-6791-4b14-a1a2-ed1003e59c84", "value": "12288:BMU+0xq75aS9iYIp6cP/G2Bku8ItNvC28c5/VTUPkYyh:F+J71vI/GOYc5/pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271327, "uuid": "fd583605-7dc3-4e27-b932-7daf6b288d78", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271327, "uuid": "ff14989c-8127-481d-b038-8922b77ad5ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271327, "uuid": "bce0d409-cd75-4d0b-92e9-4cf466650d05", "value": "99ebc3a47de2fd9bd0e42eb7e679c8a9bd8301fdc0af50b6aec8987ffc50cf3f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c9665c-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271466, "uuid": "b06480fa-6b7b-4e0f-973d-d4e22c43e359", "comment": "Malware payload", "value": "7ea83f56dcf9594ec58d023c566fa016", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271466, "uuid": "1222522e-a55e-4399-890a-560ddc2a1583", "comment": "Malware payload", "value": "9a825e4442d9c4e4d5cf4bbe7f3a751d5675d981d8a5c9354a9b075f3a4c9362", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271466, "uuid": "a2e001b5-7a97-473b-9684-7ed6e4ff61ab", "comment": "Malware payload", "value": "5256dd10eb3fe3a01dd5068c7de5e6db15fe1f86", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271466, "uuid": "aa27dc72-9870-434d-b423-851cdc9729b7", "comment": "Malware payload", "value": "998f3f64a57c9c7625ddc3316ff362a02875865f3a214c9412727812b5c38621409375af8fd58eb39e1ae1ebbfd57925", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271466, "uuid": "6edbce0d-61c3-4cee-94b9-a9dae38cf8a7", "value": "T1DF5533CA813C25844F3D0FD67AFF956C61248FF810411C676F1A98AB253E35F8275A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271466, "uuid": "2fe75a07-d09a-48fb-af95-bb7981720f90", "value": "24576:LoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRxBc644:LoZ9bq+MmMEL+hcjXHC/wnwdxK6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271466, "uuid": "4e7984e7-988a-42be-ac40-9d519ffd228c", "value": 1380032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271466, "uuid": "8a8879da-2270-4b8d-8010-5493a3c6d65b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271466, "uuid": "f9c5217d-7bff-4be0-bed4-22206e539e0a", "value": "9a825e4442d9c4e4d5cf4bbe7f3a751d5675d981d8a5c9354a9b075f3a4c9362.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74daead6-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275115, "uuid": "d13621d0-5fdd-4cee-bed9-b34c711ef993", "comment": "Malware payload", "value": "c579187bce56bf2b515a9e3f059dac60", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275115, "uuid": "fc8d2bd7-47ad-491a-bf76-3aa0e0a411cf", "comment": "Malware payload", "value": "9a9042c5e84f021dd44afcff16de555484e8e8a3c3dfb29f4f6de7fb9554b58d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275115, "uuid": "f078034d-c11d-4754-a10e-60a932c463a9", "comment": "Malware payload", "value": "3f8a36c18f9f4cb7b91eccfcf4988ab50734ba80", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275115, "uuid": "649fb757-dca1-4aa6-b86c-d5bbdc2f0dcc", "comment": "Malware payload", "value": "5867f6e9263783c010f684cdf64efc324d55cc0df6abb9969a72b71f319278d2f540e7cea1b5ae815fe81c116123f272", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275115, "uuid": "2201bf57-1fd6-4276-ac87-d44060d4944c", "value": "T1C9C423195942D2CE83D43F7E8EC0BBA03E7990EBEB0DFA0416DA35917C95251B3D492B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275115, "uuid": "d2f28a92-1687-49b3-8ccc-265a98e083d3", "value": "12288:wdevMEkFmHkh6wlOMWROC/FTeHo22Qm7NzofOrAHmN:kemF4MQOC/gHozN7NzomMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275115, "uuid": "c15e1681-5fbd-4cef-b4c2-a7884aa538aa", "value": 585382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275115, "uuid": "19b17b0b-df5f-4610-b1c9-db556bb202f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275115, "uuid": "074a6767-22ff-43aa-aa8f-664954532fe8", "value": "9a9042c5e84f021dd44afcff16de555484e8e8a3c3dfb29f4f6de7fb9554b58d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4785bffb-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272462, "uuid": "bba1530b-3167-43f1-b592-67320930fd5e", "comment": "Malware payload", "value": "6581785487dc9609d0a1a316b0a1a718", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272462, "uuid": "433c6583-d7c9-49a8-b0d8-eb7eefdc67b2", "comment": "Malware payload", "value": "9b00975e1519a66c12e9b7eed6154ae05aff5658de0f75620737cfd0cdca120e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272462, "uuid": "23cbbc87-b21d-4301-aa7b-725993da3c33", "comment": "Malware payload", "value": "b55c0d8c82ace89c64cd094482dfb97e7309efae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272462, "uuid": "41e60559-1fee-44f1-8458-db8aca283caa", "comment": "Malware payload", "value": "ebf218a2bbc63609838665bf047b3ab5a04318fdbb298946993f1eb904897ae401d06ad90a3af7a587dd1b45bbd3d646", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272462, "uuid": "2e57fd8f-a147-4195-aff7-ee82d6931594", "value": "T15DC423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272462, "uuid": "231fb6ac-a778-4ae7-80de-a7622d39e3d4", "value": "12288:YA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWNSFyorOIic/7MPQ:jm6Jj6ESfUxZ91kmY/99z8sFXicTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272462, "uuid": "dfdb8c07-9bd8-4573-9d38-ca6ebeb36b24", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272462, "uuid": "ac6fa824-28ee-4eb9-8acf-c6b6b8512441", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272462, "uuid": "eee79c76-2e45-47ae-92e7-985f33eded6f", "value": "9b00975e1519a66c12e9b7eed6154ae05aff5658de0f75620737cfd0cdca120e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e431ae-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276435, "uuid": "5cbc05b2-542d-4832-ac5a-8fea5514250e", "comment": "Malware payload", "value": "9becc054aa513a55aa6870783d168c07", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276435, "uuid": "b6b2e6d9-02f3-46a8-a281-401796fc1bb6", "comment": "Malware payload", "value": "9b3a5323c6543018e2dc06e6ad5a9fbd3d8274a53d01a841816b3d16f67d4cfc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276435, "uuid": "3c617026-da81-4740-9858-9ca787fb5368", "comment": "Malware payload", "value": "994903d4ea8ea23139dc871e4616ed651664c63b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276435, "uuid": "eee2cdbe-c7d0-4cc2-bcf8-028d493786f4", "comment": "Malware payload", "value": "1d57579995d5b5d2a5c5754bd1b3c77d7db3adb15ca7935c740475ad5a73cbfc4f9e45e3862514defcd6368ef69a8363", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276435, "uuid": "70bebee0-663c-4e44-b923-aee66dff55ad", "value": "T102A4236D922554376D67B9C0AD1D2B120A70D18932DDDBD5CE0F38A08EFAC9C1EC61AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276435, "uuid": "d7c578fc-4d90-4632-bf09-857b451549e9", "value": "12288:eW+GusvMa+IzYfcEaN9B/Jm0LU0gM7aQA:eWF/vMaEfclN9BhmSH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276435, "uuid": "3f2d56a6-4ac4-48cb-8693-1a173d40da44", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276435, "uuid": "f93ae415-a17f-409d-8ea5-8c183b03f7e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276435, "uuid": "a624a955-d04c-4d17-95ea-6fc21fd1f986", "value": "9b3a5323c6543018e2dc06e6ad5a9fbd3d8274a53d01a841816b3d16f67d4cfc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857d6001-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273854, "uuid": "23fb54db-e91c-4b69-b002-913dc902ea27", "comment": "Malware payload", "value": "e41238c8272cab8dda6e4d9dfd38e644", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273854, "uuid": "5fc41dec-fb0a-494a-93d5-88371ff56ed2", "comment": "Malware payload", "value": "9b812bdfc0ed4dec96a0c4f0d2018037ac2b970faf5eb9076d03c57ad80055db", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273854, "uuid": "d212fba6-a25a-44bb-9022-4fed043ed42e", "comment": "Malware payload", "value": "7e75d973ab3674d9fe404fabb22cef13445b2a63", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273854, "uuid": "20947adb-c9fc-4c36-b84c-3591226b877b", "comment": "Malware payload", "value": "eb1834707ad277ef6b8e05ad616338b1cd72a18dfde284fc7e47d34432cea29584425b69276dae9c073ca89c5c4f1161", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273854, "uuid": "6668d213-abea-49b5-b98d-908bc5144f1f", "value": "T1C2C4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273854, "uuid": "316ea11a-c4a3-4e35-b8a2-adb6871a0b53", "value": "12288:VMU+0xq75aS9iYIp6cP/G2Bku8rtNvC28c5/VTUPkYyk:h+J71vI/GpYc5/pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273854, "uuid": "e07390a9-ddfa-46d7-9675-a109f873a4fb", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273854, "uuid": "acc9cbe6-60ca-4c35-b5e8-d63dbcdfed2b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273854, "uuid": "bdf10d3e-6064-43d8-9b56-6d5747061ae8", "value": "9b812bdfc0ed4dec96a0c4f0d2018037ac2b970faf5eb9076d03c57ad80055db.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69956c8d-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275955, "uuid": "dc21e695-5e5f-4589-95f8-f915d95cdb16", "comment": "Malware payload", "value": "14067edcca71787c801cb03cc53ebfbf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275955, "uuid": "cbc3b664-23b6-4471-bc52-993baab98734", "comment": "Malware payload", "value": "9b878267e068ed534a12b81aa1cf82a9e0801264a72d51d82a5c106895813695", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275955, "uuid": "1d4dc1b0-ab78-42dc-b394-05d626ffa16e", "comment": "Malware payload", "value": "aa6916fbbfb1106761c04b39173b9955136ae70e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275955, "uuid": "50dca4af-f6bd-4152-bd10-3a774861b9d3", "comment": "Malware payload", "value": "4330d5edef6f4c867d95c512696014404efcd2d7614761164aedeb4260ba07754039eb04867baf450573f9f2f459850a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275955, "uuid": "e42ca97e-e764-4c9e-b7db-47209be475d3", "value": "T184B423F193429E0B23A4DAB457A3DB3375CE7292769D9301CA06CA9F4C7072886DC16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275955, "uuid": "3be91537-f67c-4612-a4ae-01822234c7f6", "value": "12288:wkmht7DrvdyiECCH1oHF9nJ/qjuyngoJrrzTPwkK:wkmHzM5H1ELnKngoJnn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275955, "uuid": "5f0fb87a-ecf7-4233-a44a-5cfa660689a5", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275955, "uuid": "5c6264e1-c0a8-4f2b-9295-af37aed41884", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275955, "uuid": "615e8b19-9a1e-4e4b-b817-1bd5a6881bb6", "value": "9b878267e068ed534a12b81aa1cf82a9e0801264a72d51d82a5c106895813695.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee58c72-c14d-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791267427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267427, "uuid": "f565e294-f5af-46ef-8470-526c0055d20a", "comment": "Malware payload (Formbook)", "value": "b51388e42f98c44816102b669880e625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267427, "uuid": "75bf8bab-b4e8-4c0f-ba21-d19d203a269d", "comment": "Malware payload (Formbook)", "value": "9c374c3801bdcfa56b3c6c264ecb9e54acae6536b5ca77b9927abf76592457a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267427, "uuid": "b33383bc-6913-4db0-9813-87d8dc4ac157", "comment": "Malware payload (Formbook)", "value": "470e4fe714958203c44456ee3c346ee4cce3871d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267427, "uuid": "9b27324d-9692-4584-bbb9-42f6ec79d6c1", "comment": "Malware payload (Formbook)", "value": "c70cd63ec84cb9204319bf93b400e6cb576f0619c631e68edb5904694e6fcf27153f2ead370ece4ed58cb6daf49d70e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267427, "uuid": "b5c68843-5ce0-4952-b7d2-96940d1ddcd9", "value": "T11F158B44225BCA23C25126B0C4B2D6F45374DE54E932C33B59E97EBBBF35FB0A5502A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267427, "uuid": "346f9888-d19d-4a06-890b-18835a1faf52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267427, "uuid": "b1b1e3d6-e402-4061-83af-782e1746dde5", "value": "12288:Aoh7n4P0Ykc0ZorIWxU0Yy337mfDnhxWCrh4FwBsc4BA4/NQGXhU9srC4mw5zl2/:AoRZpo1xtYy3LuWCdlsckFG684m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791267427, "uuid": "55fddb76-cd22-482e-804e-d901f9317db5", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791267427, "uuid": "e7d312e9-fa79-4790-9675-8fd1eb74c47d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267427, "uuid": "0f970d4e-4404-4509-ac61-a27f23e93c6a", "value": "Payment Confirmations 20260510800017023.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52681018-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274198, "uuid": "c573db7e-2f2e-43cd-98c8-acd203abe197", "comment": "Malware payload", "value": "e383b9b80af3489895aae4f3c0c4f7e1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274198, "uuid": "5ece66e0-fad2-4800-a374-ee48760bcdb3", "comment": "Malware payload", "value": "9c377e8565861f1ec72b80b4a3b3dbc667a5c0eed27ee6f90db069b5821fc197", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274198, "uuid": "70a933ad-8867-40b4-886d-a819757f988b", "comment": "Malware payload", "value": "ed6dacfedbd87b4257953ce90813a21ea3975772", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274198, "uuid": "3838ac9c-91fe-4667-befd-2bc21e08cdfe", "comment": "Malware payload", "value": "c22167855cf86e6e905b893a1a1b9fae26eecfc081ff3354e8a7ebe9f32375b0d8b24243a6d596defd333d3762cd6312", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274198, "uuid": "60e03303-0d0c-452d-8d5f-fa72c6f67407", "value": "T129B4230A85D01FFF899ACB9946D4A4762FF467952F93665BC0CD20700AEA203D6EFC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274198, "uuid": "3da147b9-1f2e-41bf-a941-df0152bbcccf", "value": "12288:/vOi3UDYXndLQ/jJOjB89RitlR0XjuIkVp69d3iY829uhBcbY7vPpCkIq:/WiEGnlQ/jwyil0X7kWv3icYcb9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274198, "uuid": "4bb67397-467b-4967-993c-551511c7a498", "value": 540419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274198, "uuid": "4c438c85-b759-4ca2-8719-3d78225b1bb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274198, "uuid": "8935740b-d3a4-4b26-8065-132dc8b79981", "value": "9c377e8565861f1ec72b80b4a3b3dbc667a5c0eed27ee6f90db069b5821fc197.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb06935-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275185, "uuid": "9584e01d-4538-46af-ab26-3aab81028a33", "comment": "Malware payload", "value": "b8eba9696dfa5963b70fa5a6bc4bcf42", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275185, "uuid": "9c5e9d72-496e-4f1e-b263-7ed7f758f176", "comment": "Malware payload", "value": "9c6e9cdf0c3bd43c57b74595ffff2f70cbba9cf4aa03c89ad64400bd9f6be287", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275185, "uuid": "e57d74fe-9402-4603-89fc-a48af2547d65", "comment": "Malware payload", "value": "3b4cabc7f39ca4276ca9d376279d90f5548a4d33", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275185, "uuid": "0b506cae-8992-4e2b-9218-3a8530b5053f", "comment": "Malware payload", "value": "0cf9a9791f4a9d9427b229142f37748db86aa260128339ed257cefd77277d92f09a03ab5b4bd97903250e51ec9820e91", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275185, "uuid": "2a446454-5834-4f1f-9e7b-f04be20c13a0", "value": "T1E9553386817C2CC48F7D0A6677BF955CB2244EFC200204776A6B4867213F6AF8B7995F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275185, "uuid": "c3d02a64-5f46-4fb2-ab5c-c16906a29c39", "value": "24576:0oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR66WAoMnCPz:0oZ9bq+MmMEL+hcjXHC/wnwdwAoMn0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275185, "uuid": "5bb53ded-3472-4051-a898-2d951063124d", "value": 1380820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275185, "uuid": "7895219c-a0df-4f46-a490-923fe4bf9be6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275185, "uuid": "2c41e32f-5b1b-47c1-8cd1-28a00ddc23cf", "value": "9c6e9cdf0c3bd43c57b74595ffff2f70cbba9cf4aa03c89ad64400bd9f6be287.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e291ab-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274318, "uuid": "f27cf546-4117-4e90-b64f-f75fad666be5", "comment": "Malware payload", "value": "c497b0bfe2839838f49bc5e4540beb68", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274318, "uuid": "73db5044-25ed-44b0-a1ed-90e40c9da9aa", "comment": "Malware payload", "value": "9c7d026a76585c757091d98e5fb3b3ffa293b5fa145ceed71178d5e85b89303b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274318, "uuid": "0fb73864-b846-4016-81b4-34c2f4dc59a7", "comment": "Malware payload", "value": "212da5c277dbf911336b0818c33b5391a06e4221", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274318, "uuid": "a6d14bb7-a569-494c-b23c-94392999e317", "comment": "Malware payload", "value": "7794f247ee2a252580939a8dce48a47a79a21ef10a67f2482d688fb39e3cbefb7866fe17860fcb12ff3ffa913182ea4a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274318, "uuid": "708fa8cd-6332-41f8-a9c6-217dc6ea1407", "value": "T10DC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274318, "uuid": "febf68ac-4d4c-4f6d-bc41-9c0d330942b6", "value": "12288:j+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2by6H9I1P0QKw6FE8:j+QqldA/TSO713u7xn6H9IaQKHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274318, "uuid": "bc0d85e9-6265-4fea-83a0-c0b03df726a7", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274318, "uuid": "1fc3a436-1e83-472a-ab7d-2a367efead92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274318, "uuid": "97d43b04-f108-4207-812f-0a79428e0561", "value": "9c7d026a76585c757091d98e5fb3b3ffa293b5fa145ceed71178d5e85b89303b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7b9ef2-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290484, "uuid": "66a82295-0722-4461-93cb-08d79948fd32", "comment": "Malware payload (Mirai)", "value": "644fa84ef970a3836bede081df79deb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290484, "uuid": "ad0a6203-6fd6-489d-97f9-5d205a6c9675", "comment": "Malware payload (Mirai)", "value": "9ca2a973cc23f2da991570aa2db08dca38eaadcf69920badbf58251e6887ed73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290484, "uuid": "1d44bcee-07f7-435c-81ff-62bf4f5813a2", "comment": "Malware payload (Mirai)", "value": "292d30b070cdeb0f2d01f99315861a9e10ed06f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290484, "uuid": "3bd5bd33-6a1b-4ec7-98a8-61fa0919bd81", "comment": "Malware payload (Mirai)", "value": "041cfd9e743a1802d671477fa02386094a60194ba57ce9ba263e06e113258ebfcca98b3fb9036a3fa3c6e61ce8725c4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290484, "uuid": "3b045ebd-44a9-4714-adda-a4a534a0b786", "value": "T1B8434AC4B183FAF1DC05017C307AEB325E37F0B6613AED9BD7E455B3A855206960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290484, "uuid": "0d08651d-fcd8-4c1f-bbac-81bb1caacd03", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WbEoPRdQZl7dDFfG:xzuXndFq4ZthB/VUfOW4oPnQj7dhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290484, "uuid": "cc82713b-497c-4cbf-93de-2491b88f619c", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290484, "uuid": "b5cf7609-9d71-4829-8889-a11bda0acfd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290484, "uuid": "64f6548b-d473-4f07-b085-9598d44efffe", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c2821b-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791263887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263887, "uuid": "9339b17e-2e44-4b11-b407-392d0f97c319", "comment": "Malware payload (Gafgyt)", "value": "553c023948d92bd6dc72f27204255fbb", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263887, "uuid": "7e818421-e4cc-4944-b9f8-3ad9ecff7b35", "comment": "Malware payload (Gafgyt)", "value": "9cefa49238c85632f4de8c3bc682cecb797c6308d76a3206aa8a64ef947c8285", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263887, "uuid": "2f5f01e1-4bbe-4add-93fa-acb9a821f19c", "comment": "Malware payload (Gafgyt)", "value": "0a994b9af7749b40b8b32285cc6065b161ab6259", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263887, "uuid": "2ecbb294-d23c-4d48-b283-1730cae2735f", "comment": "Malware payload (Gafgyt)", "value": "657479686a9eb1e517c4289d01e6df6f3d0d3d75fa95482f6cf9a599957147662bdd5ab2ce5eebfcd736b1331e26d2b0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263887, "uuid": "3b5cf6cd-ba1e-4655-a566-6b770f7bd877", "value": "T1A4243B07B5D08DFBC4D6CBB417DB95618923F8291B32320BB794BDE92F4DA986E0D214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263887, "uuid": "bd805663-da33-4f9f-847a-e882e432b6cb", "value": "6144:qXQMV0PU4MUMkp7uUifXEQeLot+MM5j4Ja4bpKQzI4bHl:qXQMSU4M5kpyXE3hMM5j4Ja4bpKQzI4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263887, "uuid": "c4547c91-ad65-4f48-8acb-99828b549626", "value": 222367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263887, "uuid": "baeb415d-f5ab-4eaf-935d-154c91bf4f14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263887, "uuid": "f9c8248b-50ac-466c-97e4-b97db66ff277", "value": "qv3.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8211087a-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791273419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273419, "uuid": "cf210352-46e2-45b5-b64a-a77efedf7a3c", "comment": "Malware payload (AgentTesla)", "value": "12a13ce4e2e841a29fc34fcba3e04254", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273419, "uuid": "75ced629-9af8-4e91-9f71-0b0eb37b3350", "comment": "Malware payload (AgentTesla)", "value": "9d03c9f9e3fc6b4c0b412658c780c2b2fb8cf00c33f3d4eaef9bc890c66f8a41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273419, "uuid": "8f320ffc-46fa-4aa6-bfa1-eea528c3b66c", "comment": "Malware payload (AgentTesla)", "value": "c50a747b5863f4625be46fc4f5289cb7cc1e000c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273419, "uuid": "8a141936-9a5f-4ebc-8349-16a3a6575fbc", "comment": "Malware payload (AgentTesla)", "value": "6525b8e3d7f1815244fb53edaa8ad5de64a20197ffb2b4bd82af19bf0294a6303d5360c8eaa85209bce1bda66c11a771", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273419, "uuid": "1fef0f26-70fe-433e-9453-90a3c1e77821", "value": "T1E7454FC70C7250307BEC9AF54D760B684F21D40CD099B99276EB3C893D5AA9B90BBF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273419, "uuid": "30d119b9-d1b1-4132-a6fa-3e692b155224", "value": "24576:E/Xxy7eOwodT3GieH3IaVo9DK5kslpppCW4TDOu3n8jh0abdPfhzKcKiocg5cGWi:E/By7lwodT2ieH3IaVo9DK5zlpppCWer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273419, "uuid": "044267f5-d67a-44db-8c66-14d5fb9febf0", "value": 1230504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273419, "uuid": "e63fcd9e-9e9d-422a-8938-1a497b85d4f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273419, "uuid": "0395184f-92ef-4eb7-9b8c-08beac9fa0a7", "value": "Factura.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae9a410-c141-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791262455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262455, "uuid": "96d16126-e65e-4579-a490-46c94da924e4", "comment": "Malware payload (ConnectWise)", "value": "fdc1fc279a15ba9f8e02f1eb46616475", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262455, "uuid": "374d65e6-df81-484f-bfed-ac35a58be396", "comment": "Malware payload (ConnectWise)", "value": "9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262455, "uuid": "c48c71bb-883f-47a8-a06f-b9ae6c75a530", "comment": "Malware payload (ConnectWise)", "value": "c47df50e3377271cd7b005f2392ed5d39111c009", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262455, "uuid": "d0365347-4690-4a21-af86-0c5014efdc6f", "comment": "Malware payload (ConnectWise)", "value": "612a2fc10b325405ed6c6b759a973a25351ad0d2452667e9de0d3342ae91103a2de01b2e01b3a8b0107233c34e71fafa", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262455, "uuid": "762ce6f4-58c8-48ee-a1c9-bd7970447882", "value": "T18D836C43B5D18476E9720E3118B1D9B45A3FBE110E648EAF3398426E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262455, "uuid": "c5a3c787-3045-4568-8dee-eabf7d307c6b", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262455, "uuid": "4d8ca015-69bd-4009-86df-0a438a7abd39", "value": "1536:qxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYR7SJE:4enkyfPAwiMq0RqRfbaWZJYYRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262455, "uuid": "417f13a8-0c47-45ad-9a00-be5b81bfa144", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262455, "uuid": "bef002bc-2045-459e-bedd-368862d86046", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262455, "uuid": "5e7641aa-9294-4492-97c7-2c92b9b2471f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a458db-c199-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299997, "uuid": "2960af5d-6f79-45a3-9fee-97b8189408c6", "comment": "Malware payload", "value": "d6b25d1077b6c25fc206e30c1145ea2b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299997, "uuid": "cc9ffa32-500c-4d38-851d-e1f9c703f82f", "comment": "Malware payload", "value": "9e4ae81e6e9bdb50e907d4d4d611692c91d050c929a95314a3ffcd26d15f79ee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299997, "uuid": "2db137b3-0eb8-435f-9968-bf019d549bf7", "comment": "Malware payload", "value": "89b529a0647238ac3ce0a216b71b19298e099757", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299997, "uuid": "5dc1d8f7-2a96-448d-a904-27ca21a4db45", "comment": "Malware payload", "value": "8a643aa600f4ddd19dde53189c9a05e9510a26877e38c392ff7b02edccb4e9b34464c295f605a2104d4d38fd527c4921", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299997, "uuid": "97cbc35c-f4e6-4080-9b5c-668b9ae8700a", "value": "T13B15126AA26C107ECC77D735E101DAE1D43025A0911FF49E4F7406DE2842DAB8B57BED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299997, "uuid": "29979885-b57f-4a2f-8d99-f7c8b54e7389", "value": "24576:jpx/uhX8fdiABs2LJZdXypfV2WMcPXMjU8Sec0a:jpx2hX8fVXzdXSf9538Ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299997, "uuid": "58a44fc1-c9e3-4189-b588-bed982cd8fd0", "value": 897809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299997, "uuid": "f7ce70ce-d418-46c1-bc8d-083ad7813375", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299997, "uuid": "11bff83d-f5bc-4678-9b59-c42e38f5bc52", "value": "fakeclient-1.0.0-unlocked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988e7ba0-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273457, "uuid": "93baa720-ea30-43b6-b56e-d5c7b64979fc", "comment": "Malware payload", "value": "398b89fedee0637455715716389d8cc5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273457, "uuid": "0f9fe8f3-5e4c-4c66-9f6d-d1e3dd97bf85", "comment": "Malware payload", "value": "9e874029f528eece07670b4452cea90d6195a062ea92ac0cdbe25e643c005181", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273457, "uuid": "4f804e51-3346-4999-aff2-383c8a97c40e", "comment": "Malware payload", "value": "a0a105f20669d6ec765614d1d42265c4616bec78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273457, "uuid": "24d54786-56dd-499f-a7ce-81217bca43c3", "comment": "Malware payload", "value": "8f1fbeb7eede85f9d3ad0de43848e9555128c4dce7a74389a761eb38323b858f1ca833040b797c6beb60765d6b67591e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273457, "uuid": "ce8602fc-d9e5-491f-b066-3998a52398db", "value": "T129C42304680691EE83D23B6DB38047A0BE7A50D7F70DB20416DE7AD17DE967077E8A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273457, "uuid": "20a852cf-1902-433b-b187-0fcda70667b3", "value": "12288:sjXIfpqn5o6wlOMWROC/FTeHo22Qm7NzofOrAHml:0Ifoe4MQOC/gHozN7NzomMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273457, "uuid": "c853ca5f-57c9-463d-841b-afa888296543", "value": 578961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273457, "uuid": "8375e35f-db4f-45ca-a942-1c321b1afec8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273457, "uuid": "a1c266da-ff6f-44b2-9911-3498ae5fcde5", "value": "9e874029f528eece07670b4452cea90d6195a062ea92ac0cdbe25e643c005181.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01c9bab-c151-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791269228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269228, "uuid": "8497f364-ea44-4894-a48a-ac58f85bec61", "comment": "Malware payload (Formbook)", "value": "8db5e877eb3dc381b053b4ccebf2758a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269228, "uuid": "66d23cf5-02f5-4a1e-b3fc-6ba59503de89", "comment": "Malware payload (Formbook)", "value": "9ed1c9ac09d3025927babf2f02cbdd55f71f846d979c01175850edb1b403dbdf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269228, "uuid": "6e33fa00-1d1d-4a39-bb54-c4406d5dd150", "comment": "Malware payload (Formbook)", "value": "3417ff64a58405a96011dfaf512f8f122d8a242c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269228, "uuid": "52e57664-15d5-491d-ae4a-8f5ee6095216", "comment": "Malware payload (Formbook)", "value": "333dab1541d52bf5504d5d5b9c33c57f9a6f28d557b3ae98e3c85eab7c652b6788ed0bfe1f7fde8a538abea5412aefa4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269228, "uuid": "1fc79891-ac74-4a42-a841-01e7fcc62f05", "value": "T19C711F037707E1748CB18BA6C99FAC09D1E02D97AC0F0C157DCD89D66F3539AB5E90A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269228, "uuid": "7f1e553c-6a45-445d-afd1-11d9cb51caee", "value": "96:aw+oIcyinf9JZqjLVVol0/H6JhT/2/r1V:aw+oIcl1JZAml0/s/2//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269228, "uuid": "4234a5d8-70b6-4706-9148-b72a57a3ae82", "value": 3605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269228, "uuid": "2072d469-14b6-469c-ba61-f1b0042971ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269228, "uuid": "db0842fb-1924-4de4-bdf7-dd7e2dc1d243", "value": "BALL VALVE 1500# - ENQ-MYY-EG-SPE-00002 - Valve Materials.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e9cb63-c180-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791289500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289500, "uuid": "6ab5ab24-ecce-4957-a2bc-ecaa573adbc7", "comment": "Malware payload (Mirai)", "value": "dcbcd5c46c7a8f622aace6cbe4f3dae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289500, "uuid": "821b3e7a-5588-4f58-b712-92e350face80", "comment": "Malware payload (Mirai)", "value": "9ed36de1d3ac961f4685f45879c288f5dfa5d6db05d575ec91ad9511b09d6f25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289500, "uuid": "b88d720c-b9c6-461a-9376-d9a624e64f38", "comment": "Malware payload (Mirai)", "value": "d8104321d98c31be1d831408faeac2521358feef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289500, "uuid": "08c9d8f5-fa60-4a17-ae1e-d0e78227a60a", "comment": "Malware payload (Mirai)", "value": "790cf28cdb7ab9c1f3b571011983361a66d6032c51c56fdd5331a56a1c8964a9ab1b1746cea773e519d9027d37cf3aa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289500, "uuid": "24d829d6-80fe-48a7-8a2e-a7b0a7777b00", "value": "T1CCD45D66BC919B90C5D149BEFB6E437C72035B79E2EFB106D9045FA06BCA8950F3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289500, "uuid": "11df9170-3d09-4ff1-b642-eb62c54ca4e0", "value": "12288:qJgGaaOaS6kyuYCpobyFomfz8aGLKj6ytvLqT:h7WCKqSPwtvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791289500, "uuid": "4b2683cc-c14c-482d-96d0-1eab08444bf3", "value": 652604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791289500, "uuid": "5f09608a-abc7-4734-8de6-da957b7fe792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289500, "uuid": "8a5924d8-d6d7-495e-90b0-e1e07d5a324d", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339a3c92-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274576, "uuid": "766516b7-f002-432d-993e-2895c9d93423", "comment": "Malware payload", "value": "06f5bb4712a6e57b29f861980db4c1dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274576, "uuid": "4b860f49-c436-4223-8758-c88c5746f5f5", "comment": "Malware payload", "value": "9f1cbe5c13c357a2f2ad04317323468f126ad0c4711dbfc412e53e53fa3cb878", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274576, "uuid": "a363ba8e-3142-4fbc-b83a-dfa2d4465424", "comment": "Malware payload", "value": "dcc303eec6671fc5d606be2ba0af57807199f45b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274576, "uuid": "625ebb7a-a67d-4cf7-aea2-bc5404359153", "comment": "Malware payload", "value": "c87adf00c5976eeade3720c582f83192b288f357bf2440cc9d65e498246aa1d75487aec299e38e37df11478b0c7e1818", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274576, "uuid": "58786870-d96e-48ce-9317-7e2000e293fb", "value": "T143553387813C29844F3D0BB367FF955CA2248EFC100309675E2A9897363F79F866599B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274576, "uuid": "bb5ec3ed-d1df-4f11-aab5-47dd75f4d720", "value": "24576:GjqZmcpuaoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRq:maoZ9bq+MmMEL+hcjXHC/wnwdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274576, "uuid": "a35afb51-3a03-46ca-a5b5-a693ea81b89b", "value": 1394887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274576, "uuid": "0cbf89f7-8b02-46e4-bb43-355fcd42d332", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274576, "uuid": "cca1fb05-31f5-4bb7-89e9-6840ae6210e8", "value": "9f1cbe5c13c357a2f2ad04317323468f126ad0c4711dbfc412e53e53fa3cb878.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac48f9b-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274158, "uuid": "f6c85ae9-95bf-4ece-9a2c-46d86353a114", "comment": "Malware payload", "value": "366f1b24ea427b3f047da9174da22b6b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274158, "uuid": "add54a62-ba37-423b-aace-bbe489eafc31", "comment": "Malware payload", "value": "9f1f8550835305b2b16a54d741beb472c143e8521cd1daba468cb30c3cde2358", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274158, "uuid": "5195532f-002e-465b-a02f-09cc0741f381", "comment": "Malware payload", "value": "859928176d173ddf702baa8190bff1e41316bdb3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274158, "uuid": "03d56254-e2de-4fe4-aefb-79f12d0d1308", "comment": "Malware payload", "value": "d946a2bc11e3e87eb0eb94077aa297e5ba392443dd8506959a98e8b880f1300bbe23d92c1e0ad0177c39be577e6fe3e2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274158, "uuid": "72b44245-06ca-4a12-9150-a317facef098", "value": "T16CA423BCD4D40E2A6C9332545E642F020F10945A7BDE99DA1B2F3EE8CDFEC1426E991D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274158, "uuid": "3682237b-3ef7-4569-a649-3f78e126889e", "value": "12288:fzYfcEaN9B/Jm0LU0gM7aQjgf+FXUPu3vSw:cfclN9BhmSHRRFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274158, "uuid": "a0cc4732-58f8-4502-801d-565338e8e1f8", "value": 465586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274158, "uuid": "ef8f80f8-3ce5-4a51-97e4-a90e7a3bcbea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274158, "uuid": "f521d81f-d91a-490c-8ffc-609d64683216", "value": "9f1f8550835305b2b16a54d741beb472c143e8521cd1daba468cb30c3cde2358.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90be173-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273994, "uuid": "26460f88-7013-4d49-984d-ab4e1db59907", "comment": "Malware payload", "value": "8d1b812dc1308c35db84619f13ec368e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273994, "uuid": "7455fe1f-08ed-47bc-8b98-f5288d5b39ad", "comment": "Malware payload", "value": "9f225b42b68ee83d20c37899f02bc335096266f43b65507b046dbf04966d0719", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273994, "uuid": "a0ed45ff-83c7-43a7-bd96-415828c298c2", "comment": "Malware payload", "value": "c94acdb2e15003f976ee3dda0b1217863b5920a0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273994, "uuid": "600a77a0-bfbd-4327-8449-b96f27a4fa75", "comment": "Malware payload", "value": "2575458c44b08e4475870fab850cafb21a504c89b3fe3197e0be23023c15e8149af5628548392a64e79f683137274595", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273994, "uuid": "46131f19-b8a4-4f74-8934-1b8d8d0ced89", "value": "T115A4235C99511D32BC777AD03C2D9F020F24E943B5D99AFB891B3A904CBEC2862D52DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273994, "uuid": "ba9d6d78-9498-46b6-a1db-d425113ac3a2", "value": "6144:Ve9ZfnUXRCvHWUEDH3s/bTDY4k2k7Xa5ozFYJHd3XcEqFN9KAK4Jmn+VJFNZ+0+T:Ve9Z/U30/MzYfcEaN9B/Jm0LU0gM7aQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273994, "uuid": "a49b2516-b874-4e92-808f-9a55a9a9e752", "value": 466717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273994, "uuid": "23edcf09-57a7-4df2-bcd4-06aed3530d35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273994, "uuid": "77ea49b7-abba-4615-93e3-77bb95bcff90", "value": "9f225b42b68ee83d20c37899f02bc335096266f43b65507b046dbf04966d0719.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229f79a9-c14c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266816, "uuid": "a621d0c7-2316-436f-9bda-bcf9903d0bca", "comment": "Malware payload (Mirai)", "value": "0f9d214d2bad723be84f86306fe54731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266816, "uuid": "368b323c-2082-43c8-a32e-5e33d00c2a31", "comment": "Malware payload (Mirai)", "value": "9f27bc2b0bc6f35c1b1a282b90eb5632fdb11414865bb73a86279843aa845894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266816, "uuid": "40fa66dc-a8f1-424a-890e-6b036ccc1a27", "comment": "Malware payload (Mirai)", "value": "81560787041b581ef3b14aa6daefd3e355b3d6dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266816, "uuid": "89e16d0e-de0c-403f-8842-d846032cec9d", "comment": "Malware payload (Mirai)", "value": "22bc4f0cb7d885c9984ce9804defa0010414d18c0d846259ff6cff26b3f607d70b79f52fe2e2ae7b7fe25a485b5768dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266816, "uuid": "abdf6b49-ff2a-4845-b5f9-cb94478859ee", "value": "T154B339CDE640D977D58319B6D29787234172FA36191ACA05F3CBFCB0AA25184B221BED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266816, "uuid": "c9085d10-5260-478a-8cfe-ba7b8f798b36", "value": "3072:YHCtzPUmSKzUtiFidYe3KpXXeTZksFDaSo4XRZhSvn:NwKzUti45K1eFkQDaSo4XRZhSvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266816, "uuid": "69901137-fa04-4c36-abe6-eb4c9508d6c7", "value": 112292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266816, "uuid": "7da774ea-57fd-4563-ad3b-e94a20886fe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266816, "uuid": "7bc42786-6bc3-4868-a7ca-2be7d8b660d6", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02f186f-c1a5-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791305360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305360, "uuid": "fb17f89c-0e30-4b93-8228-ce48a41be3d4", "comment": "Malware payload (Mirai)", "value": "df52c4bad4e1418424b7c1492402a8e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305360, "uuid": "ec1ee5fa-28df-41db-a0b2-198e8fbc34bd", "comment": "Malware payload (Mirai)", "value": "9f2ccb39fd57752cdcee1b20489d08fcfd78167ebf43eda09e14eb17f32d81d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305360, "uuid": "78e2b2f5-06c8-49b6-b964-d06573bb0e94", "comment": "Malware payload (Mirai)", "value": "b35835f721275ffeb372e6cf3576fa4bfca4da2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305360, "uuid": "3c399a78-20e8-473b-83d6-757935bfcbf8", "comment": "Malware payload (Mirai)", "value": "3d4b22cc770c57d7ab1d967747db4b1d376f9cbaebb86fa43bed2a27492fbd5506a46d10f5d3e1a7bd209822ac151fa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305360, "uuid": "b2592d27-f348-4b93-8b4b-30acf2f2114c", "value": "T1E6630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305360, "uuid": "88ee2a3c-16a4-4eb0-bcc7-7a102b065287", "value": "1536:pOTAiIYaMBktkIwn8U0yaPSmuSt8M8fhWtu5v36L:pOTAiLaMH+uSerpeu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791305360, "uuid": "c93246f4-d47e-4221-9073-de37fe8d1b4b", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791305360, "uuid": "5fb757c6-84f9-4780-a7a3-7bb09a9c6191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305360, "uuid": "1422a4fd-d213-4234-8077-62e38c5b2bfe", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cf8a7f-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290422, "uuid": "7d77c26f-ac88-4c9b-ad4f-694ae38f26fa", "comment": "Malware payload (Mirai)", "value": "a17bfffd64b1aca0737190625764592c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290422, "uuid": "6688c32f-2d18-486c-8155-4cdf2d0a496f", "comment": "Malware payload (Mirai)", "value": "9f4dcd6f19ff3080229ac21fb70763d4267b0135f646680e3b44b2c383322afa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290422, "uuid": "2adb4450-d30e-483e-ae74-42911a26e4f4", "comment": "Malware payload (Mirai)", "value": "3ed34cc316bf0f4957336da392580500a004da9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290422, "uuid": "d7c93ca4-60a7-407f-a822-8c2fa6a8a1d6", "comment": "Malware payload (Mirai)", "value": "ea671a1f6b10777feb0c8981f14f18fba4e68774068d2a8cb7edab510c864d8088d8030edd6d52d5b1013e14ca7309a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290422, "uuid": "ae26928b-963a-46d5-a99f-88ebba748835", "value": "T137B49E03A6B7E8B1D4A142B1215557B99872D8B31577D88FEFE52CD0DE60280E32C3EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290422, "uuid": "6582db56-1841-4e41-ad58-16b478becd7f", "value": "6144:vn6yB8aEyKLx9+tct6COol6guBIxU8fAnSCQjMkOw8eoWFZnuUkO3Qm9owpIo:TB8Z/ccF9dAtA8eoWFZnuzO3QmXIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290422, "uuid": "03030f1d-67cd-429a-be26-15b90fa1ef78", "value": 536108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290422, "uuid": "6fea33b2-892e-48b8-903d-4f91d5c1a71c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290422, "uuid": "fd251297-f206-4c39-810d-f5fb7e1485cf", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b046984a-c144-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791263618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263618, "uuid": "bd73dec9-f6a0-4e41-951b-edb1873b88da", "comment": "Malware payload (ConnectWise)", "value": "afdd9d7685e2394ef444e693964f4095", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263618, "uuid": "122ff066-b418-43bf-a436-3e8a212a448e", "comment": "Malware payload (ConnectWise)", "value": "9f5f8f8511aef45edbad68759852dde0c88cec07d2bcb0ac537121bc360ce367", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263618, "uuid": "d5468dae-c6b6-4c46-ac83-fdb78415fe4c", "comment": "Malware payload (ConnectWise)", "value": "ad3af134b34641f9abcaee4430b7458e938be573", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263618, "uuid": "1d6841bc-8e9f-4548-b888-eee0d8c4c23e", "comment": "Malware payload (ConnectWise)", "value": "12d499d1be18ee79bdc46d259c89701db0be2feeb0086a48b2b16ed836f09384346b7902fe55c727aa193423742d315b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263618, "uuid": "4753ccfe-a75d-4722-9a63-05ae374dd749", "value": "T1F146E111B3D695B6D1BF0678D87A52A96734BC049312CBBF5394B93D2E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263618, "uuid": "9c2b3907-2507-483a-ae25-84021f1926b9", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263618, "uuid": "76ebb98f-d59a-4e34-92f3-773e27ed2112", "value": "98304:DzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:DhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263618, "uuid": "e6bf6037-84d1-4f9f-9074-0bb574e09204", "value": 5768304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263618, "uuid": "be1e8d63-8ddb-423f-8b61-a336f1f6f949", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263618, "uuid": "ebdbb4dd-132e-4d6e-a67e-3c7de28a8012", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9878f8-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274431, "uuid": "7dc7dd2e-53e8-4f92-b573-9b5e1366cffa", "comment": "Malware payload", "value": "43a4e0416874421bbe99a94270fea541", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274431, "uuid": "b370f65f-5c81-4716-9592-343dfdab6b43", "comment": "Malware payload", "value": "9f7b47799d66ca978c1966dc4bd23a2383110f6a8c7b0d3407ea35cc9b8e892b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274431, "uuid": "9cccfe5b-d193-4cac-a177-6ccea042d567", "comment": "Malware payload", "value": "8f9bc3d45c8246736016705e776494ee01be6a8a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274431, "uuid": "ec1fd989-eed0-4202-b872-c45f94970c29", "comment": "Malware payload", "value": "b894007fa40dc7aac5cd96556c73f0f7a5c2e760c24361fa694e5c25cfdd3a591d86a909648bf9a1fc06e64b14121b5e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274431, "uuid": "eec9bdbb-3bbd-4326-bc25-09f0ceac20e8", "value": "T110A4238274716D06C096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274431, "uuid": "1409f810-a472-4bde-b1f0-5dc296bab167", "value": "12288:Er06tUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZV:Er06tUv4t1cNk/wjibhv4b2Onz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274431, "uuid": "a7753d49-1e3e-44f2-ade5-ccc49d5c071b", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274431, "uuid": "5dbf0a55-e417-48a5-86d5-094bd3c4511a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274431, "uuid": "7ecd0645-e3ee-4e95-a0f4-ba6ba160007e", "value": "9f7b47799d66ca978c1966dc4bd23a2383110f6a8c7b0d3407ea35cc9b8e892b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6848e407-c14a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266074, "uuid": "3325f2e0-2d7d-4c43-8a02-4542b4c728cc", "comment": "Malware payload (Mirai)", "value": "6ee71c745ad504433637a0e2099cc669", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266074, "uuid": "5f14f474-0547-43a0-8d2d-91ad256f43b1", "comment": "Malware payload (Mirai)", "value": "9f90535512addd3f5540ff95799fe588ac6c13f133cb010b59144f9884e4c904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266074, "uuid": "41e390a0-d88c-4147-aea8-72e8ecaf9645", "comment": "Malware payload (Mirai)", "value": "ec2c726ef24d2210ce0c22f978f3b01001edc064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266074, "uuid": "6efbea8c-17ad-477d-aaab-7ea5701c3dc0", "comment": "Malware payload (Mirai)", "value": "57afee959aba888f6cd99054015d0105521f6810c80f8d943b098ae961a920c535e4c6ccffb98ba8b8241c3894d65c0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266074, "uuid": "24131a24-60ce-43a4-83eb-5a828c63d2d0", "value": "T1610463BEFA11BB6EE168873187F25F72C39521B22291D341E2EED6185E7528C085F7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266074, "uuid": "ad291756-39ee-4188-af8e-99eb8ee7f500", "value": "3072:gIZrG2Zf/xL4ytxzLiBKUH4eWluPDbpSIeZ8tjTl5:LZa6rGj13PDbpSIeZ8tjTl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266074, "uuid": "10b6697a-1baf-4b51-a37c-fc7104135103", "value": 181799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266074, "uuid": "1fd23ed2-d646-44b1-9cdf-8b5e736aeffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266074, "uuid": "13b2b86b-130d-4713-b0f7-cd4f0e8cc7e1", "value": "gnome", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d44367-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275787, "uuid": "5d5fc726-5530-49b3-a631-ea4e4050c88b", "comment": "Malware payload", "value": "d353dec06cd9c856ea229388e97001b4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275787, "uuid": "fb0a574d-e508-49be-a320-baead6be17dc", "comment": "Malware payload", "value": "9fae4c6a0d202310188cb827ce097507b6b8dc6d154a809fd26466a2ed4e1a53", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275787, "uuid": "cf513c08-449b-4b28-bf37-c934a4233912", "comment": "Malware payload", "value": "19cb55d268169b030f9ddde8f85a3f5c059b54eb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275787, "uuid": "3feb4980-0a0a-4e85-b8e5-4304637b9598", "comment": "Malware payload", "value": "e30d3df88e9a085e43601615fd4da95fc9ade23842c017f785bc20aca77a5a143ac2ca15e42abc87b5d822f7459021b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275787, "uuid": "81a67c72-ef1b-4503-b245-4d929d64f3a1", "value": "T134C42304281691EE83D23B6DB34047A0BE7A50D7F70DB2041ADE7AD17DE963077E8A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275787, "uuid": "6fdfd73b-b2e2-470c-bc01-6bd9735f199f", "value": "12288:2jXIfpqn5V6wlOMWROC/FTeHo22Qm7NzofOrAHmy:aIfoL4MQOC/gHozN7NzomMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275787, "uuid": "ef25c31f-08d0-4ad8-a1ff-bbb18b6f0880", "value": 578961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275787, "uuid": "884ea637-54e8-4a03-b3cd-9ae280e6aae4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275787, "uuid": "affa3ccc-585e-4a2e-a125-859982059aad", "value": "9fae4c6a0d202310188cb827ce097507b6b8dc6d154a809fd26466a2ed4e1a53.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4844a1-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271099, "uuid": "f59ede72-831c-4d99-bb3b-b85df588e786", "comment": "Malware payload", "value": "0c5af9aec7b91a5653f4985682d56ad5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271099, "uuid": "ebf32950-4cac-492f-8d9c-25d93f542e10", "comment": "Malware payload", "value": "a09d1d7f65d58b656669729196cc7f56196933cec5659b509927e836d726c725", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271099, "uuid": "4e5680ba-540a-457b-917b-d0ccfac0d4ca", "comment": "Malware payload", "value": "f6d4796dd269ac6fcd7f50f718b688c1878771ae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271099, "uuid": "49781ae4-414b-4bef-bea9-0268963bac47", "comment": "Malware payload", "value": "efdd9981f2a8d834c3bcc9a460b01c81f88e6b33753790d04e3de211490243ced1afac216d9e2e795572b1b9c31ecbb6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271099, "uuid": "40a0c7c1-a509-44c9-b0a3-d53cc8933d0a", "value": "T1AAB423CD64BED0A87B658DDA9FDCBFD30CFC403A6D7526F2A51C1A13A1C400B64A958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271099, "uuid": "9c037d85-cd16-4e1a-aa30-c3efd6a9317c", "value": "12288:iB/e4pqNFTFbEXkRDoGbDDGIabs/7iiEVwYg2l3/2NyC:iBm4pgTLoGTabs/7iiWw0DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271099, "uuid": "06927273-4dd3-476e-b78c-2dfca8378648", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271099, "uuid": "47c24566-fe2b-4d5a-9401-c15ff01985e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271099, "uuid": "e812d124-351f-4ea4-83f8-69684f98db3d", "value": "a09d1d7f65d58b656669729196cc7f56196933cec5659b509927e836d726c725.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f39574-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273310, "uuid": "b68a9599-f8b0-403f-b08c-8e4c600a1127", "comment": "Malware payload", "value": "654e3c979d0f36a5b288da3fa2540057", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273310, "uuid": "0b206c8a-52f4-4577-8945-a2178d4e71f1", "comment": "Malware payload", "value": "a0b5758aa94a76c29ec69a61f554905fbd3cc1855eb908f431c4f45432bb966a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273310, "uuid": "47b8d8ef-778f-4441-87a4-8943001ea09c", "comment": "Malware payload", "value": "0c5f98a20cc8c6d4efb31f0093dbfe250b7032ae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273310, "uuid": "3b04102d-03d7-4807-acba-f77090dc9b85", "comment": "Malware payload", "value": "e42119fee9d18152965e435c2c0926a5d85cf7f2e140c98c2597d75185a5a8f19c052c75f7849293e8b8f61db649ecdb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273310, "uuid": "73a16d8f-3bf8-40f1-9017-a5000449fd07", "value": "T137A423BCD4E40E292C9332545E642F020F10945A7BDE99D91B2F3EE8CDFEC1426E991D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273310, "uuid": "8be879c3-3cb1-4a3e-8038-1f7323b2dd5a", "value": "12288:MzYfcEaN9B/Jm0LU0gM7aQGgf+FXUPu3vS0:jfclN9BhmSHURF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273310, "uuid": "0bc1a4bd-314c-43e0-b8ec-b7ac2b0c015a", "value": 465586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273310, "uuid": "92ae08a1-f435-488e-9afb-7992cb14277f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273310, "uuid": "8af09bb8-eb74-4442-b908-8763a58324c8", "value": "a0b5758aa94a76c29ec69a61f554905fbd3cc1855eb908f431c4f45432bb966a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965315a5-c141-11f1-927a-4201ac107004", "comment": "Malware payload (ValleyRAT)", "timestamp": 1791262286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262286, "uuid": "dac5b332-2e74-4ea7-9c3b-3c3be044161a", "comment": "Malware payload (ValleyRAT)", "value": "935ce08748c7a78cbf64a8d0e5341061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262286, "uuid": "2af55dee-2cb7-4513-8dac-eebe6de919a9", "comment": "Malware payload (ValleyRAT)", "value": "a0cede6f584d24707449eb5fd9a35ea0d380e9bcaa6c37c99a65bc90a3dbb9ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262286, "uuid": "b9f041f1-1a43-4f71-814d-f1fbadc810c9", "comment": "Malware payload (ValleyRAT)", "value": "6828e3c3e1e0681e128034abf876164fd3e4df3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262286, "uuid": "153bc91f-a599-42a2-aca5-8f8ed244a615", "comment": "Malware payload (ValleyRAT)", "value": "415294f98d4b257e3c271b2a631ecbfee7d93bfefe0c31f6d586bc5acbdcc050cc6b4eeb1660fcd9d7cb3847ba377d02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262286, "uuid": "7c8f4ea1-4a32-4b05-acbe-173d416ff805", "value": "T1AA972C02B6468CC6F54852F45897FAA423FDFCB48AD5C31732E4671EAF9E28C0E83595", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262286, "uuid": "0376dbc5-34ea-4092-b76d-137f8f54e765", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262286, "uuid": "23ad982c-fcd8-4273-8c86-bedb18b14f7d", "value": "49152:1F335nW2J++1hhWugAx8z/TdqRD4a85Ejr9CbHd5nYeWgR9:T5L3XLgAm9EHUv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262286, "uuid": "2360bc1c-191d-4a5e-b1fc-a6573212f2e7", "value": 40686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262286, "uuid": "5686c454-4702-451d-85e6-cb458f37e5d5", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262286, "uuid": "921fbe7b-7bfd-49f5-92d3-59d11954ce25", "value": "instdoload.1.3.02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb4c6cd-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791273308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273308, "uuid": "c9b6ea23-e3f9-4752-9af9-578127d3551c", "comment": "Malware payload (XWorm)", "value": "48883ea2d2b5717e34f24fd6d706fdeb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273308, "uuid": "8386a8b6-ad0d-4c1f-8044-63d6771d0b8b", "comment": "Malware payload (XWorm)", "value": "a11ba1507dda81b8c0c704100b6ef21b7ccbaa437406fe11c66bd2457dc9ee37", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273308, "uuid": "1f82d458-4652-4805-9568-a13917e6bb3f", "comment": "Malware payload (XWorm)", "value": "6cea1b5245118c7fa8dcb0af32004fbb5bc879fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273308, "uuid": "e6dfa726-f449-43d2-84af-f001a00728c2", "comment": "Malware payload (XWorm)", "value": "650cfbeb45cbd07951da340fd693b526931304813dbc08a21e991209219de24df2d061d5f3a48fbb394953881767a917", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273308, "uuid": "2bd726c9-3c96-4e35-943f-4e0aad08c225", "value": "T1B5F030B292F5531C317B6F98A93331192673BF86ED79868C0768181C14E2D84C8A3B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273308, "uuid": "51081da1-b4ad-4e40-849d-fa1384357171", "value": "12:QqQTpQbix8wRlbJE8QFQpQPqYpRiRdPkKgiRW:QqQT8anE83k988Kgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273308, "uuid": "2ddd04b0-76a1-448d-9868-b2d0d70f28ef", "value": 460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273308, "uuid": "2ac0ee31-c19a-46fe-abfb-800c92e2a8d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273308, "uuid": "eaeb9af3-53bb-4cfe-a493-da1ecf459bc6", "value": "FABR PURCHASE ORDER 72625181191110.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1c6d6f-c12d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791253514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253514, "uuid": "0979ca6b-d418-4554-9ca3-5fdd519be59d", "comment": "Malware payload", "value": "0a93a6a35f294cab7dd13a0b8a9e0cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253514, "uuid": "8e2ad997-1870-4c98-a0d5-b9ae93669ca4", "comment": "Malware payload", "value": "a18a40caaedeb504fc7cbc3eedfb25d30493b74e196fc49963599fb0ece7ff25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253514, "uuid": "928156fa-68a7-4857-b317-d496777e4ccc", "comment": "Malware payload", "value": "7568df3124a00fccb06e94255aa567d303c5ddc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253514, "uuid": "b089fe9a-a774-4f3b-8862-c76e8d0b38b4", "comment": "Malware payload", "value": "ff123bfa8f2e33312f85d42c9fa58f137b9c682dbde4568ba38c5deb81a0aac58be0375eec54fd5df308c459189b6f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253514, "uuid": "5177d63a-c0fc-4447-9697-a0024b9fc84e", "value": "T15FA3D0187658817BDCBF5FFC9C7232005372E99AE639C68E2D88D98D285774059A0FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253514, "uuid": "45530e0d-e415-4635-9deb-b32ce31a27f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253514, "uuid": "ffd61396-ad89-41e0-9f14-9735aa988a28", "value": "3072:C23EvugyrIODdaH1igdDuN5Sr5Tk9gx9TyfWZ65:b3EGnrIeiZ20r5bx92fWZ65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791253514, "uuid": "4d88a2fe-6490-439e-9d36-ca874525391f", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791253514, "uuid": "a71fdaba-ec95-40f1-a7fb-f8ac65f34cc8", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253514, "uuid": "9a3d8399-eba8-4b77-b76a-f6105733d204", "value": "a18a40caaedeb504.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfed12de-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274382, "uuid": "fc8842cc-40c3-411e-af5f-53f93b0b3a99", "comment": "Malware payload", "value": "0f0056fb7231874ec02ef9848e3e685b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274382, "uuid": "e3f305e9-0d2a-4f57-9044-528182b2eda3", "comment": "Malware payload", "value": "a28a122ea9a57d7ab3783ccdab5ac910f529829e0c0c185ddeeeaa0cbf4848c8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274382, "uuid": "b45d35ff-2e96-4840-a760-d0f7e9397257", "comment": "Malware payload", "value": "c05eedfaa7865c0488db01dc5eef670b47b04565", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274382, "uuid": "6d9220d9-45ab-42d0-a54c-5b150d882aa8", "comment": "Malware payload", "value": "77f177a01a56a0cea3094eed0510d6325042354fd2f9f2482dc581f82ba787acec0b674a92b6a4751aeda3b81b3ae897", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274382, "uuid": "08a238d8-fc93-4c30-8539-c8770d636df8", "value": "T1D2C4331604CD4AE1C0D382FA176746F5049A4E38EF929A7EC43C34C9E340D79FB296AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274382, "uuid": "f43ddef9-3c6c-48de-8fad-bed369a9afff", "value": "12288:z56zQTBL8mLpBmA4C+9NgOZTUqnMmzDF+nuwsQab/YpUiyCs6ZHfipRwSb1eBt:oMTBL8Sp78NQqMm3FSuvdiyCJiMSb1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274382, "uuid": "9b20ca08-a18e-4ae8-9508-8d4cd074d4d1", "value": 579945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274382, "uuid": "64780b48-99f5-4b6c-8d05-033dbc73288e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274382, "uuid": "20371ff2-22e5-4814-b5fd-3d436aa2e6a3", "value": "a28a122ea9a57d7ab3783ccdab5ac910f529829e0c0c185ddeeeaa0cbf4848c8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb170e7-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273789, "uuid": "2310ced6-bf70-4de1-b8b8-e139fd012825", "comment": "Malware payload", "value": "95811dd8d3beafe4ae31fff59b6de321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273789, "uuid": "4ffc6482-6380-4f6f-a548-030cc82645ca", "comment": "Malware payload", "value": "a2b0ec97eeaa97e6d2f08f978a16738464d321101a5a13ef113f86dffa8d3314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273789, "uuid": "443cce9e-76dd-4628-8908-d83292ea382f", "comment": "Malware payload", "value": "96b75f1d4cc00d72cae02db3e22c40987dcf3131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273789, "uuid": "a330ac19-2d78-49a8-bea1-836fb6a3ac4d", "comment": "Malware payload", "value": "007bc2a24b65cc8326c7c21f95cfbb55c9d2a3475cb003318de88147bc4d5241eea81da7d1dde88a0edda4eb56903f20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273789, "uuid": "21571633-d692-464c-8c95-3fc496814a38", "value": "T109874C0667970DE5DCC23BB4A99F233CB730FD31AE691E6BA54C81345C532D8AD1AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273789, "uuid": "f86399a9-fa44-4321-bce2-207107643857", "value": "0afb9158369f85d9d0b84abd375f80be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273789, "uuid": "4f45ba1c-9b29-4fb5-8cca-2481631f7a88", "value": "393216:YhsAS6B5REZpz7K9cUNEYOyHiaQKZpTt/Y:Yhs5+PCUxp7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273789, "uuid": "1e079df8-32a3-430c-a6ee-7b5bdf37a9d9", "value": 36042497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273789, "uuid": "b473bb90-ed10-44f4-a4ee-427483019cbd", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273789, "uuid": "8224df0d-6bf0-4db6-8664-02797a415a1b", "value": "a2b0ec97eeaa97e6d2f08f978a16738464d321101a5a13ef113f86dffa8d3314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444ffea6-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271168, "uuid": "ad9ac604-25be-42a0-907b-ca37692dc8f5", "comment": "Malware payload", "value": "c89b0a70beaeddead70648e35976e7f5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271168, "uuid": "e429864b-f6d5-4484-ab5a-d434e87609d9", "comment": "Malware payload", "value": "a35dff6468fc0182419e7311607288d046bfeb7bf5e56eae46d6343089a4434f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271168, "uuid": "afc54b3e-47bb-4b47-9c32-08fb33b477bf", "comment": "Malware payload", "value": "003d4e5af9e6a69e54900a63e3c1ea55235a0995", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271168, "uuid": "98e1781f-706f-4cd3-b57f-70beeff05f34", "comment": "Malware payload", "value": "c8265062df137a5a4dd808d356092aac6de7d134a46add4192f19d364718695c4d5edc578c291d24d606a260cef69ed9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271168, "uuid": "d7e91362-c0b9-402f-af99-4447031a7fad", "value": "T1E1553387C17C18C84F3E06D7AFAF995C72288EFC100204766A6618AB253E75F87795DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271168, "uuid": "995d0211-0599-4c2d-8839-32484f20c61f", "value": "24576:fMZuoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRL:fMZuoZ9bq+MmMEL+hcjXHC/wnwdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271168, "uuid": "bae0c0d0-53eb-4ac0-92a5-33169b804e3d", "value": 1394468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271168, "uuid": "c58a081e-d2f5-432a-b4fb-61a1ce33b4d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271168, "uuid": "3836b0a6-1407-48b7-b58b-0495c0127bef", "value": "a35dff6468fc0182419e7311607288d046bfeb7bf5e56eae46d6343089a4434f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d52c5f6-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276256, "uuid": "e55e8de3-c7a2-4840-9914-878be71d97ff", "comment": "Malware payload", "value": "96fbb5400cd61783baad26f799289f4b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276256, "uuid": "b08bd21c-9fb4-4ad5-b21c-1abbb4d11edd", "comment": "Malware payload", "value": "a41762eccbd5b6a7b551ced9bc83910ffef697c38e8884772b48c0cc4f4883d9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276256, "uuid": "7bea8bbc-1fb2-4305-80d2-176895827cb3", "comment": "Malware payload", "value": "744e91dc71d9bb9152709f8f8107fb1e9abc54cc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276256, "uuid": "037e87f9-b594-4d71-bfad-3dc9036a1af4", "comment": "Malware payload", "value": "110ee68cfff8d288353e38bc769091952b071837753aa20156628f45a3b8bb4744e979d996b193aa3cf48f5e1f355252", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276256, "uuid": "aa1ba376-ab79-46ef-bc9b-794cea2908b0", "value": "T16EA4239CA4E00A329E9373545D1C2F124764D61B33F9DB6BD61F3AC0CEBAC501AB42AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276256, "uuid": "f20b9be6-be53-40b8-8060-9a6036b89a0c", "value": "12288:TBM1eMQPiolzYfcEaN9B/Jm0LU0gM7aQD:Ty1eMQao6fclN9BhmSHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276256, "uuid": "48d4e28e-545f-4e0e-960e-205fff8bc516", "value": 467268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276256, "uuid": "9e7f941c-eba0-4925-9d4f-2ca919eb6a75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276256, "uuid": "fee92ab2-f7a5-49ac-b327-989664aa3c4a", "value": "a41762eccbd5b6a7b551ced9bc83910ffef697c38e8884772b48c0cc4f4883d9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f9a5c8-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290768, "uuid": "fe01f74d-ef73-4a54-af48-f06e60b16dee", "comment": "Malware payload (Mirai)", "value": "9b39e5ecb9cb55de624c32335fc73a53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290768, "uuid": "38ff32f0-2a2f-449b-a314-5ee09756fbe0", "comment": "Malware payload (Mirai)", "value": "a4c3e17b204ddeca1e2297219f85b0811aefa94259957c0b92a61d2f83411030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290768, "uuid": "23338fcb-e4bd-4d29-bba8-ac312c4d48d1", "comment": "Malware payload (Mirai)", "value": "95b580a05417f61893ea018fb2be514be066510e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290768, "uuid": "3b823a06-aae0-4531-8252-72ddec25dd9a", "comment": "Malware payload (Mirai)", "value": "57a00127f72c74ee37637efe28f9d297aa21c489fb104ce95b09af76aeef2839c2249c0584bbbec4a18cc1bf04f65e1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290768, "uuid": "2a4e9dd4-00f5-4923-80f4-70b0ee93f156", "value": "T10AC419B6FD41D991C0D42ABEFA5EC2C833430779C3EA70029D16C72569DF69A0E3DA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290768, "uuid": "c4764278-9759-4d5b-9c4d-8397f4319ea5", "value": "12288:suXLV+d7NCsqfrM4zyEWNMNgrinPwWCn6B6ujw7YuJoNS:+bXGGgMujIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290768, "uuid": "5bc2cfe6-ee90-4a87-ad02-4712e9d05841", "value": 583124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290768, "uuid": "5a39879f-8a5d-4c6b-bf7e-c3c1d856cd3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290768, "uuid": "5adb0f7f-d01c-40ec-9c10-b6dd464a6677", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cc1aac-c150-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791268882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268882, "uuid": "28b55172-0555-4c6f-81c6-3b47aaf95a09", "comment": "Malware payload", "value": "26c6d26d1544c2d99beefbb0a69dcc3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268882, "uuid": "4ec5f8d2-c64f-44f3-9355-424ce3dcb572", "comment": "Malware payload", "value": "a4f5bec5e206631a718b88e16f1a5fa3ebd0ad55955fd30001c29e42b601beeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268882, "uuid": "d74eac77-cd47-42fb-a9c3-45d21472df7a", "comment": "Malware payload", "value": "df2c0a26d0a96cfce2cc192d6b9f736278a3afaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268882, "uuid": "a9c2355e-d7ef-4613-bb77-6a562f8c6e17", "comment": "Malware payload", "value": "8156b874b022ba625dcd1845c07fbae735bf9b3c28845c170ec94c6be39fb624c1c164ca0e4594b74c2f1e4b4d509efd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268882, "uuid": "ed914613-05ff-49d5-bb86-defd8f48ef42", "value": "T1E9664A17EC6518E8C1AED1708AA69653BF31BC894B3063D31B50F2247F73BD0AAB9754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268882, "uuid": "3882e960-db9f-4adf-af53-caf851d25752", "value": "49152:fyErHmJc5hY94/3MyTMtzVx/eum9VDyVoF51sim6f6LZFMwIKHK5K2azyvaoMQTb:aiqcd3IVKDFuI6LMSZoMQgE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791268882, "uuid": "31f0ad4d-48ad-454b-a644-bda9fdfd3cb5", "value": 6770848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791268882, "uuid": "03623ddf-b2f1-4d73-8d4f-cdc7ca66103c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268882, "uuid": "d8e391f1-c75b-40d7-ad83-570b8117f875", "value": "agent_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1ea9bb-c11d-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246643, "uuid": "3c2b07b3-8b48-4aa3-901e-076c4f7c9bcb", "comment": "Malware payload (Mirai)", "value": "30db4b1ab612d8f629dc9da0370c8c05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246643, "uuid": "917cd116-8650-422b-8e4a-c3e0fbd34ff2", "comment": "Malware payload (Mirai)", "value": "a546933fecfdd82ff77247ac8000ac1ef54deb82a5e78fa3bca93790405a23fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246643, "uuid": "afe51a05-d8ae-45fc-a759-1f1ab46eb082", "comment": "Malware payload (Mirai)", "value": "4e4adb40f5b03a382b83c4e3381d956fc58d86f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246643, "uuid": "7c06a0e9-21e2-45bd-9d0e-ac5424129243", "comment": "Malware payload (Mirai)", "value": "0125a696920ede73be4ef0c53dab11e30b892727c6f9ee5f39cf1e487dc8aa0a42eeff699da4d5adba54371aae4c19ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246643, "uuid": "914269fc-1276-4fd0-9890-db3622311b72", "value": "T147D46C16BD919B91C6E24ABBFB9E4368721757BDD2FF7006CA045F903BDA4810E3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246643, "uuid": "b480c6ec-1f57-42cd-8f3b-e25c07ac14ab", "value": "12288:TGCLqHgGSG0QwnVuslwVaEJvvKemu1zN4UYDAYw3ivggbSe:TIHg+EVuslwVaEJvvu5Ubg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246643, "uuid": "314ae960-2e3a-4ea7-89c8-f80cc6cb8dda", "value": 625992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246643, "uuid": "7fa8ffab-cde0-4848-ba77-677808b1f68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246643, "uuid": "572fc30b-0219-4194-91ea-097a6478a7e4", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2ec032-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274238, "uuid": "2e348950-8210-4c6b-a3d8-03e1f2b15dfd", "comment": "Malware payload", "value": "dfff831794096cff134b8605ddb56b94", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274238, "uuid": "54f7bfd8-23b6-429e-adce-92790d1b2411", "comment": "Malware payload", "value": "a55a153e33610f6b87e358aca650bed11a4ac23bee6efbb60cb68372d95e1f99", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274238, "uuid": "d49ed57a-9d65-403b-823b-c928eecba8e5", "comment": "Malware payload", "value": "d75038b976f409d15e1cc47c2907429e6aecb77a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274238, "uuid": "44cbe3ba-73b4-4e60-af04-497a103cac09", "comment": "Malware payload", "value": "403e5e21ab1dce1f6abd151ee1a06ab34e938515e83234e97bbb4b5cfbbb9bc7760a4e55958162e6cd9762d4b25a6f4c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274238, "uuid": "e121fe50-29dc-4e82-a852-2da26acd8668", "value": "T1E2553397813C24845F3E0B66A7FF856CB2248EFC10030C579B2A49B7293E69FC675997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274238, "uuid": "219e7875-7d60-4855-94f5-ea1de818d58d", "value": "24576:foZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRPbA+KCmzWY:foZ9bq+MmMEL+hcjXHC/wnwdPbA9Cmzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274238, "uuid": "2e3a3892-a2a1-4122-adc5-b27f28494a4d", "value": 1395268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274238, "uuid": "0bc2fd7f-f09c-4acd-9e04-6572f23fa17d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274238, "uuid": "2cf1c1e8-931f-4f8d-b311-d6e770b09c7c", "value": "a55a153e33610f6b87e358aca650bed11a4ac23bee6efbb60cb68372d95e1f99.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93acd0f4-c198-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299648, "uuid": "08cf7107-783f-46a0-aa1a-d1899b0ff02e", "comment": "Malware payload", "value": "72a335f2c7abad027eeddbd22cdec2ae", "object_relation": "md5", "Tag": [ { "name": "HeavenStealer", "colour": "#DA1B82", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299648, "uuid": "445d9c3f-38a6-4238-9658-31235b38810e", "comment": "Malware payload", "value": "a5fcf8b3fe0462d3380227e7a063a5ea2a3b4352a270775611c467871c5623fe", "object_relation": "sha256", "Tag": [ { "name": "HeavenStealer", "colour": "#DA1B82", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299648, "uuid": "82adc7a1-33fd-4b47-bb7d-ca58b2dd681c", "comment": "Malware payload", "value": "94e02baebfed6600bc0cca320fb4bcc8ae0816ae", "object_relation": "sha1", "Tag": [ { "name": "HeavenStealer", "colour": "#DA1B82", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299648, "uuid": "a8503d86-d086-4692-b4fd-d75e9c94beaa", "comment": "Malware payload", "value": "30916980ef47ee111697fa9dcc7622d8e0f805e03fe00f49aa1cefc1557ce53dd379249f4639e34072a143ed6a3a7de1", "object_relation": "sha3-384", "Tag": [ { "name": "HeavenStealer", "colour": "#DA1B82", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299648, "uuid": "e2204a26-944c-4537-9b73-b37230b7c7e6", "value": "T1C0F6F116FECAC57CD9A38C76B1828253A81D159EE80BD07F07F099C50A31E864796FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299648, "uuid": "d984efe3-2a1b-4326-a47f-ba8522634017", "value": "393216:h4mEfs6XApsFJLLopliwIjiFmTbpCHtPnkEv3CXiZ8o/PaZ9mQjoJMgZB13jLMZ7:h4mEfsxpsFJLLopliwIjumbkHPGiiSPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299648, "uuid": "b7933f1b-45a9-4952-833c-86347e234846", "value": 15510539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299648, "uuid": "8ad20cff-ba2d-4b7a-8831-c3de13251c23", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299648, "uuid": "c7b15c84-16d3-4865-938b-d50c3512a480", "value": "app.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c878e4-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274819, "uuid": "4c7e6456-820c-4c74-abee-8b2959228f9a", "comment": "Malware payload", "value": "7990dbbcf4f6476d1368f726827884f9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274819, "uuid": "c02d7133-74c0-47a8-891c-a0c39fc5e361", "comment": "Malware payload", "value": "a61ecad6785922578b91d4acdd8b88a4beb83acfc951c334e52b6173a7570cba", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274819, "uuid": "543e75d5-dd26-49f5-9b95-e1787cc0b813", "comment": "Malware payload", "value": "bf434fa69f10c9e04d51b0111d571cade75bc6a8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274819, "uuid": "201750c1-1c5a-4c3f-8832-64303e80ad18", "comment": "Malware payload", "value": "2ed82e63cf63fe6027beb3d2eeae083862d247536d19d78dc5712efca343d9f6a657079a4be01710ce204e8dbefe423b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274819, "uuid": "6d9ab093-6b2f-43cf-a611-1a4c047c5aad", "value": "T1A1C4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274819, "uuid": "e5e029b5-541e-45db-99d7-7393ae1f95e0", "value": "12288:9MU+0xq75aS9iYIp6cP/G2Bku8NtNvC28c5/VTUPkYyy:J+J71vI/GjYc5/pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274819, "uuid": "c0c82ec4-f8db-489e-965a-45eec1cd026b", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274819, "uuid": "74be7bb0-497c-4e9b-88b6-7d4a42be5123", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274819, "uuid": "4528764f-5a76-4f40-85c4-7625af94247a", "value": "a61ecad6785922578b91d4acdd8b88a4beb83acfc951c334e52b6173a7570cba.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8782cd40-c17f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288890, "uuid": "52f1707e-1d0d-40f3-ba33-a044fd432036", "comment": "Malware payload (Mirai)", "value": "97f18a8bd339073bddbc4f0c6c6774a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288890, "uuid": "ac05d0be-72ed-41be-b720-7961de1bcae7", "comment": "Malware payload (Mirai)", "value": "a6f47b9728c0bf44140e9f561ae885740f8fcc7afecef9f072b1900180fad2a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288890, "uuid": "1e453ab9-ce3e-4417-b655-0d1426f3dae6", "comment": "Malware payload (Mirai)", "value": "a0c75f49debfd843b9d2884a7df75ca92711a38d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288890, "uuid": "8c4d4032-5221-4acb-9ff1-3186231f764e", "comment": "Malware payload (Mirai)", "value": "7c7d474297da1bb33b0d9e57f1f29f5bafe336f9f3879313951fb7a639505de676d3557fac76f002480dd6b433427259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288890, "uuid": "0832a9da-ee4c-423d-a2ab-724c79f17636", "value": "T112F32B46E6418B13C4D6177ABADF42453323AB64D3DB33059928BFB43F867AE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288890, "uuid": "1a96bf1d-c10d-46c1-80a1-a99f4bc6aeb5", "value": "3072:fh6MHUXU+hByy5aA0U456e9ZElTnXRzUJhYqaZGpGM/9ZcsNV0:YMHUDhM4aA0U4566GlzR4JiqaokM/96F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288890, "uuid": "955bd6b3-48e7-472b-97f3-6afa128c27d0", "value": 160181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288890, "uuid": "58af52a6-e577-4e83-a9e7-3f946b8921d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288890, "uuid": "ec21e315-d83d-41fe-b6b4-744f2a8e8820", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63205630-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275944, "uuid": "7f67b8bf-d824-4d5b-afde-901fd9e0ddc0", "comment": "Malware payload", "value": "a2067d4faaca0d2553e8ea77f267a613", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275944, "uuid": "8cdbd799-3372-4b5f-93c4-46338bbf866a", "comment": "Malware payload", "value": "a756cb84ce722b6e2a7d775f558a5eecb7af64eae6e562345b58013fce751ade", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275944, "uuid": "0da2f88c-2e06-437b-8660-2579a0d3e8fc", "comment": "Malware payload", "value": "5fda160e9d199459dbfb305ebdfca13274b84b8b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275944, "uuid": "55174efb-c0d6-4e6e-91a7-2a2ec2448f72", "comment": "Malware payload", "value": "8a1e3801240e2d0d3cc3c7fed7a9bc52a434db44e239ad69036103394267ef9868f2e2caf895be2abaeb2b7b436973de", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275944, "uuid": "5b5fa61d-ae14-4ead-ae6d-ad406f624370", "value": "T11F55338B413C28C44F7D0B63BFFF855CA2259DFC104208676A594996783E7AF8A7099F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275944, "uuid": "86e81c12-ea9a-422e-8c6b-d0670f258de9", "value": "24576:lw0w5MesoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRI:3w5MesoZ9bq+MmMEL+hcjXHC/wnwdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275944, "uuid": "892bcba4-992a-49bd-8c0f-7af51d6c0b77", "value": 1397727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275944, "uuid": "ed8398de-14b3-4275-bdba-4adc970c7ce1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275944, "uuid": "d0f94a00-4367-43b0-8dfd-138fa62732b5", "value": "a756cb84ce722b6e2a7d775f558a5eecb7af64eae6e562345b58013fce751ade.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68d0d11-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271333, "uuid": "8870fef2-367c-4cc6-893f-8982d370f174", "comment": "Malware payload", "value": "a1cac53f62409ccb78260079754f1287", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271333, "uuid": "7f980bdc-6578-4463-a072-9d4d1bb83963", "comment": "Malware payload", "value": "a79d7ead147621dd675189a733b56054c289788d5c2aa0c69b1190239b65f3ba", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271333, "uuid": "58a1459f-e5ee-448c-aa2e-f33004803a3e", "comment": "Malware payload", "value": "242cce68f59ede613e4566ae8f913390dcad4a00", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271333, "uuid": "bcfb168d-04be-4e6c-ab46-ace2cb545893", "comment": "Malware payload", "value": "73b484719917bac8e5c3d0d679189c797348cae97d8961eb80fcd754dcbe933cd30cf5d168a2bc239cb0e7a9b734de29", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271333, "uuid": "5303fce6-fc04-43cd-880c-027c667d2910", "value": "T10FC42304340641D5835A2B1EAEC4E7E0BEB560DBFA1CF940AADD7ED06DE92A173C1833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271333, "uuid": "25bfccb5-1e7c-489d-b97d-1302b2283ac6", "value": "12288:v6wlOMWROC/FTeHo22Qm7NzofOr68mNeA924EwC3:34MQOC/gHozN7NzomW8LA9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271333, "uuid": "af83214c-18f8-4cd5-bcb4-46fe880b01f4", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271333, "uuid": "6a6e370d-9448-4d80-ab5a-c097f9346334", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271333, "uuid": "8bffec35-2d7b-47ce-8e61-e33679792968", "value": "a79d7ead147621dd675189a733b56054c289788d5c2aa0c69b1190239b65f3ba.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc7904e-c1bd-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791315610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791315610, "uuid": "7df3fa3e-3a9d-403b-bb53-d88fd384bde7", "comment": "Malware payload", "value": "e75e5f1f532304ac68766bebdc5f8c8b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791315610, "uuid": "44786732-05ab-4c23-837f-e294dadea170", "comment": "Malware payload", "value": "a7ec293736b98f2eb2dd24801d3b958b2c2b33553bcf975c6e654861fd86422f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791315610, "uuid": "fde8cc3e-0466-47e5-b0c1-db30ec501224", "comment": "Malware payload", "value": "bf9ac9924eab4eea39368eb7afd66ada7f47dfbc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791315610, "uuid": "bc5b5bfa-2b5a-4138-b5f5-6f8690a60922", "comment": "Malware payload", "value": "bee605f5251b34ef03725b421d4916dd1837f5ac36f1c7af518a8ab3ad7dcd0e2afc260560476d1de7764184de5c468b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791315610, "uuid": "fb2a4537-1a34-4747-ad51-8f3122e566f2", "value": "T1D942195CAED162B0EA1707DE73AF24690228A0C7240DC484F94CDDE87F46BDC4A57B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791315610, "uuid": "6eec5756-15f6-40c6-b04c-3841957f772d", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzXbqFtCASsWRUM:sXX+/DV7k/3OFt5WRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791315610, "uuid": "f8dc9725-6365-492d-979f-32f8fc534a0e", "value": 12054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791315610, "uuid": "ba63a672-7885-4d3d-baa8-65c06bb6816b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791315610, "uuid": "90a37103-2bcf-48b2-8ccf-419d17561010", "value": "rooming.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbb077a-c17c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791287744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287744, "uuid": "8185d96b-7583-4e8e-9093-d89f2337d360", "comment": "Malware payload", "value": "29276c8d92b956aee2aaf32a4b75cc6d", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "decoded", "colour": "#13A1FE", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287744, "uuid": "9b84145e-b5d9-4e69-9ae3-f41d656b79ee", "comment": "Malware payload", "value": "a826b9cc584bd8c95e2778eb52e58e252f006b183d0cdc87de245b96faec4a6f", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "decoded", "colour": "#13A1FE", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287744, "uuid": "acb8b59c-2e85-46ac-a2e6-de515cb86f1f", "comment": "Malware payload", "value": "bfaf2eff21ab86b4138f14351def42c52daa02d0", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "decoded", "colour": "#13A1FE", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287744, "uuid": "203ce7ad-6094-4db1-a632-ef5732ea3b9f", "comment": "Malware payload", "value": "5ead0b45533360ae6c4c52e8a804245f5e759cf7c32b6d333b76ae12f37ecbcd7ea9e5b978a484ec2b2313ec93b528c1", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "decoded", "colour": "#13A1FE", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287744, "uuid": "1a3d24cd-262f-4653-b1c5-1307a5005f34", "value": "T1437423253E75C5284EF3603D8FCA048BF605096F60ECA1A4751E96C73F72295473EEA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287744, "uuid": "9f562e87-4926-4ffe-9281-79d18e946cf2", "value": "6144:rSNl0D/ZbWKMwYwMuyujjdo7JujZf9FVWjd6UNjJg/U7KBZaRIFkZhu:eo/LhjG4jZf9FIjd6UN9g/AMERXbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287744, "uuid": "91d1f57f-9b10-481f-8679-32cd70ca152b", "value": 370708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287744, "uuid": "98e3c697-5512-44b8-a674-ddb6292b7192", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287744, "uuid": "dfbef147-8c1e-409d-bb14-602f75d6d4b1", "value": "stage2_decoded.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c91f0c-c151-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791269237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269237, "uuid": "eaadc80e-15ab-4dcd-900b-5bd11afdbbaf", "comment": "Malware payload (Formbook)", "value": "14a58fbb6422c27976bf32401f5ef593", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269237, "uuid": "d0383b53-090b-490d-a041-10e5aa6f9625", "comment": "Malware payload (Formbook)", "value": "a834ac8699c5b2fc4e1e9ad8cc7d98b9da6a976de91cc048ca2864ad846399fe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269237, "uuid": "2e7ed4d9-ab4b-4382-afc4-b75b0470e36d", "comment": "Malware payload (Formbook)", "value": "81317f727d77e2596003e3695b922a7098e9416a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269237, "uuid": "65d260fc-f874-4279-9cb7-f268f02acd9e", "comment": "Malware payload (Formbook)", "value": "3245cfe5de1bfd97640345d40d392899ba4814a845ffa406508bf095d95b66096dd5493408da7fa5d17b97e2ed11d0b7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269237, "uuid": "6bd487e4-ae21-4dab-babe-88ae717f934e", "value": "T1AFC2200009A178845333ABBFAB1B98E9FB77096B01948447786CB851AFF2C1CDDE4DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269237, "uuid": "b8c6227e-84d4-431e-9f7d-b1d4b0e9e253", "value": "768:PQ6S6RylvbRTXO1fl1HYwtKwwVeraTP7idghCPxm7Btjf1MPjXvcUsarQCP0snWg:IlVZUByg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269237, "uuid": "25d4bf9e-313d-4d85-97d1-cf5cbd1f1aa0", "value": 25940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269237, "uuid": "1164c694-0e20-44ec-bd10-3c3e1e2f58a3", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269237, "uuid": "ce4e6f2b-e3ff-4305-9190-06adca5a1674", "value": "CHECK VALVE - ENQ-MYY-EG-SPE-00002 - Valve Materials.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cfa1b4-c193-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791297581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297581, "uuid": "0ec947f7-3421-432d-bab9-329fe3ba9686", "comment": "Malware payload (Mirai)", "value": "36ddc976c27625064f3f2741c386c27c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297581, "uuid": "7209514f-3924-4be2-b56f-ed72c1d033b4", "comment": "Malware payload (Mirai)", "value": "a876b21f6f0765e8c995f98d91a15e8bda6887ea70c6c6cf330dbeb225171ffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297581, "uuid": "dd76074b-a322-4497-86de-ec96454f94d1", "comment": "Malware payload (Mirai)", "value": "8bd0dc86cad7dab1e5f476e4c8194bdef8fc108b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297581, "uuid": "98291fcb-9920-4f48-b620-949ac005986c", "comment": "Malware payload (Mirai)", "value": "cb8c01f137123042a46c5740ad68844f46441cb06ce2953d88b452fb6e6d935df16c89bec35834d27e7945ccaf89f0da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297581, "uuid": "88e20576-e397-4d8a-955e-292bf2cfb066", "value": "T15BD45C66BC919B90C5D149BEFB6E437872035B79E2EF7106DA045FA06BCA8D50F3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297581, "uuid": "c170bfcc-7fea-4db9-a6f1-faa9dd886285", "value": "12288:G5HWG1t7ewu4xRHp3g/IfvIathkVLwdcxDmT:WjxZq/8ddcxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791297581, "uuid": "d66631e6-0159-4494-a56f-19dcc23988be", "value": 652604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791297581, "uuid": "4927ad03-533f-4fdd-a856-c2cefa715977", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297581, "uuid": "3256f662-9c76-4176-99cb-ba26ae488787", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c90e69f-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263880, "uuid": "78e366c4-8514-4304-801b-388dec5fb877", "comment": "Malware payload (Mirai)", "value": "81b9f8510f47c7558f48160ed62faa43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263880, "uuid": "0d7a74c1-fa80-49d8-9ecf-2be1e475414b", "comment": "Malware payload (Mirai)", "value": "a878d1f030715dde9ddba0a5ed4de96760e7b9fe9dc4c550b6a57be62f90c042", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263880, "uuid": "ba74a6de-2017-48fc-ad3d-fa26b5257dfb", "comment": "Malware payload (Mirai)", "value": "5d6cf61421d39137f05d50446ff4b9f11f9025af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263880, "uuid": "399c4fd2-3937-42d9-9171-07d3ee8722a5", "comment": "Malware payload (Mirai)", "value": "34a1df37ef651ecaa24ae38b28d3426252c35b6683d4d0e7ddbae084b475cab34724b3375f31b6a04b3e9a2774de6fb2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263880, "uuid": "1d1c3389-d995-4895-a361-ebc6de303163", "value": "T1B7342A83F905DEB7F40AE73304D307357231FB6249531A22B21B797AAA3A3C4646AF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263880, "uuid": "0c140cdf-4960-4007-b24e-dc2a64ac283a", "value": "6144:CtiEdyHKk8hTjRLq1njLagjaRBYqZXjtj/3E4Ptzr4UHk:CtRtLdgjaRBtZXjtj/3E4Ptzr4UHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263880, "uuid": "1f457891-68e6-410c-9032-028ae6f531fe", "value": 230971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263880, "uuid": "dd579714-2af4-4fa3-bcd8-ea2809434a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263880, "uuid": "03e162e9-1ca3-4275-9867-f420f8b091f9", "value": "qv3.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78c3ae3-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273186, "uuid": "0076945c-095c-404e-ab0c-4619051c8ac1", "comment": "Malware payload", "value": "477acc86b7bcd13b4511ab99dcf070b4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273186, "uuid": "87bb2546-de4f-48b4-b781-c65244564a3e", "comment": "Malware payload", "value": "a92099011456837cab8eb7a911b70616b146badc0247f419cc9c0ceba4a15c48", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273186, "uuid": "07c7c33c-a864-4494-88f8-f60a8d14cffb", "comment": "Malware payload", "value": "c4f608d12f3b7d495208d92680889c4bb593070f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273186, "uuid": "7d5f5f2b-2387-4547-ba60-7febdc003a83", "comment": "Malware payload", "value": "585e43199d5569fe621f34c9f5ca5693858f7389de17259f9462a4a811c0be2b42e10a3d809cb70cf287507a941a1a0e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273186, "uuid": "fba02b6f-d40a-431c-9240-dfef9da9c2d6", "value": "T129C42367226F72500DFE92ED8E4156146D3D8E322A00A6FE55D8C9CE8719F0ECE35E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273186, "uuid": "135e1d19-330b-4678-aa88-677627b46987", "value": "12288:ueCEht59qO3g/ALyYG0ZaDajTCXMO8xzDOeQakn:xtnA/f0Za6TCXKBxlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273186, "uuid": "c829aec2-4203-4694-9c0b-f12bf4b84b91", "value": 546286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273186, "uuid": "8b0310d2-29b4-475f-85b6-952aea82eecc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273186, "uuid": "09dbf4a0-765e-41c6-961f-063330c67859", "value": "a92099011456837cab8eb7a911b70616b146badc0247f419cc9c0ceba4a15c48.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a097ddaa-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303105, "uuid": "7dc682c5-9a8d-4c43-90ad-0b2dc040b99b", "comment": "Malware payload (Mirai)", "value": "e1c4133231ce4878586b60ff9e816bcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303105, "uuid": "c2424b87-acc8-4454-8a7b-ab822c644623", "comment": "Malware payload (Mirai)", "value": "a9353bc636c4ab17b0cbe68e289d908db6927ca5df6f28082dcde4f8694c18f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303105, "uuid": "0be3198d-4c51-46f6-9ef1-bce99609afa8", "comment": "Malware payload (Mirai)", "value": "f3db66619f0f2380ebb66aa7a71c486ff2db6259", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303105, "uuid": "c1ed3c9e-7c3e-4b7c-b2b4-638a97f62fb0", "comment": "Malware payload (Mirai)", "value": "1a9540d50b907aac4506612157929584c70259dfe991481134b360296c83aa38361de7bb70286a1395cf759fc45a877a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303105, "uuid": "775e8678-bdd1-4ef3-bc8c-2f29091d8442", "value": "T16B046B1BEA43E170E0739031414ADBB78639A9354342C417FBA63E35EDB46C5E686B2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303105, "uuid": "c95eb258-51be-484e-9013-2fb8df4617a7", "value": "3072:hdd0RVke0elWIB8fvgFAtauytqNkqOowFS5PRariTqWcyavvOMx9:fd0keHBOgFAtauyciqwDWHMx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303105, "uuid": "6ea54a83-2634-4e48-92cb-9c435d4e9e8f", "value": 173372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303105, "uuid": "6ba6325a-b7e2-41f1-ab80-2c96fefb1df5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303105, "uuid": "ada46232-bfa4-4b91-a7a6-ef4923de0e83", "value": "flutter.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c672912c-c198-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299733, "uuid": "0ff508ad-010f-4e9e-98bc-0cebdec9c922", "comment": "Malware payload", "value": "11ab9f8b630a52a89af86190ed556633", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299733, "uuid": "90b5a7ea-3626-42a3-be4a-383551415bf6", "comment": "Malware payload", "value": "a948edad10855dbf0d14b7a860d002bd1f8c5f31e67345888d4c9769a157745c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299733, "uuid": "2e713ba9-6263-4ab1-9b18-de1567c99068", "comment": "Malware payload", "value": "7f3995e5bef4cd7482420cba51c3380184c3e318", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299733, "uuid": "14a3de64-a889-4ee9-91bd-220ae594a028", "comment": "Malware payload", "value": "ea8ea679df1ce7dea5a6592ebde2e5936503049bc8bc53b223f1a84e88bd2fc0bca9135d33d98fc30d1d9d5e992e96d1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299733, "uuid": "7a6427f0-72eb-4cda-b719-6a877be618af", "value": "T111C41275EAB82570E51F86B480504F377807D685A00F127B3EF14E8B8D86EEBAE5B345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299733, "uuid": "841928f6-de0c-4554-9081-a46ef0202fae", "value": "12288:CHGpmjb3q0ubpWUMbP8AwMA1IP3glnoZ4LpTG:CHGpoUFjM9JA1IPO9NTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299733, "uuid": "66511a41-95a4-48a9-a8b5-d25c4e33cd5e", "value": 556566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299733, "uuid": "a14e1f31-df62-4676-95ae-1da7fc66274f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299733, "uuid": "d57f0965-f680-4907-9952-89a0a098a014", "value": "Clutch_client_v5_.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358939b5-c12d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791253534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253534, "uuid": "67faa300-a268-4206-80e1-49d13a77f119", "comment": "Malware payload", "value": "55b331a4b6ce7c12fb115baa183f9bc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253534, "uuid": "f255c424-ed0c-465a-9bb5-d0fbe652d910", "comment": "Malware payload", "value": "a9795082ddfb5f57e9068a7ca4ac4f1d2efcb7d2a45f40563d87c1ab786560b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253534, "uuid": "ca6e0167-3471-4e06-825e-79653946c291", "comment": "Malware payload", "value": "986a4cff5ad5af14c43d6327becafd5f08b1e0eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791253534, "uuid": "368b4c70-2c38-4fc7-8754-4c400a862f6c", "comment": "Malware payload", "value": "30ea046317b4d29e63527eb701d6abc2e16af229ca8f18254d91992b292aae0a5eba843eeba5ea2394cc5c37c99a597b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253534, "uuid": "47fe984c-72f4-49d9-ae77-8f91aa7929e9", "value": "T12D564B03FCA555E5C0AED23486629253BB717C496B3123D32FA0F7282F76BD0AAB5750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253534, "uuid": "79885097-05e7-4316-937b-9a0cc8131c62", "value": "49152:clyy9Xdl8rtg/KhuBUH3zba9KEweol38KQtWdBfH0M0H9oNewY0dHKQKDKM48e5n:cgGtGNSKveoZ8eUKRdk4pEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791253534, "uuid": "45180991-5740-4362-9a48-3b757e19f28d", "value": 6037688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791253534, "uuid": "8a59d59c-c355-4da2-9e5e-d9eb6365284e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791253534, "uuid": "af2b254d-df56-42d7-a4f0-81fb1287e43b", "value": "a9795082ddfb5f57.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7ea595-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "6604cf02-c338-43c3-8112-d1d8c6d011a8", "comment": "Malware payload (Mirai)", "value": "0a5f24d04c8b7e67e09b46b8f8aac120", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "82a417a6-13dc-43a9-900d-e00c3e9e2737", "comment": "Malware payload (Mirai)", "value": "a97c59b7a6045af9aa5e806d3ae1a4252e07dcd970c82958c8852f40e70730a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "838cae36-a54f-4915-9d8d-c45da198a1d7", "comment": "Malware payload (Mirai)", "value": "b403e73900ebe1bbb3dbc7d0d3dd40f5f58efd12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "6edccd49-4821-4aa5-afea-c0d75c475784", "comment": "Malware payload (Mirai)", "value": "6f9930e2c9d0c11967a826876294e59efaa41615b4a05b552783e4cdff7f8e002d00b4aeee4ec41cf560e8d5584ecbdb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "71aab783-ead4-446a-a735-c0eabefd353d", "value": "T1BA64AE57FB068C66C19206F84ECB075D5373C0014F1ADBDB7A2C6A387E97A9EAC5A740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "5c0a133f-4914-48b9-8ed2-e292bea631d2", "value": "6144:XCUZcK6KOP//Fyp1vDCwXtQ6+qAWFfMF5HmJR2cjJ:XCUZcXKo/YvGyZ+8umJR2cjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263877, "uuid": "70e37524-c60a-4240-9f74-82db4e821eab", "value": 319952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263877, "uuid": "2936a2c1-508f-4366-a606-0804ab5e4228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "628783ad-f97a-4c60-9793-a1f000d3fb87", "value": "qv3.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0d052b-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273676, "uuid": "a37bef17-7e55-4fd5-8d72-2929cff87b79", "comment": "Malware payload", "value": "8e3d9f4a281356675ef1cfbbc8e4024a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273676, "uuid": "e26d54a1-4e9d-4482-bc61-d323c3eca9e4", "comment": "Malware payload", "value": "a98f80710f27fae09f83fa42478ffc7aa2d922016ac775aafcc5ae5a026d13b0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273676, "uuid": "961c99b3-f83f-49e6-89f2-7d4bb4cc0436", "comment": "Malware payload", "value": "5a6b004fd93b71c10c8ef1bdaa3014f7302198f1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273676, "uuid": "b909f1ac-0ba6-44bc-9c3f-25ec60f244db", "comment": "Malware payload", "value": "46949dd602aec9f8f87c53412bd9eb946b1d0cb3409756ef87ed32136a013b1a2dc9f3e0e6da0acfedef93bba24b224f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273676, "uuid": "0cd9fc7a-0da6-499d-a531-86f53a18b3a6", "value": "T145A42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273676, "uuid": "ca524045-58e6-4348-8fdf-4c2afb709d7b", "value": "12288:4SCDe0U+m1V6ECbniSPfS3e2R3feeintFck5TsuC8hH7:4De0wUTiSWzeeiBsP8d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273676, "uuid": "78ff50b2-69d2-45a4-bc4d-97c88f6966cc", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273676, "uuid": "83ff8ded-8003-4c9b-9f81-ca1680b10342", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273676, "uuid": "bf098f47-2de7-4622-be9f-c0eb7808d9b3", "value": "a98f80710f27fae09f83fa42478ffc7aa2d922016ac775aafcc5ae5a026d13b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ac2441-c197-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791299032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299032, "uuid": "e8c09fcf-208e-40b6-8775-60254bcea926", "comment": "Malware payload (Mirai)", "value": "5a553d906352377c0fa8af5105182dfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299032, "uuid": "f8ed97f6-6de0-4fbf-830b-b25b14138c24", "comment": "Malware payload (Mirai)", "value": "a9b88512ba552d7c5f283e2e1e070428b0f99db8c4c3b761a51aa2cb0af81015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299032, "uuid": "dfe13f91-dfe9-4ba0-9905-5bc1620a13ca", "comment": "Malware payload (Mirai)", "value": "4753a59899cff211d76860370b2c05570c2c0d2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299032, "uuid": "3c8b2d14-4c31-44c8-b908-8da96f0cb8cc", "comment": "Malware payload (Mirai)", "value": "bc76f27664ff834d7a53be0c68a8d2b0e9dd1f19d7b76570202bfafac507f1dcba0eebc815fb8e1f2578a35dcd7ca709", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299032, "uuid": "300193fc-bfde-4e7c-9944-59a3b2d35c67", "value": "T1B6F308CCE865476FC6D323BAF649568F33321B78938BF32159A7EAB41BC17481938191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299032, "uuid": "0ad0b461-195a-4ff4-8998-1720255e4898", "value": "3072:h6IjgRsJGMPeuQ8oGM+AL1r9PDv1ZpYZsW1zmLmS44hzkj0ILngGMuFQPHjibosi:LSibosT/aK7Oubdm2Wm+WusQ6zy5s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299032, "uuid": "eeb1fb51-8e66-4b48-be6b-3382db598d26", "value": 164155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299032, "uuid": "72f0271d-3a17-44f5-af45-db366b883fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299032, "uuid": "a45624e3-fe1c-461d-b622-6fb925bbe7c2", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bcfb04-c18e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791295140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295140, "uuid": "4c874a59-6e2f-45af-b44b-74db85772644", "comment": "Malware payload (Mirai)", "value": "2c49bbb0c94ce5c8c8eccdc58660cca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295140, "uuid": "2b49cc91-1979-4c46-855d-a5f21b73b546", "comment": "Malware payload (Mirai)", "value": "aa52c624a26d451f3d9739b2c4702b31c13b827f845a3aa98b3f87d1ff1fc014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295140, "uuid": "ba3320e3-16f2-474b-8450-ce78cc920cce", "comment": "Malware payload (Mirai)", "value": "0a5537a310f223764c5e8dcf90babbbe73068963", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295140, "uuid": "e7c608de-9483-417b-a252-056c9d5aba9e", "comment": "Malware payload (Mirai)", "value": "54c7d857230c07e36ba80016a399f1e9b6854c1c281abef6d58de304709f258ecbf857804b91dbb1246a1763ac084739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295140, "uuid": "3e7f6e47-cc47-4bcc-b10a-7675bae30806", "value": "T1FCC4AF47A77A1490C8A6C0B865E207FC89A7528B57F7F1DACF5EA9D1B925480332C3D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295140, "uuid": "c310f0c6-aaf8-4df9-bc87-a895eb5b49d9", "value": "6144:s1dkyRdFxbopNAl769fLRGWo2sEmcc7ZohPAHFK4tQ0Q4FSC/khB4fUwlAbq:s1rMMJ6ZLEWwEuFohPSFPhp84fUdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295140, "uuid": "134afd61-2b3b-4718-93f4-c38096fb3133", "value": 550828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295140, "uuid": "b9ff8fbd-7cd6-41b4-9383-e7e1dd0b6d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295140, "uuid": "60d169d1-0f32-4ee1-9f13-76696eb84a4a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1baca080-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290427, "uuid": "123fc6cc-dbfb-4c9e-aa94-209e6b07da45", "comment": "Malware payload (Mirai)", "value": "f4db40bc3e82172105d091741980889b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290427, "uuid": "b69d99eb-a101-420a-8b49-74995228f357", "comment": "Malware payload (Mirai)", "value": "aa5ac64f3c6cd94160da5d6445f985034ea88a585f152c3756f0f96428e743b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290427, "uuid": "52b28a03-1e22-46e8-bc53-c77477b02b26", "comment": "Malware payload (Mirai)", "value": "fb266e1ff24cae7665cb1e13630c79b9cca33311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290427, "uuid": "b1836ffa-3e02-4179-888d-06733a1630e5", "comment": "Malware payload (Mirai)", "value": "e0127a84a3a0828b59df9e0c61d4088b9a6633b699795ed49e500a89b048aa969b60422b11ed921fad29837830cf5cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290427, "uuid": "c2fc360e-84ab-46eb-8f41-561f910da71b", "value": "T16563AD77C5396E94C15885B8B8308E781B63B14082971FFA5E99C1B68047DBCFA4B3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290427, "uuid": "32333c59-b119-46e1-9574-c43c2fa4bf66", "value": "1536:nAax3wt79EFEMce4MB6KjnFu5XL8jCDES4BERMs/nj:nAaVCEOMcBMBdjiXL8j+esJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290427, "uuid": "bfc28b87-022e-4bb0-afe2-1dc5ec34f264", "value": 67196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290427, "uuid": "ba829529-246d-40bd-bbd0-162cfc2bd3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290427, "uuid": "3a726a76-b773-4bf0-8bff-e2307af1c6f9", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45af6688-c157-11f1-927a-4201ac107004", "comment": "Malware payload (DCAgentRMM)", "timestamp": 1791271600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271600, "uuid": "a494001d-cd2e-40c1-af76-632b36b6a2e7", "comment": "Malware payload (DCAgentRMM)", "value": "6971fe8968925a2c0617db0f4714a27f", "object_relation": "md5", "Tag": [ { "name": "DCAgentRMM", "colour": "#52F6F2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271600, "uuid": "56a4e842-b3ea-49e4-8d52-7d5fbfaf59a6", "comment": "Malware payload (DCAgentRMM)", "value": "ab21f534e2d446aafdc6a1fd6cfb77ea3d2d25a9ca78f6cceee27f05f87cf0da", "object_relation": "sha256", "Tag": [ { "name": "DCAgentRMM", "colour": "#52F6F2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271600, "uuid": "9b8d8f68-4741-448d-8cb2-c2c4c1129eeb", "comment": "Malware payload (DCAgentRMM)", "value": "f464147c7e6088eefa486598992affff9baccfc7", "object_relation": "sha1", "Tag": [ { "name": "DCAgentRMM", "colour": "#52F6F2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271600, "uuid": "744a0bb4-d865-48c1-901f-c232115094b1", "comment": "Malware payload (DCAgentRMM)", "value": "7dcc189604957ef755fde5c39cb3a6d7c1180fbacc55c6531151010e4452ce7885e3865d3d4aa8bff5c402443fa2e22c", "object_relation": "sha3-384", "Tag": [ { "name": "DCAgentRMM", "colour": "#52F6F2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271600, "uuid": "10eac496-5030-4c2e-adff-42ded344e540", "value": "T128822B0EF602ACF5EC5786B99CCBE7B7C6D1620540592AFAFB4CC24C7A61B40ED0A547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271600, "uuid": "5b0332ad-2f12-412b-a5d3-1126980c9383", "value": "ac6471cdaced8dba75cda30e7b659cdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271600, "uuid": "ec621491-4502-4d2d-b989-af0d5fc006e9", "value": "384:j2MiBgAOWjvZoqMA/1y29nFxgOKhplf5Nk3HYzN2I+fI:KNFbZmsFWhphk32N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271600, "uuid": "b824189a-4f4e-4245-90ed-30273bce0b9c", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271600, "uuid": "860a8f14-3ca4-4353-8d83-05bfdb4c16fb", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271600, "uuid": "ce3206d2-02bf-4e9c-96fb-bd6740050c3c", "value": "ARPHADUMP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab598c4e-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275636, "uuid": "256c5961-1fe0-4124-8da8-cf51537d1d6f", "comment": "Malware payload", "value": "9692852e52bc9082969bf00d9976612e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275636, "uuid": "ca3fd846-360f-43a0-a0af-e5d272f250f8", "comment": "Malware payload", "value": "ab8c94659c6f176f6677e96298573088dfcea8888c2b85b15c83abf7c6115187", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275636, "uuid": "1f626ca3-e1cd-4089-85a3-a8eac6174fff", "comment": "Malware payload", "value": "63e843a75149130639f74439a936f5e224cc4d78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275636, "uuid": "3a4b7c18-68a1-4fa3-810a-bc0bd306c623", "comment": "Malware payload", "value": "2b205d34ea092b4ff2828a7acc06b433d934e377321ce0853e53f1db19d05c72fcc19bb7ca69ffb369d991e6f7e77435", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275636, "uuid": "0def3da7-dde2-4676-918b-f42be2e2ebab", "value": "T1D0B4237B0A7F70D00C6A43BA8B468611A43D9D621628AFBD47DCE6CC8D0E51EBF14E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275636, "uuid": "ed292563-4654-4fd3-87c8-4b5bebb8f27b", "value": "12288:V4lhhLoVDI2FLmMJKgeqO3g/ALyYG0ZaDajTCXMO8xzDOeDBk:CxopIAmMJgA/f0Za6TCXKBxFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275636, "uuid": "c5a891d9-4913-48df-bade-5c091cd606dd", "value": 541353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275636, "uuid": "edcf93b3-1502-41e6-9fcb-a702884ed9bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275636, "uuid": "607824ef-4c71-41b4-9dea-cf74035f87d6", "value": "ab8c94659c6f176f6677e96298573088dfcea8888c2b85b15c83abf7c6115187.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6253aff3-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250602, "uuid": "e5a1661d-6e02-4628-8f6f-e473f75bd248", "comment": "Malware payload (Mirai)", "value": "38f016143c713a510d54d3489ff80a78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250602, "uuid": "fdd670ef-d6e5-491b-bfc0-cbb831ace817", "comment": "Malware payload (Mirai)", "value": "ac24f66196f9f5919887f30e4388d8f5c1489723d739a0525b7cb030969ca68e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250602, "uuid": "ffaf2999-9ede-470e-ad44-524b356a4f23", "comment": "Malware payload (Mirai)", "value": "7bf16bdb3907fd5bdd5b168f64455e17455be977", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250602, "uuid": "d5a1855a-6d05-429e-86c6-4ea94f4b3e09", "comment": "Malware payload (Mirai)", "value": "680dd316247ef6b73d6c8d2078cce57a18812a8bd63e0c1648698f252e8acbf1ba83bb683e20588a1249507eeef28c36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250602, "uuid": "424721c9-203b-4c25-895c-66011be7b6e4", "value": "T1D433F707F84285FDC556C13417BABA3AE83671EE533CB6A777E4BB222842E614D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250602, "uuid": "0aa89321-1eff-4666-8548-21963f0d38e1", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HH6ct0QkiuVn4P:yHlPZMEcTFZ2A1HH6y0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250602, "uuid": "b3c78fa4-f1f9-43b1-9ef8-5b9f6685454e", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250602, "uuid": "34459e90-2927-4d01-bdeb-8b8f2d44a89d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250602, "uuid": "cb46f08c-e7e4-4705-8a4d-eca1d14ce2d1", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7761d82-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273616, "uuid": "7b806519-e578-44f2-808e-17d80c203dfb", "comment": "Malware payload", "value": "f4e7a3fe89d6e26cad8743125f169b99", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273616, "uuid": "032f903f-2063-416f-b631-941bfcba25a3", "comment": "Malware payload", "value": "ac8a0e1e9932ab65445c1fc533cd8f233bdf2b0ef6bd5173345608259b669df1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273616, "uuid": "11b1231b-be8b-4a15-afb6-4a5161278a97", "comment": "Malware payload", "value": "098dd26bab2c14f14f6e88e070dbf2015b008bb2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273616, "uuid": "f427e7ee-8a4a-445c-8a37-1bd66926f19c", "comment": "Malware payload", "value": "3f9e2a0f73d1960f35a06f76cf7335433f27b1a0904b4f91e6ef3683541df41c454234856e474ee72e4d104e09bdcaa9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273616, "uuid": "bbd37870-92ae-4157-8de0-9b4cd7ba38ef", "value": "T139A423A35293A2D7ABA19F74E40D93D1E2CFCB0D3D9AD2F423B6F904F6651C9444841B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273616, "uuid": "8e948c01-a21a-4f92-ab44-fb3e89cd7376", "value": "12288:11TGoqqMj4uEU5E1RIfMiZ5d6PfLGsjukmtrYFM:11TGoOjrEEfMiZGgtcFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273616, "uuid": "ca9afbac-74a5-4897-9426-03ac1f12e127", "value": 491961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273616, "uuid": "05ff1caf-09b6-4875-9d0a-1556d51542d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273616, "uuid": "0462e35b-2a27-45c5-8837-b445a86c3b37", "value": "ac8a0e1e9932ab65445c1fc533cd8f233bdf2b0ef6bd5173345608259b669df1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8027b26d-c161-11f1-927a-4201ac107004", "comment": "Malware payload (RevStealer)", "timestamp": 1791275993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275993, "uuid": "6e16f218-4a7f-42bf-9f08-68c234c43c9a", "comment": "Malware payload (RevStealer)", "value": "2ced628a3e6299fee6186021aec817cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275993, "uuid": "0d0cddf4-f8fe-45c8-a9df-d6a1bfe538a0", "comment": "Malware payload (RevStealer)", "value": "acabede7ef8b0c5ed4a49ef82c58329ed97825e6d9a1d0c6d6425f3bb754cf5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275993, "uuid": "985bf6d5-0037-4a4b-86b4-b2f3bcc78fff", "comment": "Malware payload (RevStealer)", "value": "57b09e60dbddcc72e5e6087ed5d2932672e7a3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275993, "uuid": "48b4613b-afa5-4903-86ff-dd5df20b2fc9", "comment": "Malware payload (RevStealer)", "value": "e92c33ff991eed6ecd6ad0bfdf014358dc20817e2416a97a3c3ba83fb35a5fcf6a52e00cc3ba6895a4e037785e3e6de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275993, "uuid": "6e2d974e-a0bd-44ac-81f7-f9740dfc97d0", "value": "T196E52359B8C63979E033C3BB56D3B0AE312A3BA647F80C5D7ACD5B201E526296C77305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275993, "uuid": "6dfefad4-e78f-409a-831f-39b0da4fbc3c", "value": "001b63852a413bf6eef528d920bb10b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275993, "uuid": "75587892-0f2b-45df-ae6c-0c32445cbc9f", "value": "49152:0omgr8h8X7MOGMCSS6FQm32TYpg3qV2jOn8kWf/3A3BTs3CI6deECeO3l377:0ofr8WMRXSZd+D3Hjg8kWzCneje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275993, "uuid": "bd4cd4f4-b133-47e1-9b97-5a3d9da9982d", "value": 3065344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275993, "uuid": "e3260217-ef8b-42fb-bf83-f341214e3728", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275993, "uuid": "c28277e3-20bc-4325-bfce-731ec54afe29", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da23847-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274700, "uuid": "ea47c760-f956-4807-9406-6402da436466", "comment": "Malware payload", "value": "54062868d99489e3b5b04075b35371d6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274700, "uuid": "0b977b38-8ac6-49ff-ad2d-08058e795009", "comment": "Malware payload", "value": "acf5229ff475a8ae866b83d648cf68a8feb7a121f3dd015f27024c6020d4983e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274700, "uuid": "41995e1a-8415-4686-a7c8-a0cbfb5b057d", "comment": "Malware payload", "value": "8796c1da6070cc879608a63fc903b7f1ff2ceb8b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274700, "uuid": "11410677-7734-43f1-a2d8-d085aa7609b2", "comment": "Malware payload", "value": "50289c563e9ed36afffa08c1c3f77a62d670264b03e58d251b2373acfaa4ef76a5c53474c04c5a65cdb1300e5d546f8b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274700, "uuid": "0bb3b834-088a-4a9b-922b-89107469bb44", "value": "T193C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274700, "uuid": "0dc2be0e-10fc-4645-8746-920acbf1ece1", "value": "12288:L+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2bySH9I1P0QKw6FEw:L+QqldA/TSO713u7xnSH9IaQKH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274700, "uuid": "0d23fdd4-4a58-4443-9426-644c6b09b060", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274700, "uuid": "1ae8580e-42e8-4c54-82b7-23b07810e7dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274700, "uuid": "1b030860-f3bd-4e6c-8d68-b20b0a542c66", "value": "acf5229ff475a8ae866b83d648cf68a8feb7a121f3dd015f27024c6020d4983e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d92e8c-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288303, "uuid": "c7481b73-5b6b-441c-8ea9-a9f0c5489f9e", "comment": "Malware payload (Mirai)", "value": "2d7ab0a3a9425294aeb2d447bafdefd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288303, "uuid": "afd1b520-d6f0-4130-8b4f-2b80b1b64a28", "comment": "Malware payload (Mirai)", "value": "ad34ec156b1143fc30849f4dc42775f9f0592a01cc86ab9b7bcc6109e8415e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288303, "uuid": "7d3bee8b-45a1-4b87-8ab0-1ca2eecf2f75", "comment": "Malware payload (Mirai)", "value": "fa53226d95c48e1642fb82338a61b9c114099723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288303, "uuid": "732cbcb0-64d4-42da-9fba-dc1b0884dca6", "comment": "Malware payload (Mirai)", "value": "06b9aea272edf367067f0d3b5e64a6ae30d08a648e6b837e214005ee4db549af981ab3a4ceb3a0448f3bc00f00a77d1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288303, "uuid": "b9e31901-a589-4077-88cb-77614a254ee1", "value": "T10FD47D8BBA50CDBEFC97D33645130A286020F2E255E29B2FE15E7DA4DF2D1902535BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288303, "uuid": "32995673-ee96-4190-b134-98e575b8f999", "value": "6144:onB7YobsCT4hFUc7IaQg1lH7l8WEfAlTcQaMFLymxUc5PbkgyOLLxzsSwHPdYsLj:U5YoQ4oUTaz1/88NNkk7wFN2du5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288303, "uuid": "880667ee-1f7e-44eb-960c-2b12457cc05a", "value": 612052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288303, "uuid": "9d238ff0-a292-4953-ba80-dd512723431a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288303, "uuid": "8b92ed36-f6a7-403b-87fa-6eb181dd470d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89530b15-c19f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791302637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302637, "uuid": "93b10867-94af-44a7-b1be-140af4c0f125", "comment": "Malware payload (Mirai)", "value": "7bdad42778b7d2d29e1fd8d0cfd5b1b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302637, "uuid": "cb867ba1-2104-4e27-a564-8e37e79ec0a5", "comment": "Malware payload (Mirai)", "value": "ad7f7ce2a0949295e786ea45b327f38e4adae7ad67df3d350c491f5c04dd3edf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302637, "uuid": "59f37695-2c15-46de-9afb-5111e4c203e7", "comment": "Malware payload (Mirai)", "value": "78091742eb3aca22d11e9d6a44b44bdb8b88d9e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302637, "uuid": "5d840a17-18cd-4cfa-a702-9271bf7932ee", "comment": "Malware payload (Mirai)", "value": "206f0fde12105c1ee5573b4010ab52e52533b3ab9770d5c3e0fa299d9f8b34078c22904c0f00827e43f4c6ccd9e17ad3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302637, "uuid": "eb3b2ee2-7884-4f9b-9759-5146bfa5742d", "value": "T1AC735C21F939192BC0D5A13A21F74722B5F683CA21A8861F3E710F9DBF615403A57EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302637, "uuid": "77e41cdc-8a68-49d7-bb7f-bb2683b4efee", "value": "1536:uRdiJuwMzJ/wrC4ajsq2rt5ntaM6Ym5WRwanVtrHd:/ux4VfsM6YOS1Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791302637, "uuid": "1008b363-5620-4b7d-9773-1e1c1a200706", "value": 80000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791302637, "uuid": "11b22a99-f0ae-4c1f-824a-8c1950c6f6e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302637, "uuid": "3cd59278-2f4a-4f14-a40c-03627b4c8954", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06817c1-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274436, "uuid": "8f4af5f2-0945-466a-8f04-56e7be55da24", "comment": "Malware payload", "value": "848ec6f02d0a9f1c1d40c3d80d21d217", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274436, "uuid": "3fccb58b-50b1-4e7e-bd9f-b0db34abf69d", "comment": "Malware payload", "value": "adcdb7b809b5e45ced6637ddafb646b5aa7ec4d5799e8927e889757d812f4413", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274436, "uuid": "dad26590-c3c7-47f5-8c13-abaa08ce49e5", "comment": "Malware payload", "value": "3fd8b24dd54122fbeb2615c7b11ebf037997b305", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274436, "uuid": "67603850-eb24-433f-87a8-969e63b7df19", "comment": "Malware payload", "value": "6064863c32b6e5c0a2ac49548d5c42ba847dfc3a2d192c9c6f3f1281c9a79027cdf25431b0ce86a41c6ba33488c2aa84", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274436, "uuid": "dce21c57-57ed-4f7d-a480-419551b2c545", "value": "T18EB4231AF4D478CFD68ACDA394291C785F6C96C9CD122B7246C4EE9313442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274436, "uuid": "c8e49384-01ac-4b39-846a-9ef61ddb60f5", "value": "12288:1TibgSMFBOBSlqrxKu7FxPbzJTVBU+8JM9hAC8Z3QVOBRkbKQDiUbpKM:scSMFYHKkxpTKJM9mCw3QVOMWAPbpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274436, "uuid": "a52e9204-99e5-4fbb-bd1b-87e74649c5d3", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274436, "uuid": "f2778396-1f8a-4078-b588-f1ccc1b703f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274436, "uuid": "0488e9c0-315a-4638-b6c1-0e99bbb044fb", "value": "adcdb7b809b5e45ced6637ddafb646b5aa7ec4d5799e8927e889757d812f4413.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f30c57-c145-11f1-927a-4201ac107004", "comment": "Malware payload (WannaCry)", "timestamp": 1791263768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263768, "uuid": "8b72f7e9-6858-4c67-b802-8182733da12b", "comment": "Malware payload (WannaCry)", "value": "99088294d431c0b4b63269202dba2d00", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263768, "uuid": "b577ac9c-ee34-40a9-a854-02370415fc5b", "comment": "Malware payload (WannaCry)", "value": "ae5ce4d540d6decaca5aa836d2e53b5b1067a53c61a6df88c5498c7b04f0827a", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263768, "uuid": "8a9749b8-e014-465f-8ef5-34dfdc07eba8", "comment": "Malware payload (WannaCry)", "value": "08932d441b67fef7577c8aed7a57a5b57e3ea9cb", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263768, "uuid": "55f3ff17-c6de-4e25-a61c-aa0ba9abc698", "comment": "Malware payload (WannaCry)", "value": "03deb2db5d600b9cca053307b9c2a34a7ec562c867cd30e9be96e2f2450c5b0ca870e811d432952da16b51d558499b44", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263768, "uuid": "ff0b96e6-25b4-4247-942a-dc484701f012", "value": "T11236235E32BC91BCD007233594B78E26E6B37C5A22B99B0F4B4486761E03795AF64B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263768, "uuid": "bd2b32d1-5fc8-47b6-8c6c-67c2b8a66c16", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263768, "uuid": "a45d0b36-28a0-41a2-918b-d1640ed8a2c7", "value": "24576:jbLgBbLgu4QhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+:jnsnoQqMSPbcBVQej/1INRx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263768, "uuid": "402f6af3-4900-437e-9fc7-a6edc3721a0c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263768, "uuid": "6bcfeda4-ac12-4c8d-9f5e-bcecbe172347", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263768, "uuid": "ff554a28-e6ed-469d-a0ef-5a6ba7c8eb69", "value": "ae5ce4d540d6decaca5aa836d2e53b5b1067a53c61a6df88c5498c7b04f0827a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be8600e-c127-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250887, "uuid": "794dbbaa-06df-4cd8-a277-da3ac4649f45", "comment": "Malware payload (Mirai)", "value": "c60c40f753a1bb60f76e1231cced94ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250887, "uuid": "1d751963-3ac5-4a9f-9dea-2848351493cf", "comment": "Malware payload (Mirai)", "value": "ae8d375ef8ab0a71375b665445e5fc1f71e0b10fc1fdc07d33379c8795ca973a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250887, "uuid": "493e3efb-ccca-4556-86ba-a2543e003577", "comment": "Malware payload (Mirai)", "value": "b7e64de95560538ed23a330ff7411b388973bd5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250887, "uuid": "08c3d85b-97c9-4b11-9414-4050c8cf26db", "comment": "Malware payload (Mirai)", "value": "2d310eef5953c917eb0a9bdcc8710302d5ac7387e572ee6fb1011ba76eb071a4e3d8e540700b79cd6569d68cba54951f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250887, "uuid": "e97feb25-c61c-4adf-9e7d-24cb55afc24e", "value": "T14BB2C0CD61943484CA8D7C7C278D4A664F68A190FAED9B16E350CD98B3BEA4F3459078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250887, "uuid": "d7caa351-7996-41fd-88ff-c38eb5164989", "value": "768:chrQlS07dEv0UXqUhvQE+CXQKMQKCXBpJZqaWvH:KQlS07FUXqIYSXQKqufqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250887, "uuid": "8223cbde-bd6f-4e03-89f2-93803eb73a88", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250887, "uuid": "ef41e5b8-8e67-4f6e-83a5-c59500a50fc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250887, "uuid": "b9482f29-1d49-4145-9142-dd75907c5b00", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10927afe-c198-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299428, "uuid": "8f57cf23-4f94-41b2-a275-9968e52dafe6", "comment": "Malware payload", "value": "7da8db749296f242d55bd321e5dc21c6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299428, "uuid": "abd4306b-7f2e-4d3b-a2ff-4ae392749be9", "comment": "Malware payload", "value": "ae95541266a79cf6583ef265ed34b02d22f78472b39da08dc90e922ed4c1f1c4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299428, "uuid": "9c196c56-7947-4bcc-a07a-460a7004d205", "comment": "Malware payload", "value": "e2ab1dea1dd586837bd9e05f113845f56c150f0d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299428, "uuid": "b03c9b45-79e4-42d9-9c8b-18e5565605bc", "comment": "Malware payload", "value": "022c6544290c594258b56709cc2096e97de9472a2b79352a26fe72e68cc28fe659c2a22cd3396be474bff479f407e99d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299428, "uuid": "9e5df9b0-fbef-4bf8-a7bf-ffc25c1047a5", "value": "T193D41213D55CD0F0E7176374C48B8A61BA1E0E81A847B83F5ABD199F5D8E9BA0F0970E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299428, "uuid": "55a0aa3f-5bac-4fbc-a827-c6fb269e8e0d", "value": "12288:1jS8ApGikV91VfN8eVyiFMVs0QvJg+OM7kI/e5belY:1WpYfBVXFf0QvJg+O8Niz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299428, "uuid": "a30749b4-aec8-4852-9dca-71d077d565a4", "value": 639592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299428, "uuid": "b48ee005-4ff7-4adc-8170-8d33eac1923b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299428, "uuid": "6960aa92-6aa8-420a-8789-894e9d2b673e", "value": "AstralClient1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac954bc-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "ca654a1c-5495-46aa-9392-0f3124f317b0", "comment": "Malware payload (Mirai)", "value": "32ac726dcdd6321e640376a9fcea2816", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "9777688a-5df0-43e5-8b2a-b9d901545141", "comment": "Malware payload (Mirai)", "value": "aeaf069709600b0bd2e9bb8b067845bf3155d2ddc9ac7fa4e54079f9c27b3207", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "f2364c0f-3609-4ef8-ba0c-2ad15bb579a2", "comment": "Malware payload (Mirai)", "value": "44c5f1e4583c6f6a5ba56e9bf0263cd319be4e2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "07a3464c-eb0e-410c-ac30-08c43e29ba12", "comment": "Malware payload (Mirai)", "value": "fae7e7f669f79d34d6cdabab56e47838b0a4d116f8591cf03fa8cd310a8b5e964a8c157e0546e21b6ee0b55c171b22c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "c68670df-8d1f-451d-a05d-4b01589f2304", "value": "T158342B05EA418F53C4D32BBAFB9B425173339764E7EB730695286BB43B8675E4F22102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "2b4c7f4c-bf66-49e3-980a-b85f83f1e18b", "value": "6144:zIbt3Sxop5/GP3abjyT/YSSmLlJlsLXRLa0aNBsV/O/MmDo1a+DH:zutC2z/GP3aba/YSjjlsLXRLaRBc/7mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263877, "uuid": "5b19ab66-ec84-4f91-b617-cec8a58ac279", "value": 234746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263877, "uuid": "af28ac6a-7811-415d-9ccd-bcfe12b40599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "5927d378-6e08-4efb-a4f1-8e083133c5ac", "value": "qv3.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35947300-c18b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791293906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293906, "uuid": "56a814c2-017e-45fe-89be-b4ef0bccbe37", "comment": "Malware payload (Mirai)", "value": "3f3344a7520666bd59ce91ebb3745720", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293906, "uuid": "f5996000-8bc4-42d1-9f1c-f341d9bcb07f", "comment": "Malware payload (Mirai)", "value": "aebb955e1ddaee6945f78f7fe190aac460ecfae8999f96a51ac33f7d9721d27e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293906, "uuid": "7ddac0f1-8a50-44be-b545-456a40de8de6", "comment": "Malware payload (Mirai)", "value": "93e4313d2ee319fd88a8ad72ff07b0ea13c335d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293906, "uuid": "540f3483-3c4f-4ffd-b558-b823fc1fe5f8", "comment": "Malware payload (Mirai)", "value": "0e2fa216fbc05e6cb00607f96d914c812cbc1c7be5727651a1c529452c9baa90f4f30027bced36c125e8d577a8dd214b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293906, "uuid": "b2f568b0-f053-41e6-9294-a116180e3a48", "value": "T147F2D0D5E7F8C980C3AED17C844BEA0F0451D55C8C0443AADEA9785A2456F24EA7EEF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293906, "uuid": "7800fd6d-f160-44f3-b9d1-c6249a02af98", "value": "768:6W/zEpEYEgHE+Tc6ryeinkUNnERhn+f4o6iu6j/ACGEqiaIuhinbcuyD7UHQRj3:34B1E+Tca7UAhqR6yxaIu8nouy8HyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791293906, "uuid": "89b59c15-5bca-4838-87f5-89df0bca60d5", "value": 35940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791293906, "uuid": "d5f575db-2f75-4162-a638-f8b2aa02d201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293906, "uuid": "cb4c0853-41c9-428b-83ea-ec1d76578d86", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f6934e-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275135, "uuid": "0727c41b-dcc0-4594-8328-9042fa0155f4", "comment": "Malware payload", "value": "9cdd1b53aa61ca09696cb8317e52a447", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275135, "uuid": "dd3ae32a-8ea2-4a4d-9f8e-b2170536d526", "comment": "Malware payload", "value": "aedb57ee1cf1ee1e88afe7327628b900dca3d0c247c8bf8e4fdc799ad937b94a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275135, "uuid": "a85cea79-7cde-44ea-a6cb-484bb081ec5b", "comment": "Malware payload", "value": "1baa19d35d471a873821b984f816f68e4083d7d6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275135, "uuid": "e1975a39-28cd-4dd0-8cca-3120e79c8716", "comment": "Malware payload", "value": "341ef4f26109754076417255caa2e0236e32c1d5fd9433491f92b1bd50f5aeebb8b6abe11d675917ccc0acc772cf7c41", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275135, "uuid": "00039193-a742-4540-8081-af261825962f", "value": "T1C8A4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639298CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275135, "uuid": "282c9009-6bcb-4e2d-8946-c849b02340ca", "value": "12288:sr06QUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZW:sr06QUv4t1cNk/wjibhv4b2On0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275135, "uuid": "3c7da5a5-1413-4dfc-9220-63d7bf801b16", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275135, "uuid": "20e5e694-c6c2-4e7f-bb3c-784d12677ae3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275135, "uuid": "d2a2fcd3-28e0-4c08-8764-ebdf794ce140", "value": "aedb57ee1cf1ee1e88afe7327628b900dca3d0c247c8bf8e4fdc799ad937b94a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc654b6-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273355, "uuid": "456a3252-f727-41a7-836d-23c2488de4a4", "comment": "Malware payload", "value": "ed9ef130d2532679ee8a365424b562dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273355, "uuid": "f10f6da9-f42e-45c6-b58e-656b1c2348a8", "comment": "Malware payload", "value": "aeef3d551617a807c91b70304273060a06d1fcf6d30ee2b4996bccbfe0342640", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273355, "uuid": "879160e4-36bd-4e20-b970-156fdf12f014", "comment": "Malware payload", "value": "16c26c8139f960178064ec7bd455e89628b4239f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273355, "uuid": "550a2129-d745-4764-a5a1-74221230479e", "comment": "Malware payload", "value": "fe59bc497fe6d0696a9c34904d948e734907dd8f2c49fab1869d748fb78c965cac2509878af3053f40338d4bdbb4f9c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273355, "uuid": "25d9f02a-9e69-4523-883b-f2bf98947c67", "value": "T115D5125BDD160F4F889F5E843254885A6436AB6746B8B5D33CCE292DD3B8E30B275338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273355, "uuid": "3fd48386-14ed-4102-8965-ba12c7ac0d39", "value": "24576:H0dgmcknDb84xjuJlbmj4dBGs2ZK7C90yvR7A1Lv9sE/wMcf68IA4wHloc35e9r/:x69BkauBa4t+oceEB7AyPMQaEtSS3wt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273355, "uuid": "be28f216-3309-47e7-9f2e-04c27c6f1fc4", "value": 2828760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273355, "uuid": "a94b4ece-0508-49f8-899e-72f95fa08a7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273355, "uuid": "133cb814-a3ae-443d-a86c-74a593910b9d", "value": "\uac00\uaca9 \ubb38\uc758 #39.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b44ac0-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274878, "uuid": "17533739-aaf6-48b1-aeb9-d38499340639", "comment": "Malware payload", "value": "ab2df84de88b41370c060b1c9147201d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274878, "uuid": "519d4ebc-1753-4d35-82cd-f7d311e458f4", "comment": "Malware payload", "value": "af3bb6777b206c68b618834504315f28d0f03af8638c54b127a1bc17eb0c0f5a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274878, "uuid": "0ae39061-66ff-45f2-80e1-9a3fbe40561e", "comment": "Malware payload", "value": "bb1b6ac7f4d28a7ce53743e08c737d9804c55522", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274878, "uuid": "44c63b37-47f1-4361-9c05-5ed6fd05c5b7", "comment": "Malware payload", "value": "738f7ea0e71c7ddae0e8ff7e8eb12f0f1b8422a88ca9f1ac59f70c7faaa38008b304d76c0fb6f48d6701fe2b36b33a8d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274878, "uuid": "f563a59d-0c58-4367-ac78-cbccc001c080", "value": "T174A42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274878, "uuid": "3d8eaadc-4fb1-4ed8-a08f-a1d265681ca3", "value": "12288:eSCDe0U+m1V6ECbniSPfS3e2R3feeintFckCTsuC8hHU:eDe0wUTiSWzeeiisP8dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274878, "uuid": "65deb769-41d6-496e-bd9a-e8c71591b81f", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274878, "uuid": "496adc6d-335c-4253-874d-bb52bd5c3192", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274878, "uuid": "aacb6183-f8d5-451a-a6e4-8938f60b3fd8", "value": "af3bb6777b206c68b618834504315f28d0f03af8638c54b127a1bc17eb0c0f5a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f717c5-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250580, "uuid": "239799e4-f415-408e-9e2b-b25f6d283579", "comment": "Malware payload (Mirai)", "value": "c27d0baf2bcb44c6a6ecfa36fc3b8d9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250580, "uuid": "7f101929-8d3d-4ba5-9876-a9bc84def957", "comment": "Malware payload (Mirai)", "value": "af7276347242cddf8717a87fdc963ff5cc0ea69d12d724481a132964067189e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250580, "uuid": "3111c0fa-9fc2-4277-88cd-bc25e00416ad", "comment": "Malware payload (Mirai)", "value": "508f24bd81eb711652880e6fb983f33df85bfa66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250580, "uuid": "fe7fb276-cc47-4988-97e2-f084565d3fd4", "comment": "Malware payload (Mirai)", "value": "cabdd918d42bd9fd99c0e113c805fc131cc999995eae3e7b8756b463398b3cd97fcbc55275822f60d7ea5abb7590028c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250580, "uuid": "97ff789f-c122-4de0-960f-491b0405497b", "value": "T1E882CF3061AB74B4DBE14431FAAECEC6571A0BF9D0FC36E21758AB78894140661F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250580, "uuid": "67a29863-7414-411a-832f-069cfe219b93", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa2hymdGUop5h5lJ:2dV0P6+kom0tVAoNvm+to12s3UoznlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250580, "uuid": "3e5c95ce-ef61-4b33-b527-a42d8dd5d721", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250580, "uuid": "60516e6d-bec3-4a32-bfdf-e8bb44a8e112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250580, "uuid": "b178746a-5978-4b0e-ba88-5d15c570f61c", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3a868f-c18b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791294238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294238, "uuid": "4d9f3208-0b43-442d-b78b-98b5c2fb24d7", "comment": "Malware payload (Mirai)", "value": "30ad871b48556a3c00e5a3f137c41d4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294238, "uuid": "fdedce94-482e-4883-a75d-bff07830fc55", "comment": "Malware payload (Mirai)", "value": "af95b857aee85921f9309924b8c26d90016ad50ae28b84264bf1ab3e04e49efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294238, "uuid": "36f50971-bf59-42ec-8a57-c39ad7cd9be3", "comment": "Malware payload (Mirai)", "value": "bb6783d0310f1d42f52469de0cd4337ae7539093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294238, "uuid": "373497ba-7f22-4a72-a209-120ba2570aa3", "comment": "Malware payload (Mirai)", "value": "254c3a6c60d09aa7fb1fbf364d2639aec314dd7f588a05bee6be00903a5e1942b7d76c2cb78c5bcee42c2a0d4da5b388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294238, "uuid": "dd246b36-3115-4359-b384-767289d17a0a", "value": "T104533B99F4029E3DF88FE9BA84160E05B93023D212931B2767AFFDE37D321659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294238, "uuid": "fa689a02-8d38-4fa9-9720-804b08601152", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozdyI:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791294238, "uuid": "c8e628bb-baac-4c9d-afbb-4c6c9f20dbfa", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791294238, "uuid": "f03702f1-a82b-4a4d-9210-df4919e4ad31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294238, "uuid": "4db4297c-be86-4536-8e6f-51343f040764", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d65bd6b-c194-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791297946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297946, "uuid": "723bee8f-6c15-481f-9b8f-2c5aacac002c", "comment": "Malware payload (Mirai)", "value": "4fee53f2bf25e7ba346fd53c6ddad02f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297946, "uuid": "db474ed7-77d8-4795-b149-78c6ee69592f", "comment": "Malware payload (Mirai)", "value": "afa39e189d609221191081664d05524c3328307d70d0d6f3a4d80faa7b302367", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297946, "uuid": "da741c06-0a09-43b0-b247-39d81f55416d", "comment": "Malware payload (Mirai)", "value": "7b5077bfccd8a3bae3d9de541b2eeabb3629dad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297946, "uuid": "a92e2d89-f2be-4705-9f37-c8e79201dc20", "comment": "Malware payload (Mirai)", "value": "32084d240ceff0a80cddfd02387d97aa5f2be9194dc6b7549beee6c0b3634ad7fea0e9216dad9f48c7ce0599a2ec7cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297946, "uuid": "da80fbf8-3089-4603-a9b1-c0cd69c9ce6d", "value": "T17BB47D07AAB7E4B1D4A142B1215557B94472C9B315B7D88FEFE52C90EE602D0F32C3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297946, "uuid": "9764f328-ce2f-44ae-ab93-ef370d937260", "value": "6144:PS7CghpyxWlfW27H9reKV86f3zIDU4wsS5hwP0gV4/bq3SXXc6y1Gs36NVp/:PGhpyxWouaY/sAe4zq3SXsP1GTN3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791297946, "uuid": "09970847-3dc6-4ff2-ab5a-fc0ffe283578", "value": 536956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791297946, "uuid": "26d0c6c7-c37b-4f6a-a48c-a5d71e7a9894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297946, "uuid": "a8476238-f7cc-418e-92ad-33b4da6111e9", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfc8953-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273570, "uuid": "e90b1de9-b120-47c3-9e30-7dcc4807a7c9", "comment": "Malware payload", "value": "c0f02bb3ca57c685b9b886e8ce7834ff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273570, "uuid": "21fe14ff-5936-4b95-bf4a-ba4234f4b25e", "comment": "Malware payload", "value": "aff7b712de81ecd17bf0e0c94ab24bfe699c656c5363c3e38d8eb71de41166ce", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273570, "uuid": "23b1d84e-ac7c-4579-b542-d3d781857634", "comment": "Malware payload", "value": "371398449f18f8551c3ab689985a64088ed782db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273570, "uuid": "34c975e9-2b4f-43cf-849e-da77ce9f6970", "comment": "Malware payload", "value": "149e9ab6ad74d4f7c9aabc996e4f91c6049d640c69d87fdc247a20ede7b4390862ea7e50884a51a5ba11449985f0619c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273570, "uuid": "bab6db6f-7cfb-48a2-8a86-48ed6a14198a", "value": "T1ECA423AC26D11A352C97B2D4B9153F870770E61F37ECCAEBE60B39C46AADC30054665E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273570, "uuid": "035dc293-6ad8-4d54-89e0-4e0a5d4ddc21", "value": "12288:gJAjNngJOPdzYfcEaN9B/Jm0LU0gM7aQT:g+VgQafclN9BhmSHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273570, "uuid": "e52f4432-1b53-4cbd-891f-7311759e19ea", "value": 467513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273570, "uuid": "4a47253d-a0b8-409f-9f33-3a312c5d6880", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273570, "uuid": "3cbf5e17-8704-41f3-9ad7-caeaf520fbab", "value": "aff7b712de81ecd17bf0e0c94ab24bfe699c656c5363c3e38d8eb71de41166ce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ed55fc-c161-11f1-927a-4201ac107004", "comment": "Malware payload (RevStealer)", "timestamp": 1791275873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275873, "uuid": "e2bfeb05-0fb9-4653-a8ea-aa98cb9b7b22", "comment": "Malware payload (RevStealer)", "value": "4a17cee02deaf2bd7f9bf3f2cd4dff37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275873, "uuid": "557827ec-b9c6-4f43-b97c-8627b6e05836", "comment": "Malware payload (RevStealer)", "value": "b025d3a95f71cfb81f4d4e0162ab1f9a1d821c098bbf1fe5de7fdef73f1ea67e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275873, "uuid": "86972128-6bbb-4c5f-aae3-01355e698f34", "comment": "Malware payload (RevStealer)", "value": "4e7f110ef1002a1dbd5a0756c09692ab0e382ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275873, "uuid": "794a0210-19d4-44a7-8871-5a1555083ba5", "comment": "Malware payload (RevStealer)", "value": "1baa0f68dce1e84b4fcf127b0f8503164ea107863152ec9adb2c69cd56cb1623c53fa8de36a61970f5c1ec7f420204b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275873, "uuid": "64d2a7b4-a4f0-4918-8036-b8b26c4aa698", "value": "T1B3D523997DF22AB4D83AC7724F42F06DB12D739146745F5B76CC2E004E225A06E363BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275873, "uuid": "43788dc8-5cb4-4fed-bc59-3315840e5d8b", "value": "f6ce08c0cf7798e8b58a99c4c1552f29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275873, "uuid": "4bd3ef9b-700a-4657-8e36-de4b03e97e44", "value": "49152:wwxFDg9YIMhPr6V3MWZMMp4475m2ndRdS803zyc5+gmlgBEQ9LzyeG6xJp8Ya7dm:vLk9YI22yWZnp4q5mMRdS803zyc03WHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275873, "uuid": "9cc5c43b-1d7d-46df-ba16-780f11d0aa28", "value": 2953216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275873, "uuid": "1a2aaf76-ba58-4b7a-9ecc-8c3474ee646c", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275873, "uuid": "330a6e41-77c8-468b-8502-965e6b6c876f", "value": "6eq5gvOfRvNmCi54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd895f6-c186-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791291749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291749, "uuid": "1ea34020-8228-4b27-b548-f633a8e699e6", "comment": "Malware payload (Mirai)", "value": "dc9a8855999d87817b27bc4b8930ff57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291749, "uuid": "21c99b91-bfec-4494-b356-c8f2cb5fb8db", "comment": "Malware payload (Mirai)", "value": "b03defa5c10a3ae6cb90860ec25a2bf171a93e0bf95699b95f2e47d2804eb119", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291749, "uuid": "6806818c-3c57-4598-843a-4ebbfe1425bd", "comment": "Malware payload (Mirai)", "value": "668ad94c62c09ca91d1e55c2870f60c422f11779", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291749, "uuid": "6efb36bc-28f6-4ed0-b640-5be441367a23", "comment": "Malware payload (Mirai)", "value": "d91281b13d780acff7cd238fe265edbf5e0e8e25b89de132002e958f3fca63988347c9b945a6a689e870428a1b4488ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291749, "uuid": "5a2b4311-e0d4-4324-b017-637493ac081c", "value": "T1D2D2D1B86B0149D7CA6FA1745DE10B262D608FB2E1437C0B6694D9D7BF0A86C3CE5DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291749, "uuid": "c50f9192-5782-4b71-a888-5217d0139127", "value": "768:U4ylAtv6pqLJM0RXaxGyUbXtheU/ShLJgGlzDpbuR1JH:HMBqTRXa+Zhr/4VJuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791291749, "uuid": "aa37ec2e-ddbe-422b-9661-1b01cf8a29e0", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791291749, "uuid": "dc06e9b6-6630-4e39-9fee-1e99f2e0ac74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291749, "uuid": "62504efc-344e-407f-9722-e3ab0ea1925b", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67071b39-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250610, "uuid": "13ff336b-ba17-4ae6-b800-825998809a57", "comment": "Malware payload (Mirai)", "value": "774d666b952515b1f35ac61088fce9d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250610, "uuid": "e9805bfc-97a5-410d-bbe0-46569eb4db47", "comment": "Malware payload (Mirai)", "value": "b0676837ca4fe8fa9e5837b0d8afad5d5e20e6a686948f73ab8d3810007eab13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250610, "uuid": "28b893cf-1553-42c2-809c-1dea48b015d2", "comment": "Malware payload (Mirai)", "value": "11e31ee2ad281570a6eecf1c63654caae9120ea1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250610, "uuid": "2580999e-1377-4fec-880c-f6b066de15d1", "comment": "Malware payload (Mirai)", "value": "39274d100c10357257d1da8ed3033a721447e8d4d2da81912ca2e91d2868b0f629ad549dab9c44735d9338d7c9170cd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250610, "uuid": "c8c9452d-c12f-48da-9e0d-7693deaf1ed4", "value": "T17BC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250610, "uuid": "0386d0e0-098f-4ff5-81a4-11764908d186", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoerScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIerSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250610, "uuid": "93cf00ad-ea2a-4518-a797-539ef4f887d1", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250610, "uuid": "d82877b5-8a92-4fab-972e-470baf5bdaa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250610, "uuid": "0309d5be-be7a-43e1-9eaf-da5b7962451c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb58e89-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274027, "uuid": "6b9c47ce-50c4-4855-970b-093db9e495e1", "comment": "Malware payload", "value": "741d4ae0d7aaae506e164c211e8b505a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274027, "uuid": "3415c204-d82d-430d-a089-89ac58b6d6e7", "comment": "Malware payload", "value": "b10345e2816165754cb9199dfad4a3ed451af992da517ae7c3abf0205e882446", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274027, "uuid": "b0a10c0a-0f2a-47c1-912f-441987041a8c", "comment": "Malware payload", "value": "95ea1bd8037930842fda10bd39a38a1db5dade60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274027, "uuid": "083cd7bb-1c0a-4315-b5be-0b371f22adb9", "comment": "Malware payload", "value": "7c0a838414ce6216a65d92edddf9203fbf448aac38afc379d1e639a381041d78cdef9d25ecdeb7fd5f519c829a191f17", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274027, "uuid": "6d522e19-714b-4a33-9ce8-c587e6d0184f", "value": "T109A4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639298CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274027, "uuid": "6275054a-3996-498c-b1f1-c26592af2244", "value": "12288:Mr06YUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZG:Mr06YUv4t1cNk/wjibhv4b2OnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274027, "uuid": "5771daa8-ea7c-4d15-99ad-0fe386ea3566", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274027, "uuid": "58719aa7-745b-47f3-b4f8-5a19b0b9894c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274027, "uuid": "c522fcf8-67eb-4b4e-b686-b61074034713", "value": "b10345e2816165754cb9199dfad4a3ed451af992da517ae7c3abf0205e882446.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc80d4c3-c156-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791271369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271369, "uuid": "4d461cc3-211b-4838-9eda-3bae66f6ab5a", "comment": "Malware payload (Formbook)", "value": "bd740a5f660ab7d890bf2cb408d6d60f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271369, "uuid": "9be2e084-4401-46e5-bcaf-d184890d4f36", "comment": "Malware payload (Formbook)", "value": "b16e1b73113223db5d96830abac8b6ac440d7ee06f1a3eb1baa917764ea7d85e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271369, "uuid": "8fbf9f24-276e-4c2e-94dc-0b0e5065123f", "comment": "Malware payload (Formbook)", "value": "3c5de08149d5dd3ee6f11c1377e1c294018d0403", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271369, "uuid": "f9617b53-650d-43d4-8fef-41abc46baade", "comment": "Malware payload (Formbook)", "value": "66b86dd21f21f6663e02e495607255dc378a76c844e80f08c55fbf80ecc895dfef153d51cc715de7cb1bcb37bcc3a027", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271369, "uuid": "abfd357f-fc25-40a6-ba9c-587b6d5613eb", "value": "T133652378125C26D64911E7FAFF7DFC29768D13824983132BA33CC1A136F45A49AA3D63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271369, "uuid": "aa111a17-1d36-4483-87f3-de2f98916df8", "value": "24576:z98syR03y90/EBjxgZyzVAk4iesD4k+XQrvOtyzn8f7ixjOPaOyv1zHNX6Gj:p8syMcXgq4+N2e7wiOjyNtX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271369, "uuid": "537ab8b1-8382-4589-a65c-688779a63e9d", "value": 1539431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271369, "uuid": "3908412e-a54d-4ac2-b580-532d463629d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271369, "uuid": "60b8b73b-572d-451f-b880-8a378dad4630", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0807d5-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275742, "uuid": "dfdba60b-bb67-4a0a-8ea7-dc28a9f2a3be", "comment": "Malware payload", "value": "cc7955f5a9077e79df31fd4f876e2e60", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275742, "uuid": "3e78ccca-308c-4564-a336-ec4470eb7884", "comment": "Malware payload", "value": "b19065c76c6e894a5ec84be7f06e163aa6a2694dde1a81379f97227e054108b6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275742, "uuid": "bb0cd33d-6ade-4012-a1ea-2ef530aaee98", "comment": "Malware payload", "value": "444f73b1bbcc01dc41a96fe902d879a715ea2cfd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275742, "uuid": "7daa6688-6190-44fa-b547-d64bbd7e1f3f", "comment": "Malware payload", "value": "f9562e8d62c21067e4496719b7022dfdf1f7e7f881de105cc88f9f43053c1470fa2d69f440e0d40ae1bbff6c7d29d7be", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275742, "uuid": "d017545e-1f6c-437f-8f53-b8653ae8375e", "value": "T189A4232C59610F367DB7778089395F02472498073BDDABEAC70F3AA84DDEC909A66748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275742, "uuid": "92ffb6e9-265a-4c4e-a601-c67492922710", "value": "12288:7/pj5tFltx5309/wzYfcEaN9B/Jm0LU0gM7aQf:djPFj30B/fclN9BhmSHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275742, "uuid": "d7777d11-99cb-420d-b421-8d1bf392890b", "value": 467527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275742, "uuid": "14fb8795-0584-41ca-954f-a046c1e8b5e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275742, "uuid": "0ead2b80-a7cc-4e89-a2f4-b25e1f467087", "value": "b19065c76c6e894a5ec84be7f06e163aa6a2694dde1a81379f97227e054108b6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c9e29b-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271898, "uuid": "852041b2-1527-4067-8675-d70de40b4246", "comment": "Malware payload", "value": "b98875a1b24de6576fee1716b5b2c63d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271898, "uuid": "c74b3e82-cf61-4e53-9c6e-ab3bc0077b2a", "comment": "Malware payload", "value": "b1ab6fc62cbfe0e2c20a1104f1a86aed67c1a6f9d5ee6c27c57fbcd87677b3b6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271898, "uuid": "b3b21eae-7c15-4e0a-b3a2-68c6c92ec40a", "comment": "Malware payload", "value": "b1822ced38059443689ad882deaa0b71dfef70f5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271898, "uuid": "1ed82d5b-703e-47be-b0b1-32b378551cd2", "comment": "Malware payload", "value": "b223cdd0a83641ee65b09e98a4a106d11ba3d2fb0d16320474ad585e81dcecb564ed74b6a1849d48ab0d86a4050e72a3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271898, "uuid": "9425fe3a-f4da-45d5-b02f-389b2aeeb2ef", "value": "T172C423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271898, "uuid": "afd45f69-3910-47e3-a2c1-3c8345e9d0e5", "value": "12288:wA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWNSFyorOIic/7MPg:bm6Jj6ESfUxZ91kmY/99z8sFXicTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271898, "uuid": "c462ad9a-3f55-4532-b190-ee2cf94b3b0c", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271898, "uuid": "dfa4b222-2b8f-4998-91e0-9db04972adb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271898, "uuid": "b60939f3-6ca4-4b87-9990-15cacd9055c4", "value": "b1ab6fc62cbfe0e2c20a1104f1a86aed67c1a6f9d5ee6c27c57fbcd87677b3b6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64f28b6-c153-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791270178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270178, "uuid": "385cdc58-ccb2-4849-8fa7-ac62fa4c103f", "comment": "Malware payload (Mirai)", "value": "8f36ec9754e3a6867d09e9273b39e56d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270178, "uuid": "750a715a-071e-497a-8b03-510a85634308", "comment": "Malware payload (Mirai)", "value": "b1bd44dc2bc7afee87112216650fbabc75940fa1a3fc9dc30d8dcc9c53f11c0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270178, "uuid": "528b2191-f511-4cea-8e51-52c5f6dc7cf5", "comment": "Malware payload (Mirai)", "value": "bdf4071bfaf1185fd23dd0fdf183cc2d1ad978ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270178, "uuid": "14639e22-ef6d-4e1f-821b-49fd601736cf", "comment": "Malware payload (Mirai)", "value": "baf0a9addc797e0d05a3786386cfe7e690e07afd29bed1eaadd2acad6465a827391abd7c536ecb06f934a62db613ce8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270178, "uuid": "4c16c792-5d0f-45d2-bb24-56d46335d4a5", "value": "T1FBD319EFF2D0CABAC44661B5EACB8553E412FA380722E20773D3FD652A2D5C45D592C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270178, "uuid": "958ba2bb-7256-49a5-945f-6039305ca569", "value": "3072:FnMpvQ3KuvxyUTbsk0EGvdaAkQY8VlqZvDbcZ4crd7yh+:pMpvQ3KeDTb3evd7X2lDbcZ4crd7yh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270178, "uuid": "ac11d02b-921b-42e4-99b2-bab7cbfbc10c", "value": 131800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270178, "uuid": "d8086dbf-d840-4c72-b8e9-3e64a6c3a0af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270178, "uuid": "ef909b84-6c8b-45ad-bdb3-71e80980d0ad", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b704d8-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245904, "uuid": "c1c02050-c9c1-40ec-9a23-66a9c03ecc63", "comment": "Malware payload (Mirai)", "value": "62b838026025080be0b766ff26d75043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245904, "uuid": "fafce6ae-4400-4f63-a962-8c2f59501988", "comment": "Malware payload (Mirai)", "value": "b21b3c043605ca472da929fa8225bb6d74a9752153fb901377db874bc65d10a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245904, "uuid": "0d6d0422-fd88-4177-a904-7d59010165a5", "comment": "Malware payload (Mirai)", "value": "39d960f292446b18f679cc413f997eda63bd9097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245904, "uuid": "e8619870-bf90-4d84-b0b9-d7f906648e0f", "comment": "Malware payload (Mirai)", "value": "8e190135b755f98f68998a3521c11b78c9caf96853af78d0887f52367827d8bae7c849d9c879c5d0631eecbd378194bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245904, "uuid": "d077a728-d65c-4dff-8232-9a023201abf1", "value": "T12AA4E09BF3072D82C5D7D939088AC5448B5AE56763F3D3053F43A9BB38292724F29399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245904, "uuid": "dfd4665c-1109-421d-be42-e744278fbe19", "value": "12288:cff9eqawdZ3mcN0SS1GEZrJbThT0hfQUgp78Tj:WfQBwdccN0SSZ0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245904, "uuid": "8a3694d6-ccd9-4ff0-9059-c6797e7088ed", "value": 464448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245904, "uuid": "f4b5089c-8a9e-40ed-993f-64ebce64f3c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245904, "uuid": "a24353a8-4113-4028-bfa0-16ce5603e93f", "value": "mbupload-_kb5zo9b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151aed31-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263358, "uuid": "296a95f2-2120-49ee-a9c7-1eea05fc2858", "comment": "Malware payload (Mirai)", "value": "1d1c2f42bea51a900ea4e4026ff2654b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263358, "uuid": "bb780823-eedd-43d6-899c-87a0fa0b5a45", "comment": "Malware payload (Mirai)", "value": "b2238267cad870db41151a195b2f05870ed72aeda6650a8b9d727b52f2c3ae56", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263358, "uuid": "a66296f7-7b3a-41cb-9a8d-74d9328fd396", "comment": "Malware payload (Mirai)", "value": "3f4cc818c04b90f0ba9d6c3331937cf1eca7658f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263358, "uuid": "94a22845-8eee-45ea-9693-e1892699d795", "comment": "Malware payload (Mirai)", "value": "1632f497ac7345cbf168ee008e725501355301f2d8cb855b5d6213b8f185ae26ea28e35443f7b7d183d665da39a60fd2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263358, "uuid": "e6f7c38f-50c1-42cc-87bc-d142fdef1395", "value": "T14624C60AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263358, "uuid": "b9029a58-12a5-4bfa-9e5f-b1f7c0ecf898", "value": "3072:PY/6gT7DbU28Mn0NawZ5aMBjv+7GYNRvO1:PYND1f08wZ5Fj6GY3vO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263358, "uuid": "40b7dfb1-370a-4ede-84e9-fe1eb758f86b", "value": 211648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263358, "uuid": "3897df7c-fd59-434b-9aaa-65f8724c7e09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263358, "uuid": "aa08d847-413a-409b-b45a-2726989a4fb8", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e26b92-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "ed9a9858-96cf-4e68-b503-5aff73e2f760", "comment": "Malware payload (Mirai)", "value": "81034c4932e93dad81b0303d6f1d181e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "7db2e177-5ec7-4feb-badd-a68d9b208315", "comment": "Malware payload (Mirai)", "value": "b22e4c920695bb35526ff1173f8a8344190576228af1791d941c54ca60fc01e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "0c065710-d735-4e51-a951-64c4f1fbdca6", "comment": "Malware payload (Mirai)", "value": "4aef02ee98f4e517cff80ece28b90c2a0caab841", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263361, "uuid": "00042945-e81e-4c1e-862a-2f04173ccd44", "comment": "Malware payload (Mirai)", "value": "41a8a318a883ef92692e0c602ae57e9380948e7e700c868708c1c8401faaec94cc561fd7b6d9287bb2c9340032748ec6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "6470ee58-2391-4c42-9a0d-34339c738fe6", "value": "T1EEF31A56F9819B11C5C156BAFF0E528D73231B78E3DE72129E246B347B8A87B0E3B015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "a3393c8b-c044-406d-aadf-4c9d786febf9", "value": "3072:Oo0R0M1GwnMVyH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hLz:Oo0R0M1GwnMVW+MFwCOPtU3oaKCMl7uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263361, "uuid": "b66d4a8e-d277-439a-884b-934b873b4218", "value": 169012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263361, "uuid": "ca96b691-410c-42a2-8859-2773835fa8e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263361, "uuid": "7067418a-0185-451f-a244-7c7dcfe4c985", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562d7310-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245857, "uuid": "172ae755-d8ab-41f2-8e57-55d1470abfb2", "comment": "Malware payload (Mirai)", "value": "82d8214edb502e265eeff96c1464a7d0", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245857, "uuid": "77c81a43-06aa-4a76-9a7c-7c12ac8bf4ec", "comment": "Malware payload (Mirai)", "value": "b26587d97ae8aff4d9ab3e848ace294224c9f9e01185e89f3504eed6fc85b7a6", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245857, "uuid": "4bcfb850-59c8-4a17-8239-46845d9bded3", "comment": "Malware payload (Mirai)", "value": "cabd9ffd2c5ca1c7507dc9f4c9f579d7219465b4", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245857, "uuid": "887b86fa-80e4-400e-a65a-44ed9de6ecfb", "comment": "Malware payload (Mirai)", "value": "74809bb5837331d5ea1b3711da67d5b5ade5f585417587ace0fa227fdf1492472efe6e0f2895f11667d11ffb14f3240f", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245857, "uuid": "af88ca3c-30bb-4559-be4f-0364606f27f3", "value": "T17B342363869FD024FC703DBBE741045E3F235865E85CAA4B27A0E18A60CDDA761379DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245857, "uuid": "86b96691-df5d-4093-a259-740d21577d8c", "value": "6144:6omyuhGVZH0EzxldNa0QmfLXmERIJI4hcW/JGfs8jSvPR8z:6Yd3H0EzNVQIKERIBhcWhGU8Wmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245857, "uuid": "cd48d6df-307e-4c10-92e5-5f50fa25140e", "value": 245220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245857, "uuid": "d89c7d24-3404-4b3c-9795-4b4a22261999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245857, "uuid": "2678f00e-eee3-43e8-af1c-a84926394271", "value": "mbupload-_kb5zo9b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb01764-c156-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791271450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271450, "uuid": "c0be79a8-d8fb-45dd-806f-cb951dfaba5b", "comment": "Malware payload (Formbook)", "value": "829f222480891f1e9f734f0ffb7b0cb3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271450, "uuid": "8a87bc00-15b5-49da-ad51-ed867e3ad347", "comment": "Malware payload (Formbook)", "value": "b27ba7046e98fec6f9685cb4dec55bcde22bbe6647261191a007b33c9a5e31d2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271450, "uuid": "24b68a63-5a67-482b-895d-b0f0bdd2cfaf", "comment": "Malware payload (Formbook)", "value": "5d4e1114c0c7c464f623852c4da337023708248a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271450, "uuid": "7fd05431-be74-469d-b2af-4e55b34d3574", "comment": "Malware payload (Formbook)", "value": "6148a92278afb333932a61f1a2e1cc4682c8f7b5d08e2f07c3156dacc0adfe58718d8e891f9183e6c587baad02ac7fa3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271450, "uuid": "d361b7d1-8e27-457c-9ff7-83775c322f6d", "value": "T1286523354B6B15C9460556F9B647B4A2B9CE13C64C912A2F237DC2B132FA0ECEEB3C51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271450, "uuid": "185344d7-7bdc-4b12-9e11-7330089e3c44", "value": "24576:CrrfEFNBcUzaZ0/3hfRmXixMAXwDoHz2Vp4jbK5CXahdICF0KSuin:dFAbZYhs1UiYvB+SuSuin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271450, "uuid": "fff6feea-3b84-42be-b932-c21f259c0797", "value": 1539431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271450, "uuid": "8b4390f6-162b-471f-a41a-b28361fe7142", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271450, "uuid": "80025da7-48d7-41a2-9b3f-3bb7c4691dba", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841fb1f2-c18a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791293609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293609, "uuid": "6487fc2d-1c03-490b-a43f-e27e8f9cdef6", "comment": "Malware payload (Mirai)", "value": "cb80bb37b182c6c6d58b8b5ba12b7580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293609, "uuid": "b83748f1-ebf2-4bf9-b7ec-0c60310f6c6a", "comment": "Malware payload (Mirai)", "value": "b28bea5211b97d1c27d6cf4f73a564944779bb233008c8a3b584271dccd88d1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293609, "uuid": "cdbcb691-3485-4a49-b33e-bd9f9aeaaafe", "comment": "Malware payload (Mirai)", "value": "1fd7cb8421fcdd556f452c2e63751ad72beaca75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293609, "uuid": "74e61866-ebe1-4d82-910d-30bf0d2feec2", "comment": "Malware payload (Mirai)", "value": "379a5df86645bb130725ca6a9991cc05504501f8bcc523f69d3d9fc982b31f6fb09103604bbc7dd1b89100d591609f1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293609, "uuid": "f90a726e-3df6-4d3d-b219-56c65dc67115", "value": "T19C534C02B2180A5FF9D31AB0343F5FE187BFE9C025E0B689695ED7598635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293609, "uuid": "39b3c2e6-1f1a-40a6-be30-f2d3b277abfe", "value": "768:L9ETpVKRF4LoDfud18vSmqzQgdPfe0czC+N5XYizjrs+yRDQf/1qfgI6igs:BET6Rq1gSmQ+LzDIiEbW/ogI9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791293609, "uuid": "9e601551-5788-4c9d-90b6-798046dd3081", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791293609, "uuid": "06f0716c-432f-415d-913e-800f4d124aae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293609, "uuid": "15c5b177-db0a-4ec1-a7d2-f0c32dd9662a", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c947805-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263880, "uuid": "c363934f-51f3-448b-bd74-9f1366b7133a", "comment": "Malware payload (Mirai)", "value": "17226b77a50571eaf3a0515aef6f35c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263880, "uuid": "da988f20-2eab-49bf-81f7-b11ab72270f1", "comment": "Malware payload (Mirai)", "value": "b2cb7daa18f198bc809b674c168dc2ac16b3c0590a3c4d28c982d854ff5c709f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263880, "uuid": "6d71c29f-c0c7-4888-a33d-dd06de8a8e62", "comment": "Malware payload (Mirai)", "value": "7326b1501fa11ba53c82b065788b647715211797", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263880, "uuid": "675d672a-3a6e-4f34-8f33-f65c19667e97", "comment": "Malware payload (Mirai)", "value": "fab77fefc544bfec322794359b1dd87eab026eaf5a777c179fb61c53091eced262a4c5f3d22d987b5c66e4c9ce8c805a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263880, "uuid": "f16f40cb-83d4-4a2d-b08f-dd03e669cd01", "value": "T118044A01B646CAF3C4830FF512A75B750632E8265B2F9A49F36DBDF48E175C9B20A358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263880, "uuid": "7f1c1e61-ef99-4617-a5d5-419731f651d0", "value": "3072:qXNveUB1I27ghB3tdr2LgHqLBkOQ4ef5uDGQyVt/ZxaX5jby//OHK0lI4cHe:qXNp/IVHdrZHSBk0eRuAVtnaX5jby//s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263880, "uuid": "b07233ea-5968-45fe-a58c-466f650f8c07", "value": 189835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263880, "uuid": "47944841-c0b3-4a34-862a-cb5ea90b92ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263880, "uuid": "52157e6d-b45d-489f-80b0-c38448cd9ffa", "value": "qv3.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5d2cc4-c14d-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791267373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267373, "uuid": "5ed0fb1c-32bd-4a7a-bff1-112d252e3556", "comment": "Malware payload (PureLogsStealer)", "value": "d2a9b590d61563ef68407d1f1afaab4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267373, "uuid": "cb550090-6246-43b6-b446-6a8b5947c4d5", "comment": "Malware payload (PureLogsStealer)", "value": "b2d0acd9d080794496faa1b3d7de902b3fb78329cddfe4deda33cbabe6e79a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267373, "uuid": "27b5ecfe-8061-4f3e-b69e-274f3a286722", "comment": "Malware payload (PureLogsStealer)", "value": "3b606a9ee20401db523ed6a763a5c4e4b2845ca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267373, "uuid": "429fea0f-accd-4c84-9625-9324faa9dfa4", "comment": "Malware payload (PureLogsStealer)", "value": "9a71525b940ad19994fb5053583cc338c1d221edced58aca0569cc6aa31857a11aac4651697404d5e19970b7ff4b1bad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267373, "uuid": "54459ca3-e009-4d3b-9406-9510ba9d3d32", "value": "T17C65DE18211BDA23C65426B4C8B2D2F50374DE54E932C33F5AE9BDB77F36BB0A4541A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267373, "uuid": "471e67a9-6168-42b4-a266-ddeab0b8d95e", "value": "24576:0ws9kbe6Tab35LJ1A3TC/4DLU6EzSSvCaP6ORQBsbab:0Rebe6Tab3iDC/4DLq1IXSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791267373, "uuid": "69fcd7fb-bb6a-4cd8-b085-4f68357e3a81", "value": 1458688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791267373, "uuid": "5e912d75-8552-4541-ae88-13a9c4c87893", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267373, "uuid": "15263c0e-0857-4126-ba7a-f7d914934e86", "value": "EDO-SITKBSG2613285.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d204b042-c17c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791287726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287726, "uuid": "409acbec-7c15-4962-bdf7-31cde8becb1c", "comment": "Malware payload", "value": "75274ffd06169b41fe969b2d17f7b010", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287726, "uuid": "e409d3be-7dcb-4229-8b31-1088d379a66e", "comment": "Malware payload", "value": "b2d7e7a3dfa43d8d675c745e3996ee83c0b827780fb39b0bb7f9057d048ea1af", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287726, "uuid": "8f51f246-d67d-4ec4-a7f5-1181ff7af21e", "comment": "Malware payload", "value": "6ad70c24ff6ab0b691f947e31352f92797c189ad", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287726, "uuid": "34dfdc5f-ad4d-4a57-8529-f55b7dfc1dac", "comment": "Malware payload", "value": "1eb6714b4911e96f944c2d29f8bcaf2fab5c902d9f80e7797ef7800b9f71ec523d43295a9321b8dfc78ee8bb1979b1ae", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287726, "uuid": "f2a6b0b8-171b-4f89-910a-835705d73c96", "value": "T1455693DA3BC807E8AA688EED420675DA1AE1D17F2EBF114C52E1482B742FD1375E0D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287726, "uuid": "0f0ac4a2-1fe8-493d-90cb-b9dcdc11c00c", "value": "12288:A3t1v3fiCUT8FShN4eh6q7zzEH7q25DXblO1d9sxHN01+szWNFLzcTTMwXXTTwnm:e1vuTrbQm9sX0Tz2zcTTpTMt+HtlDfgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287726, "uuid": "33f9a5b6-fe9d-4561-b999-b4e440bc9553", "value": 6300886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287726, "uuid": "fbbb72ff-092d-462c-9e3a-54f0888ad690", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287726, "uuid": "8ed30fd4-e2e5-4979-a1b4-21ae4207a154", "value": "install.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a2b17e-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270794, "uuid": "49a134b7-ecdb-4315-b6f5-644bb592ce10", "comment": "Malware payload", "value": "e753de60fc04e28c1d091e15b0778ea3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270794, "uuid": "ad6daea3-205a-4721-8895-f23093021e1b", "comment": "Malware payload", "value": "b3375b10f1c9065705f644254ba45714fc8348f7f991c31018a43c2278497669", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270794, "uuid": "d8dd22dc-8cab-4d18-8825-7e0d5f8243c0", "comment": "Malware payload", "value": "1e17cd20751c66f10edae0675418d2f9a55b5a19", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270794, "uuid": "6e38286c-b7ac-472d-8b8b-ee9c8280461f", "comment": "Malware payload", "value": "240f491cf6ba80cd721dc750dd4536fb6112813c796edfdf2b88324701761ace9446bf51c03c3a71c290fb6042b002ba", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270794, "uuid": "cd8afbf7-3c6b-4fc8-af6f-7cf597253d7e", "value": "T18BA4239CA8D00A329E9373545D1C2F124764D61B33F9DB6BD61F3AC0DEBAC501AB42AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270794, "uuid": "f68da038-92aa-4d89-ac37-b690d35e4270", "value": "12288:GBM1eMQPioezYfcEaN9B/Jm0LU0gM7aQx:Gy1eMQaoFfclN9BhmSHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270794, "uuid": "8752a6f2-b383-4286-84f1-b4175ee9d10c", "value": 467268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270794, "uuid": "2d8d7034-396f-49a3-8a53-b56d17429ac0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270794, "uuid": "2c635262-697d-4f63-b068-c42f757ab411", "value": "b3375b10f1c9065705f644254ba45714fc8348f7f991c31018a43c2278497669.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b761c9d-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250591, "uuid": "1e73562c-2c85-4a9e-a3cb-4a9e77601c06", "comment": "Malware payload (Mirai)", "value": "6e1a535ddc01cb2333bc012428ad2a05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250591, "uuid": "b341adb1-b7af-4c56-b85c-94107f15f663", "comment": "Malware payload (Mirai)", "value": "b3976e80fc1f58e0237e4e8c6a8e03bbd9bf5a802647cc839152d595e0eb6068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250591, "uuid": "66d8884c-a335-45ec-b3b4-101590a6e839", "comment": "Malware payload (Mirai)", "value": "d70c300a58286273df3e30033199d5ea2727aee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250591, "uuid": "7a3c72fb-b3e0-400a-9de9-8535e89eb1da", "comment": "Malware payload (Mirai)", "value": "158c6d161a26106a063199f0e2a8a83e3e1df4fc24868c868bf4aa5b509ff8e76939b64cc621ee661f38096dea865e0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250591, "uuid": "42743ec4-a8a5-4044-b694-321bf06f5d21", "value": "T1F7334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250591, "uuid": "ae086061-576d-4021-8031-2a5690e0318d", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Twn:ivW3jdQGqt7Y+Z+zN9cGgI6bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250591, "uuid": "094c763d-427f-4234-b10d-e16223abab0a", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250591, "uuid": "e167165b-cce6-40e2-9197-d20e8e519c7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250591, "uuid": "b4b53d8c-de05-4d18-982d-6821ba73abfb", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866651db-c17e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791288459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288459, "uuid": "b6724044-8e53-4f86-aa2c-e34d41296e69", "comment": "Malware payload", "value": "0d9ebfc2e129a4b374efce1b120be787", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288459, "uuid": "344feb0f-1aa2-48d5-8c04-adc9e9721bfa", "comment": "Malware payload", "value": "b40241e319180026eb0d5bc8e3e8a6d975a962366a9b21b04da621bac03b7c9d", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288459, "uuid": "3ce0da91-5aab-410d-833d-1b5fd8572654", "comment": "Malware payload", "value": "dccbe6227fb4ab4085675b9efae1c88e7c5f8e85", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288459, "uuid": "d25cd597-8f4e-48bd-9aba-aae9db2d7d9f", "comment": "Malware payload", "value": "1edc118cdfc9de751cb15ca8dd941f30e99716dbd59234bcf593380b3d66cead9f1e76a2d43159566a498f554e42ccd8", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288459, "uuid": "6377adb8-d3d8-4ad2-a633-ba57a3af020c", "value": "T11435F100CE629496F48CD7342B7A9E379F207650484853EE67B52F98AD713E3F17722A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288459, "uuid": "43c93503-2a70-4cf4-bff4-c26f73943c1e", "value": "24576:5AricRkD+0IyoNaJsjNG/BW+H4szuH2MOqoP4JsvrUrl:5AG60KaJ6GQ52M84JmUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288459, "uuid": "ab94ab7f-a61c-4203-abed-011c00f72433", "value": 1068512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288459, "uuid": "5730aad8-b614-4850-8c25-e265bf2a4849", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288459, "uuid": "a323913a-5fc2-4c9d-9053-4b3e3cec9c0e", "value": "b40241e319180026eb0d5bc8e3e8a6d975a962366a9b21b04da621bac03b7c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a817650-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "de5fd417-833a-47a6-ba6f-1d029f7518f6", "comment": "Malware payload (Mirai)", "value": "a582f1d12b5f4097d23403554747e159", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "a136bd8e-f151-40f4-9bf2-a4c1230af141", "comment": "Malware payload (Mirai)", "value": "b4335ca4ea9bad4580a69c027775a3610d0d9a877f5b40fdc073d1183adf38c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "8e28b430-6877-4fb8-b7b9-360bcd235c0e", "comment": "Malware payload (Mirai)", "value": "c9945cb07b2b09ed7e63cf57915f1b461b4a2d12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263877, "uuid": "ede8239f-a879-42b9-bf30-1913a9370d70", "comment": "Malware payload (Mirai)", "value": "e83b9113438604e8203d5f76b718de6cbb0381faaaeb1cfab9e9f80ee6d0acabbe03a347c1fb53c275699a386caa9cd2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "4141006a-d1dd-4a43-9812-5d6587415c19", "value": "T12D24FA01A9104F53C5C32BBBB79F429837366B28D7EB7302EA15BFB42F4668D1E29151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "6bca6584-1cda-4605-b57e-a9fa8a1884d2", "value": "6144:LP8u1d89ag4CoB2EGjVltf9epehUdtpNbXjuWFStcXtoqV/3k:LPvPg41oHf9eRnNbXjuWFStcXtoqV/3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263877, "uuid": "48e99757-1374-42fd-9a5b-a9b868826606", "value": 221877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263877, "uuid": "a8b48d97-5e1c-4abc-86a0-771343a6a3f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263877, "uuid": "08a074c0-76f7-4330-b8c8-8c2ed9507502", "value": "qv3.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70422cfd-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270812, "uuid": "5d86533c-581d-487d-9d95-3dfeb06ba294", "comment": "Malware payload", "value": "56ba3c9333671f15e2c90e3ee7f31935", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270812, "uuid": "2e334bfa-72d1-41e7-803c-49276bc4c1c6", "comment": "Malware payload", "value": "b44046cf68927efa1083935e30c9c7e1c55d69dca42c3407b40dc91e3c4db0f4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270812, "uuid": "034cb9f4-4508-494a-a59b-b2d1d0f17a31", "comment": "Malware payload", "value": "871f31242e24783fc6c9a0b1ca6f36f1ebc5ecf9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270812, "uuid": "f6fb1f3f-a27c-4318-8741-2876fbb902fb", "comment": "Malware payload", "value": "58b861a1812d26ad4221169a271812a47f58d40ecd19766011537db78788aa14c22f51d56f40c1adfb1843dcf7f08c90", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270812, "uuid": "8aca8c36-e2b0-4fff-bff1-3cbc84406e69", "value": "T1E6B423CCB6CB88CC55A63134E6A20B4154DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270812, "uuid": "08e87e91-808a-46e0-838a-b6a6040874b7", "value": "12288:TwsK8MG1KnyC/G76u6M0gXar5qdu5ct2ien3P+be/:JKGcGmuwjRQen3PwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270812, "uuid": "6cfb6248-48a1-4451-b2c4-55807c4ae5c9", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270812, "uuid": "e3026a1c-0e18-43f4-a837-b964d51a54fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270812, "uuid": "b6f15284-97f6-40d5-8d21-efd1b61bb254", "value": "b44046cf68927efa1083935e30c9c7e1c55d69dca42c3407b40dc91e3c4db0f4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf3a573-c19c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301512, "uuid": "5bb3c3de-f126-4cc6-a780-b34aceffc287", "comment": "Malware payload", "value": "106bae70ce4409b563f75768b58f3b31", "object_relation": "md5", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301512, "uuid": "2d55ad00-3776-41d1-a012-980d8209caaa", "comment": "Malware payload", "value": "b449341fb97c5dd248f2091d92ad27d4dc32861ba5bc86deb0ccbbc627d4843e", "object_relation": "sha256", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301512, "uuid": "09fefe2d-22c8-4b7e-ae4a-73e965b85bd2", "comment": "Malware payload", "value": "41c3f27f851be32e7fd5bced683b0adc75aa23b3", "object_relation": "sha1", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301512, "uuid": "ccd25d17-1382-45a3-906e-352fd304f756", "comment": "Malware payload", "value": "3198b4da06c09ebe0e91a0b8cdcd5ab587530656a2347332dbda0533ddfaeb15d0e9f4a4f4d42ac501a1fa8c3bb04847", "object_relation": "sha3-384", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301512, "uuid": "351a0057-0fad-448a-9f8f-ee88bbeed54f", "value": "T17A06F123BD9AC428DE7744B7B1C28652262A1568BC0F907F03985D869B70D4F4B72FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301512, "uuid": "cf0cb873-a749-462d-a3c7-2fe55587ca45", "value": "98304:gwwhCbGsIVJ8S+y+zg9QOKHmimN+AIJdGLCG7kWTM5O:gP/HVtygaOMmnN+PDDGQWwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301512, "uuid": "fc756838-435b-48b9-a5e6-25bd1f4289a2", "value": 3973841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301512, "uuid": "1685aa08-d95c-4be7-b38c-e2fbf63fba63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301512, "uuid": "75ddee21-dbe1-43d6-b2cb-054766f14409", "value": "Spoon2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8da4e9-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276393, "uuid": "960ddc75-ec30-43c5-89ce-36d01d0a20bb", "comment": "Malware payload", "value": "cfee07a9812c5809d85dcf1ca495b95a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276393, "uuid": "3b4e46d7-c7cc-44d9-9c2e-f18a93104b45", "comment": "Malware payload", "value": "b46266dc97bbe195b7ccdacf5cd92b13fcbeb9100be6ee5f73cd08816a50d302", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276393, "uuid": "042e24bf-e83b-4320-b0f2-b387ae279442", "comment": "Malware payload", "value": "c0e40b135589c7caef67de6dcc0f95107c036141", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276393, "uuid": "ad0541b0-af64-4d93-ace0-e19381563ace", "comment": "Malware payload", "value": "68486eb4727fec817e893377efd26867967a488b1bdd72aef337e082ee802a390af1ef63a6ea54477c10fbb5929101c5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276393, "uuid": "baac2353-5afc-4745-8d94-cc8b005c4a9c", "value": "T199A4239581B987533484E3B5497B1AEA5F301CF28D3D674F88DAC5F80B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276393, "uuid": "79588af7-2f4b-4143-a862-87b630773fb7", "value": "12288:XcRSCDe0U+m1V6ECbniSPfS3e2R3feeintFckM:qDe0wUTiSWzeeiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276393, "uuid": "a6f3ca5c-f77b-49d2-882c-d82cb19fc1f5", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276393, "uuid": "f2bdb783-55b1-499b-9273-237b81b85319", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276393, "uuid": "12501d87-bce2-421e-bb5d-250c8286fd45", "value": "b46266dc97bbe195b7ccdacf5cd92b13fcbeb9100be6ee5f73cd08816a50d302.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7ae096-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275830, "uuid": "e88b1ebb-f22e-49bc-847c-a98f14647f0d", "comment": "Malware payload", "value": "e71c9497151f4667901e9e602f269ab6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275830, "uuid": "ac7a142e-8a71-4ddb-948f-abff070039a5", "comment": "Malware payload", "value": "b465aa3e3ff35d9b99af6d60c2141fb1687174cd093da5593c80ac28c867a0c2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275830, "uuid": "1c7ad644-8ba7-4f4b-b42c-8fa3c61a637c", "comment": "Malware payload", "value": "403df47db2d374db5b74c8f504a00aa76d9a9d4b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275830, "uuid": "bc6bbf71-0265-43a4-a352-ed725ccee462", "comment": "Malware payload", "value": "021913788253c08025e3ae8dc6bb1ba851682c6d918f037fcfe0cf1800011312f149cb9eca2e81b3d2731d313f136bc4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275830, "uuid": "1027252c-6c2e-4d05-b563-615c852de1a4", "value": "T1B3B42369227F71900C7543A94B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB195638E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275830, "uuid": "a819ab27-e01a-4463-b2ad-eb81e7d8121e", "value": "12288:s7JZAaFpeXqO3g/ALyYG0ZaDajTCXMO8xzDOe3WU:oLpebA/f0Za6TCXKBxmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275830, "uuid": "6d6f1b90-a1d5-495e-a1e6-3d9c2595720e", "value": 542164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275830, "uuid": "8e034dc0-1561-42bd-97e7-d3524769fa46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275830, "uuid": "5c3da387-a82c-47b0-9f10-4e7f605af333", "value": "b465aa3e3ff35d9b99af6d60c2141fb1687174cd093da5593c80ac28c867a0c2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7fe31c-c1aa-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791307283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307283, "uuid": "992e3c98-ca56-4514-bd49-f95713901f18", "comment": "Malware payload (Mirai)", "value": "87a1b6b06b2e1357e8b3b7d1ce2176a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307283, "uuid": "009c8abe-e7cc-4021-b2fe-8f43aa117c1f", "comment": "Malware payload (Mirai)", "value": "b4991411975fbe9a19516114f5ad0c3dd897d3f998cf741db4661a09ba624cc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307283, "uuid": "aaac3f4d-b83e-4c9b-8e30-4bf5baaebe92", "comment": "Malware payload (Mirai)", "value": "dce60f65a05a25716335af97552ab5d0aac5ac66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307283, "uuid": "cb901622-44bf-4d4f-8e31-b4d559235243", "comment": "Malware payload (Mirai)", "value": "9d37c7999beac7334fdcbcdbf0ae5615310b99d1ed5cc59a92b414cf47d6d41aa7f6c983bf8b40602110a470bbce6d99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307283, "uuid": "d2c2a76e-ac10-4155-b7a0-c57869719dda", "value": "T117F45C5DFD1E3C41E3DBF278DB4E83E1A22FB1A0D32391A23982135CD5C69A9CAB0555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307283, "uuid": "9ab3e3b7-b93f-4984-aba3-1ff2aa12e688", "value": "12288:KQzbvCIHRELHg30G1OjhVRGcPRNQLgJIQPAHuzptw5QotyIY:/fABSOjhTGEDQGIYzpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791307283, "uuid": "cd4baeba-b550-4bd2-bbcd-83d4b04f053e", "value": 795064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791307283, "uuid": "4b7b5aa4-69c3-4271-9945-f0ae4b9fb2fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307283, "uuid": "885d0cd2-f480-47fe-ab6c-b9bf4909efc4", "value": "sarm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a689aa57-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303115, "uuid": "c73e7830-3100-4f8d-bc19-70954ade8d22", "comment": "Malware payload (Mirai)", "value": "57fb22304564500e34a403f9eba40345", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303115, "uuid": "c2b0157d-e477-4b13-94bc-a7ca0c2ef47d", "comment": "Malware payload (Mirai)", "value": "b4ae86de813acefbdeac8794336a72da081e68b8004a68be0ec3aa258d86d76a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303115, "uuid": "27dfada6-0f65-477f-bca3-8db504d38736", "comment": "Malware payload (Mirai)", "value": "1ac4b5f8e86356684eb4b1d11a4a801f1e8577cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303115, "uuid": "2847d7f3-70ee-4619-bcfa-2d24aba071d8", "comment": "Malware payload (Mirai)", "value": "199db90ad74daa1aae10bb72ae800c807dab9dbcd734c5e2ffda6b637d6459f2adb64c4554e67887f94a48b7a26face6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303115, "uuid": "5617a3fc-5ab9-49e4-a90e-0a19df325b5c", "value": "T1AA044A03A5D294FEC19AC87087AFD536E931349802357A2F6BD8AF312E35E71272E751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303115, "uuid": "9339d5ee-4a19-4b4e-a0b3-783cdd5fe456", "value": "3072:65Prls/UIm/P3VKXZvXi/DuT1nxy7aeO/k+frX9R9MvvpPj+8:QPry/DOP34XISZx6ck+rX9R9wj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303115, "uuid": "5336c345-0d5a-4065-bff3-fbe7dfbc4b48", "value": 181568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303115, "uuid": "3c11ec71-631c-42be-976a-ef9ac46c4a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303115, "uuid": "3bfb17c1-1631-4a3f-b681-dd071e62f810", "value": "flutter.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3186491-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273984, "uuid": "67d98bed-2316-4518-81dd-ca1271367e97", "comment": "Malware payload", "value": "013b28c26e274ffa2da087f8b553dcbd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273984, "uuid": "4c3f2176-0897-43d4-bd89-f118c73776b7", "comment": "Malware payload", "value": "b4c2346f58bb970bf94529dca9f54004911a1ce1c60b920bf2972071af2af130", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273984, "uuid": "e12286a7-8361-48cc-9c64-2b6ccd66b2d8", "comment": "Malware payload", "value": "b847cd768d90d6165fb6686eefc72c89615e4fe4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273984, "uuid": "c3a0c89e-fe78-4da6-bcf4-d705e480a227", "comment": "Malware payload", "value": "2211f3da3b97116569981363ad5e2cfe2ff7e45b57cfe1213fd4a3511313fee9f42ed705122fe36609d7bf6bc89b00c2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273984, "uuid": "8c4055f0-7ea5-42f4-a31a-19162f77c3ae", "value": "T13EC423B7179AB4897503E3E4814C7D9489AF20D957C3436ECA1E2693F5BE147FB2009E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273984, "uuid": "8e2c2b37-a8ed-43e6-8adf-e97641fe0aed", "value": "12288:IeElNtIBB2gX3U5FA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9N3ezw:IeSIBBfHvm6Jj6ESfUxZ91kmY/9Hek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273984, "uuid": "6e492b08-77ff-409b-95ec-4bdd8a8819c2", "value": 584435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273984, "uuid": "ccff21e3-8f2a-40ac-803c-f945918968b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273984, "uuid": "8dc98e1d-a852-4a12-b6d1-7ef06885f136", "value": "b4c2346f58bb970bf94529dca9f54004911a1ce1c60b920bf2972071af2af130.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d0df95-c1ab-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791307889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307889, "uuid": "ede52d0d-daf2-49f6-a61f-97ee5e9231c3", "comment": "Malware payload (Mirai)", "value": "507a2810525984cec33ff8a91449215c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307889, "uuid": "d4f558e9-7fa9-4dc0-ba21-610fd56b3d5f", "comment": "Malware payload (Mirai)", "value": "b4e2a808f57fc407bc2c7b7d3c6c42ca0e358d23bc6c6d4b49865ba3abd2d237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307889, "uuid": "cd491341-cbd7-40e1-8ccb-3bbe30b5e055", "comment": "Malware payload (Mirai)", "value": "efcb4fbb0332ded86eead25360c0ca1f40e8fb2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307889, "uuid": "73a43b5b-3ecf-4f54-9fe9-d9d5ec7da131", "comment": "Malware payload (Mirai)", "value": "547384cc30f575f20b359775a8d93696272a3add638b46bc34c096f6d78b8eca9e49cb81d138f493cd60f8017fc6f128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307889, "uuid": "b9de9ce8-7507-4bde-b8a6-351a2d8b8b6b", "value": "T130C419B6FD41D991C5D42ABEFB5EC2C833030378C3EA71429D06872569DF69A0E3DA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307889, "uuid": "d7f7a303-60ae-47a1-b9f6-728f17285e74", "value": "12288:POLJgVOjod6dwm82UX0+w7kzRcvouBktpW6k0a0GpRV9vsYE:qsEsOYk0Es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791307889, "uuid": "501b8000-b312-40de-95fa-0dc9768e6eff", "value": 580028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791307889, "uuid": "0734aec6-491f-4626-baef-2a56e5eb0463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307889, "uuid": "4b5e133d-d110-4595-8e74-8b5a3065953b", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4f2915-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273728, "uuid": "d2fed87a-1874-4030-906e-ec656bcafa7f", "comment": "Malware payload", "value": "f7c3dc586f6339932a6d2503eb6c4a9e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273728, "uuid": "76ea887f-2f2c-46ea-ba8d-29f35c04ce9f", "comment": "Malware payload", "value": "b521b48cd964a8e6588e697779a8ec48536ce1ffdfdef65bbb9423b1843d22b5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273728, "uuid": "cde9efd3-422c-4749-857b-d61473c7cb85", "comment": "Malware payload", "value": "96ab683710bcb0243c1f8ed63c5ff000737de99a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273728, "uuid": "95af02ac-5297-4e99-9b3a-989b1b54bd21", "comment": "Malware payload", "value": "ca8cbaf14582321e8746f7524850cec77c01e7c8785bd7fe16015540f237f270907dd920a56698ccb7636e655fb99684", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273728, "uuid": "19ece13d-c2af-4bde-b17f-8027775cd2fc", "value": "T173A42397E39996EC88C47ABB8B2C0D08B27CE7745CCF06A8537E5335D1688A29E0751D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273728, "uuid": "a5559420-8300-4709-8a93-e89a6a17f3d9", "value": "12288:WsS5lyFd6y+6sVXkvgSe5yMqr++rVOje+yH58:WsgxT6sSvPTy+6eTH58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273728, "uuid": "5611e525-bc2a-42b7-81ed-d311618b3d4e", "value": 492541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273728, "uuid": "80a943b2-31ab-4da9-a899-58c67ff03815", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273728, "uuid": "5fdddbfc-dd4d-425a-bbeb-b8afc5793fcd", "value": "b521b48cd964a8e6588e697779a8ec48536ce1ffdfdef65bbb9423b1843d22b5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287c8bbe-c14e-11f1-927a-4201ac107004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1791267685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267685, "uuid": "d24db3eb-5b8b-4a7e-ba3d-50a17a104472", "comment": "Malware payload (VIPKeylogger)", "value": "0ad58a1ac04a1a4ecf0d14a9b8bef452", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267685, "uuid": "6154f16d-1fab-4188-87b0-b89b9230d5de", "comment": "Malware payload (VIPKeylogger)", "value": "b53b72efedbbb276791bddd1693c48124e47a809c7f4594d224b3575ffc3d251", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267685, "uuid": "5d5719de-2309-40ed-9fe6-07698652fe3a", "comment": "Malware payload (VIPKeylogger)", "value": "580da7bf00cea3f1c8e8c34123fa90035c05946d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267685, "uuid": "87b243d1-5e1d-4708-a97a-dcbc4f56c0d2", "comment": "Malware payload (VIPKeylogger)", "value": "9ff76377f07d3f8b9017b3803b0e34af11ce45596c7244fd22b0b6d9101e9d8eb32fd321031b37a9f9c439ce10ae5f0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267685, "uuid": "a5235925-895b-447b-88ca-00a5893b45b0", "value": "T1AFB22F44099178845333ABBFAB1B98E8FB7B056B01948407786CB851AFF2D1CDEE4DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267685, "uuid": "a277026f-5482-4d34-be49-8583d08c21fc", "value": "768:PQ6/6RylvbRYXO1fl1HYwtpwwVeraTP7idghCPxm7utjf1MPjXvcUsarQCP0sQWg:IqVZ2cNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791267685, "uuid": "a7bb4a26-cb1e-4182-bafd-b307d465f29f", "value": 25705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791267685, "uuid": "8f5de790-3d47-41e4-ae6f-71035fac7bd0", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267685, "uuid": "df552036-a249-4dba-96f7-953d07150189", "value": "QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686c833d-c190-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791296139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296139, "uuid": "4c94d24a-78de-4d74-bb82-865f5e77d911", "comment": "Malware payload (Mirai)", "value": "bbf2186a68c1423831b74430ee3f6b00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296139, "uuid": "0e882360-cd22-4097-a4ca-6cc6b7e752f1", "comment": "Malware payload (Mirai)", "value": "b56202aaf5bb6377f19b7311a5af2156107352721145286fa934c1c66b9a5ba1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296139, "uuid": "96c0d84a-9c8e-473c-a111-0b5b9d393e5c", "comment": "Malware payload (Mirai)", "value": "3c93990a85f6517c6d833e309ed5fdef899ea152", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296139, "uuid": "71101870-4089-45c6-8327-c6240cb6dacf", "comment": "Malware payload (Mirai)", "value": "5a7acf5d623cfe9833f4c82d34f52107df2fb9b13a5a23dfaf796aa432efa7c823fddc6a6f3758eeae7d77f438f2cc56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296139, "uuid": "15202c0d-c60a-45bf-b479-ae91cd5fd140", "value": "T1CC144C02770D4B43D1571DF02AF717F183A7A9112AE7E644F60EFE886772E71A40AB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296139, "uuid": "4da5b5aa-2e92-4473-b151-0b5d828d032c", "value": "6144:DCJyNExgrMJOm1G84zh/Befd6IXUtj/3EXPtlr4uvk:DP5eG84pBeV6IXUtj/3EXPtlr4uvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791296139, "uuid": "d0b20cfc-8eee-4eb1-a057-9872e2039050", "value": 208751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791296139, "uuid": "3f915d4a-3674-42ad-a502-287f99fdaaae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296139, "uuid": "ce71f05b-7a0a-401e-84c6-835bd86ecfbc", "value": "qv3.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44ab345-c13d-11f1-927a-4201ac107004", "comment": "Malware payload (GuLoader)", "timestamp": 1791260591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791260591, "uuid": "bdcf3620-7619-4873-a5fd-5c02eda68b32", "comment": "Malware payload (GuLoader)", "value": "639cc3baaf196ded25be97e755cb9b7a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791260591, "uuid": "f1b2de14-1a14-46f6-9136-4f82ed00055e", "comment": "Malware payload (GuLoader)", "value": "b6372c69f32a81e9a73134d72f0c907ff62ac19410b0dab70aab3b317305cbd4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791260591, "uuid": "1e1ffa1e-4bfd-448b-8ef4-bc94a9b8c6d4", "comment": "Malware payload (GuLoader)", "value": "9b27e8b4a5667fce676c4fdfea099348d1625c34", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791260591, "uuid": "6f6e03bb-aebd-4ffd-8b64-b5b4d30d62bb", "comment": "Malware payload (GuLoader)", "value": "6b41fb41c39e869d80f1f6f61f1a9e8db5c16c8291f39a42d6a83342d67f4e0063d07b15fb7d6757be472aa5f5f9b0cd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791260591, "uuid": "6f911732-b725-4749-8b83-c5666f040270", "value": "T14D635D20EE2405594F5717EAFCDD0B22DA7D8215A22654B0FEFE670D700369CE3BE269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791260591, "uuid": "67c02dc8-60ef-4ad7-a18c-9a4fd22b6419", "value": "1536:JGrLKJHIpY7cwZQAYFB7YLBd88lpe32dEwPDN1:5opY7cwZQtMLQae32dEwPDN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791260591, "uuid": "907bc397-33cf-4bdf-bf79-57b4a8eaa73b", "value": 66965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791260591, "uuid": "b072f6dc-a74b-4592-a354-be256a819d9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791260591, "uuid": "6dda1eae-8189-4e65-a6d1-a4dd4739c7ac", "value": "PO SGN260529193TONG HONG TANNERY (VIETNAM) .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39b4631-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288588, "uuid": "28a33c65-e4bc-4e51-86b4-7c5a516c5cb4", "comment": "Malware payload (Mirai)", "value": "a4d0bffde403081dd5369425fc2b5423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288588, "uuid": "58442157-a622-42ad-b488-5b695aa462ed", "comment": "Malware payload (Mirai)", "value": "b63e2ab8f532a60e9d6dc0aa9017dea49c68eb1828e0e0fa6b6602449737bfa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288588, "uuid": "fcb89112-94b2-4a10-824d-1e49b66b36cd", "comment": "Malware payload (Mirai)", "value": "141a1468076e783e16ed99c54b4fd4447a7a107f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288588, "uuid": "bc2f2dc0-da7e-459e-abc2-5427f8656fc0", "comment": "Malware payload (Mirai)", "value": "f54b1d4dfb7d776922fc2faaaf07234b958db1e3c89ff509983a34dfd5fc60285080c737cde81e71ff01eb2daaa28839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288588, "uuid": "b95a914e-c165-44bb-800c-645023d9245b", "value": "T155D46D0769F084BEC8D6C0744B8B933A9D62F08A2179F58FEBC66E817E19E90771D351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288588, "uuid": "cf8a64a4-1174-48db-a2f5-ee96bd736726", "value": "6144:c5l/dVvXffgKCThszVppYiHlcs9LI7Tq9x+rOwiW4qp7X3BZkeQc1ZJNAXaHOIWF:aVvc6ps0UiWvp751Z7lW/ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288588, "uuid": "607a3e15-0a1c-4bf9-a349-cb6bb88547f1", "value": 625224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288588, "uuid": "8052cb0f-4e3c-4b9c-b2c6-780743ba0be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288588, "uuid": "f4105615-e683-42a7-850d-fd8f51a847c3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ee58ad-c192-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791296860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296860, "uuid": "a9a5bd6f-1da9-4189-a7f7-6bac279f9ac2", "comment": "Malware payload (Gafgyt)", "value": "4f9c91192dc8b3f18e974bb4264f47a6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296860, "uuid": "e4b29d96-8b07-4b9b-a43d-9ae700cf6f7d", "comment": "Malware payload (Gafgyt)", "value": "b694d9c69417fe8514f2ab80e7f73af18e0653ca774e4eb14c74a3775d69cc4a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296860, "uuid": "df3eae5b-f49f-4855-a49b-af6c7a12a315", "comment": "Malware payload (Gafgyt)", "value": "5bdd2e936efc3eb802f46944d032db8fec282172", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791296860, "uuid": "22589595-d42b-46fe-ad82-1a95a90f038b", "comment": "Malware payload (Gafgyt)", "value": "b64113e61acf297e014b64f314bcc3bf7d64c5b618f8adcd91fbc44dd53bad35b326858d2bcfb74522451c306683042d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296860, "uuid": "badd8480-f933-43c1-8a8d-a1e4455da2a9", "value": "T148E1D6DB229719716DE0F81B72BA480470D5A19F40F66F856EEC38F891CDD8CE4A0AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296860, "uuid": "3d84e166-b46f-4a64-87d7-8b2994850709", "value": "96:G9VQstFrZhVoKxJpiWKyKEWl8fNtgaWKxS/FTl81ciKxc4ECl89:D3DBl8gP7Tl81hnCl89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791296860, "uuid": "aad4c844-7b76-4ca4-97a6-5a92dd1c8121", "value": 7363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791296860, "uuid": "b8dcee79-bf91-4619-8f5a-0fd172af883f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791296860, "uuid": "efed7fa5-21f3-42ac-a51c-096d6ced50ee", "value": "handshakebins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fe2e9f-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290773, "uuid": "96c8da0c-689c-401c-afcf-3f70a19d7375", "comment": "Malware payload (Mirai)", "value": "245ce0b84b190047eb75f4b1b61d4eaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290773, "uuid": "08567279-3e7d-4fda-b818-2e0758ad1c2e", "comment": "Malware payload (Mirai)", "value": "b6961a5baf69a78a24d3505d1aac2d04a4dde8a27a40bc6b1d0171a79c12b51c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290773, "uuid": "20e92356-7088-4537-8a1d-7f9dd86b3742", "comment": "Malware payload (Mirai)", "value": "d8aa1f5b7e32e8442c23d6c47c0fa0db2db9adf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290773, "uuid": "c19c06f0-fb4e-431b-a458-edf103e69757", "comment": "Malware payload (Mirai)", "value": "2b69e9061ec8fc33aed5b3061d6fbd0cf66c911871bc88a239a0319c49991e64f632dd858957b27f855cc91d18bb4a39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290773, "uuid": "a01fdc5c-0888-4da1-abd7-d36e1e09d004", "value": "T164D47E8BBA90DDBEFC96D33644130A255020F2A251E29B2FE15F7DA4DB2D1D02539BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290773, "uuid": "350cfce1-7dbb-4e07-bbdd-f6920e9dc4c7", "value": "6144:euV5cIezMmmq/zwXWJly5gugIFrRM8W0FAlT7bg9PYyNMftOtbiPlhLLSKqVLKdU:nFezVmKZJM+ufF+8qwZi6KqV2de1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290773, "uuid": "a9b39d60-7fe9-4f97-ae9f-ead0ab5246cc", "value": 612244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290773, "uuid": "0495f363-828c-490d-975b-17eb6bb54064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290773, "uuid": "52b9ccb9-fd7b-46fe-81cc-e46493d199cc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a318df-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271229, "uuid": "eba6d53e-b147-45a9-a1da-f93b02495634", "comment": "Malware payload", "value": "5a18e2056fbe5701bd02874e317d2f4b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271229, "uuid": "bdf48e6c-701a-4053-906a-c925c2d1b208", "comment": "Malware payload", "value": "b75b053ae45c6d8f06bc44613fdfe7f2b9bb5555a80400791e059f5f55161c63", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271229, "uuid": "2c413130-db8d-4c7f-b82d-c7efe0b4f305", "comment": "Malware payload", "value": "e30b17da1fcb9bddf3772b9d1c560cd6607728f6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271229, "uuid": "1660c83a-93c2-4d91-874f-dbd0dc431bac", "comment": "Malware payload", "value": "73f38a14ea133fca1845ec3a487399107c9639421937e72be58e940e6fc5bd0bb2817824402b1a438bbe3c0ca89918c5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271229, "uuid": "385a1717-8f0b-4271-bfda-a4913e98d010", "value": "T186A4236D922554376D67B9D0AD1D2B020A70D18932DDDBD5CE0F38A08EFAC9C1FC61AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271229, "uuid": "2deeab4a-b98e-44b7-86e2-686d54b759da", "value": "12288:8W+GusvMa+EzYfcEaN9B/Jm0LU0gM7aQm:8WF/vMaQfclN9BhmSHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271229, "uuid": "67858749-8e36-4c53-a6ff-d89ad6784383", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271229, "uuid": "43401d0e-30a9-4d0c-85dd-b6fafdfbb477", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271229, "uuid": "f7b0c111-e291-4503-836a-b5c3bf37eef6", "value": "b75b053ae45c6d8f06bc44613fdfe7f2b9bb5555a80400791e059f5f55161c63.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446d988a-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276322, "uuid": "893c9077-213e-4e0f-8526-9f12e28d16ca", "comment": "Malware payload", "value": "95b239b1a4ffdf12a732aded13dfef2a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276322, "uuid": "e51d3d84-efbd-418e-9a56-b2ec006f4a42", "comment": "Malware payload", "value": "b7c66bc19986e27802b65ad7cfedb10b99a2561222b27f4ce5659aaf1d789d6b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276322, "uuid": "d42a1c73-e882-42c6-91ae-da621cd8cc6d", "comment": "Malware payload", "value": "8fdcf0e858f120167d65a022a4623503e06d5750", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276322, "uuid": "a7e0cd89-4165-443a-8f44-845f332d1b64", "comment": "Malware payload", "value": "ffa2f4ace10f90188592735b8afb28fbd85efc31e6cc0de57d45d0187c9aafba07aa74438a6b10053403fd23ea07f570", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276322, "uuid": "0c317737-4e49-4596-b228-6c3cfb709152", "value": "T1C4B4235A2EAD7BE7CD91A09411E132682C1A89D8CB77EB059C5842F20477B14FE5F28F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276322, "uuid": "6371f42d-b0ee-47ba-9956-7cb0dff13325", "value": "12288:2yl/3BItd+3+JViRziobl9jcr91+rTY3rkCMuvq39jP6Fe952/mC5o:t1+tdb0RLbl2rKY3ICAJPF9YXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276322, "uuid": "939d9d6b-ddb0-4bc6-adcd-698215ab7ca6", "value": 531063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276322, "uuid": "7e553620-8dd7-479b-84ad-717f2d907f9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276322, "uuid": "03e14d70-3e35-4522-b256-faad146ae5fc", "value": "b7c66bc19986e27802b65ad7cfedb10b99a2561222b27f4ce5659aaf1d789d6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffb58f8-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274516, "uuid": "f43b602a-11d2-4f29-a15d-8320b4a1c0c8", "comment": "Malware payload", "value": "8e61d710afe50047d91a21f501b9aa9d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274516, "uuid": "dc39401d-699e-4846-9ef3-421987b71dae", "comment": "Malware payload", "value": "b7f770412e0d10a77527bffc6031d245a824139a649833ab8f7dddb62abbcac3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274516, "uuid": "bba83e73-8571-4a28-89d1-7e9fccc2585d", "comment": "Malware payload", "value": "2b7d034386c6f9dd98d0da77f31c545ac2f9367b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274516, "uuid": "676efdad-682d-4dd4-9902-7ea495879022", "comment": "Malware payload", "value": "ca821977a6f390b9bb717012ad085f9a51f684ec46c9e71793490fb5a23d46a2f856f617c5b53bc6857bca8508792e3e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274516, "uuid": "647a9970-a213-4ab7-b624-df7f051e8432", "value": "T1E8C423052521C0CEC3891F3E5BC0AAD06DF6509B9B48F5843BDFF91D79C0AA536E9B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274516, "uuid": "d0ea2983-2701-4af8-9505-33cfaaa0ac6d", "value": "12288:H+CGvJAevoAVcA+6wlOMWROC/FTeHo22Qm7NzofOr/mShA:JWJR9cAG4MQOC/gHozN7NzomLmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274516, "uuid": "03c77425-3d35-4cdd-9126-853e9fac676c", "value": 584667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274516, "uuid": "d4b8b3e2-040d-46b7-be4d-5f8705e2175b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274516, "uuid": "5e368ac2-55c0-4235-a263-c99ecf8bca8a", "value": "b7f770412e0d10a77527bffc6031d245a824139a649833ab8f7dddb62abbcac3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0804a994-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271496, "uuid": "594d32d7-57d6-4ccb-a14c-06ed1b8f49cd", "comment": "Malware payload", "value": "ebe632d4204569eff659d292fc761283", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271496, "uuid": "3c6e6311-0e18-4c5c-9c0b-981abcd21ece", "comment": "Malware payload", "value": "b8133e621be2e1e8e8953156871fa825cb9cf37e4a02fb70eb28927004e2afb0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271496, "uuid": "c2c074f7-6e7d-4c9c-a273-448acb76d898", "comment": "Malware payload", "value": "a76310c34a44a0078784d33ac0b0c899b1b76f45", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271496, "uuid": "9d926900-90dc-48b2-a8de-422ebbd4da5e", "comment": "Malware payload", "value": "f12a189d396619944705578e3234faabb3fc95a39cda1cddf890cfb131ba3e017acb910e832fb63a2ac3b31b9a366bca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271496, "uuid": "85d9f825-08f5-4a9e-b529-496006883f22", "value": "T194B42369227F71500C7543A94B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB199638E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271496, "uuid": "6c22206b-180f-4d33-b181-6ca7a81cfd62", "value": "12288:A7JZAaFpeLqO3g/ALyYG0ZaDajTCXMO8xzDOe3Wk:cLpePA/f0Za6TCXKBxmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271496, "uuid": "c89abaae-fe86-4302-86d5-6b9dd339dd6a", "value": 542164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271496, "uuid": "39fa3a1c-02d3-47db-a241-02a52b6329cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271496, "uuid": "956026ef-286f-42ad-a013-c8ad4601d50b", "value": "b8133e621be2e1e8e8953156871fa825cb9cf37e4a02fb70eb28927004e2afb0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16edce6f-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276246, "uuid": "316d913d-70a0-40a6-92c5-39aa2420b120", "comment": "Malware payload", "value": "6cf2363898b1410c68236e44402a0195", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276246, "uuid": "3b712af3-0a5e-4b75-b2d5-fb4e518ed9b6", "comment": "Malware payload", "value": "b827729f239bea7cb9f44280524efda7c34c778a13939e53ee1f840afe67e990", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276246, "uuid": "9e9388de-fb13-40b6-9ee3-88578b12ae0f", "comment": "Malware payload", "value": "89b9116c175e7d0a261df62793dfc7ab97b327c8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276246, "uuid": "ed5cac67-1118-4fe1-8cff-463fd796a762", "comment": "Malware payload", "value": "bd49ae119c37a4738b5dbda3e6869377e724012079480f59c6719650df8502f6da1e3eefbf9db305c22fd8c24f728c49", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276246, "uuid": "384c43b4-f645-4f67-845f-e9d5ac79b1a5", "value": "T18CC42304340641D5835A2B1EAEC4E7E0BEB560DBFA1CF940AADD7ED06DE92A173C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276246, "uuid": "76b4d9d5-e481-41e1-b270-a9267b5f7a37", "value": "12288:j6wlOMWROC/FTeHo22Qm7NzofOr68mDeA924EwCV:b4MQOC/gHozN7NzomW8hA9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276246, "uuid": "2f3c38e4-ae38-4cc6-a611-e0535fa1a890", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276246, "uuid": "37774e5f-d259-4de9-a8e0-22549b409dc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276246, "uuid": "7b1e0685-84f3-4497-b0a5-0d5f9742ce0f", "value": "b827729f239bea7cb9f44280524efda7c34c778a13939e53ee1f840afe67e990.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e87804-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275568, "uuid": "761c9677-bf3e-4fba-8048-84647bcf5350", "comment": "Malware payload", "value": "a93bddd68626af810eea69899d2a4ace", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275568, "uuid": "62fa3d39-09aa-4e39-9152-aece44c00f5f", "comment": "Malware payload", "value": "b8295a7309fb7662f8d2283f8aae7de33430d540ee3bcffd6a4b66ecca3fd11d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275568, "uuid": "018ff325-1f44-4c74-8c74-f5d1fede1a70", "comment": "Malware payload", "value": "21157e9ee70f9bc81d0810eec44b427a98ebedef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275568, "uuid": "38160350-c1f9-49cb-bdd6-6b306c8aba82", "comment": "Malware payload", "value": "4a6fe9e6ee264b32459fc7da085e9cb921800fee7822e003573fc7ee54b4686f0cc1dd23a8f57dd6131c178441481d90", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275568, "uuid": "bdcf557b-89a5-4ab8-9d73-284db8a2cc3f", "value": "T188C4231DA0547B51F64B6A78B323CDB08B69D03FD219C388A0840B399B5BE5B69CD376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275568, "uuid": "c0ae7e72-c98e-4740-b75f-1294f5cd0b23", "value": "12288:GMU+0xq75aS9iYIp6cP/G2Bku6zXLTHXP427bO:2+J71vI/GzX3ftHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275568, "uuid": "206db22f-c998-440f-b218-81b465e08cc9", "value": 587431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275568, "uuid": "0fe089d1-0898-49a7-ae6a-e59074d2e91e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275568, "uuid": "7b971557-46d6-4fe4-bef6-83780fd28e18", "value": "b8295a7309fb7662f8d2283f8aae7de33430d540ee3bcffd6a4b66ecca3fd11d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e7a364-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272704, "uuid": "5bfcc320-afe6-4e05-9ef3-3e8390a78e4d", "comment": "Malware payload", "value": "685fc9bda4b28d8555da87d460a38519", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272704, "uuid": "05d1e040-f0cb-4854-8d2f-9f146c2761ae", "comment": "Malware payload", "value": "b8cae249d24f33a9a9445b93c4b1d8e0b33406fec5953beee43f39a8d192b3e6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272704, "uuid": "b6c3aad4-0723-47d7-a544-a7041b2a84d6", "comment": "Malware payload", "value": "91fd4ece8d0cc651af26f5a2513ff8391672ce75", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272704, "uuid": "21bb219e-95dc-43d6-86ac-061a0ed6db73", "comment": "Malware payload", "value": "f54259b4839f9a71344cf21c7b533296243aa5372488e9dd049abdda1f5cd0c36e7cf8e71fa9a979778ff68edf30ac51", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272704, "uuid": "ade154cc-4bd3-4b76-85bf-9d7eebd2b2aa", "value": "T1CBC42304340641D5835A2B1EAEC4F6E0BEB5A0DBFA1CF940AADD7ED06DE92A177C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272704, "uuid": "ad1b84eb-f471-4e3e-aa15-21c0d4338ad1", "value": "12288:j6wlOMWROC/FTeHo22Qm7NzofOr68mteA924EwC7:b4MQOC/gHozN7NzomW8bA90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272704, "uuid": "8411e9e9-7a48-4805-b3c8-2ae249b5d32c", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272704, "uuid": "0c783c52-b75a-4887-970e-b59dcd43a3e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272704, "uuid": "b2220c2f-ca12-4254-abc4-f3bf495ab90b", "value": "b8cae249d24f33a9a9445b93c4b1d8e0b33406fec5953beee43f39a8d192b3e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdd54f0-c196-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791298695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298695, "uuid": "a45006ae-3ffa-499e-8fc2-57cbb9a26009", "comment": "Malware payload", "value": "a824398b7923e0945551b06f47c400ed", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298695, "uuid": "457f9df6-f6a5-4d30-96d9-d4bb1fee8cd6", "comment": "Malware payload", "value": "b94b0462a88c7f7f45e8ab7c4b4bdaeb54ac646a1720b89bdcaf580074a4a54a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298695, "uuid": "f2e26646-d83a-4ff5-89b2-6294384bf257", "comment": "Malware payload", "value": "71e0a4750018bd6b367b18b16e8fea0bf1e96e15", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298695, "uuid": "7996f0f7-4194-4bf8-91fc-1a1b280bff62", "comment": "Malware payload", "value": "fd418e16622da4099ebc9607a0f0ce2d23ec4587d8f555062cfba598182d54eecc8fd82e8e3e64f057a4b55f0debd55f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298695, "uuid": "a9853a91-7858-4f1c-af49-802b56d96a07", "value": "T1DA067C07ECA118F9D0AAA23189769152BF317C481F3163DB3A50B7B82F76BD06DB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298695, "uuid": "d49cf5ef-bcd5-4937-b4d9-76e127d4dbb9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298695, "uuid": "04e4a87e-2f3b-4e4b-8792-a841f4e08c46", "value": "49152:FS+0EccQfLJMD9rvekmrasDquVNhdBjs7RuA+Nv52Zrn1T3K:FluesBVssRNvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298695, "uuid": "f11cd41c-1b8e-4e64-98ec-3cd443dec16c", "value": 3972880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298695, "uuid": "930b6afc-cbba-47b7-bf82-356fe52e6a81", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298695, "uuid": "90bc41ae-33de-4253-85f2-6ae329781c73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89065a3-c153-11f1-927a-4201ac107004", "comment": "Malware payload (MilleniumRAT)", "timestamp": 1791270155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270155, "uuid": "e29ac9ca-5982-4ee3-9710-4411cd19683e", "comment": "Malware payload (MilleniumRAT)", "value": "cb345182c2482cb19834f6e0bfc0322c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270155, "uuid": "625e9543-b9da-4051-a296-0c65f26c1ac8", "comment": "Malware payload (MilleniumRAT)", "value": "b975fc15637a72cb3452655dc5d7ba2d8230bda8a5752c3047eb4c0851c4c372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270155, "uuid": "aec07b22-1bad-441d-84af-98c542f32bf3", "comment": "Malware payload (MilleniumRAT)", "value": "3672751b149d961b1626b0aa2501574e1fddce02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270155, "uuid": "5ced3d42-2f7c-449e-96d8-40cb7e814ce5", "comment": "Malware payload (MilleniumRAT)", "value": "c10fca7512593f4ea1d7f06d2db82d2c3029aadeae77edff258bc1b99a61de0f3056943f9ae9c038fec469aadb179afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270155, "uuid": "11285ab2-1ddb-4c10-95ce-395c8897586b", "value": "T1A20611182117DB2BC25076B0C932E2F96374DD94D932C36F4AE67DBB7F35AB5A8400A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270155, "uuid": "a1b2cd2c-5217-4c30-8379-21378f175210", "value": "98304:CaE61jWE0WzQVbj/Yt9DHoGjORa/9nYjJe5fWelP/I4lnpHBIx:CajzJzQVf/69dB9noepvBIunph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270155, "uuid": "de52ef7c-bce1-434b-a52e-2ac88d1633c5", "value": 3776000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270155, "uuid": "2884a2be-0bb2-4bf7-94ac-2a5a1a8afae4", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270155, "uuid": "cdcdcda0-da21-4c96-a68f-2ab8c262f012", "value": "Po no-000063773-PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cbe750-c1c5-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791318953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318953, "uuid": "85fd40e9-7ecf-41e1-ab6f-ffa17ed7ccdd", "comment": "Malware payload (Mirai)", "value": "19a4912dc318361df0427dc32bdd05f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318953, "uuid": "0933ad45-4705-4040-80d7-b90d3f17f5a1", "comment": "Malware payload (Mirai)", "value": "b98a0909267bca4d6296b544d4463e00f28f38099dd4504df1c6cdeac15a760f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318953, "uuid": "a425019a-34fa-4a08-9162-7495c46a6219", "comment": "Malware payload (Mirai)", "value": "8de8fd2fe989979856e7ab0259fc57e0bab0ff79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791318953, "uuid": "63be10eb-7677-436d-b096-ceb2e2bf251a", "comment": "Malware payload (Mirai)", "value": "6eccbdc43d7ac18ccecc219b904acf3feb3aca3d5abf5f0c38c96dd8a4257196a2b71c397d48e4a8e3425a2daf8f68fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318953, "uuid": "70578264-f265-4191-a486-13c91aab0653", "value": "T1E4D309CEF801DE7AF50AA63AC8C30A17B270BB750A52D62572C7F96699331D43426FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318953, "uuid": "9488dfcd-d87a-4281-9680-5cb87c2e8d9f", "value": "3072:OSp4uKxGyK0srgRfTYL4u1XwiyMzPbqzD7JoYWBthL15:J4uYzKQLYL91jyMnqzD7JoYWBthL15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791318953, "uuid": "67741816-ac07-406b-984a-79d5b31cbb4c", "value": 134930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791318953, "uuid": "352f1013-f050-431f-97f4-ccd2883bb160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791318953, "uuid": "def9240c-18e5-4cc6-837e-fae8ff0d32c2", "value": "kernal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48dfa369-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273323, "uuid": "942d92bc-389e-43da-bf49-d0502df19059", "comment": "Malware payload", "value": "9ff0e0b5cb31f47d995da4e59d08165f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273323, "uuid": "62fc10d8-b430-4250-84f8-ccef741a3198", "comment": "Malware payload", "value": "b9d7a65d49e9bd7f14dc067e105d98831833d767cfa588775b121723f42992bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273323, "uuid": "45db7e7f-341f-45d0-96ab-c98d2b1853c2", "comment": "Malware payload", "value": "3aee0cccc4b73f4a2c96af8a38fdbf61379484e9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273323, "uuid": "630bf4e7-faaf-4d68-8ef0-caf5cbe2a49b", "comment": "Malware payload", "value": "9d5d75aa5643e7d3863d1cc46e95caa245afb587373bb8c9ec299a0d1c0bafbf235dce5f82d16f9d2bfa84a270f91a39", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273323, "uuid": "4371daff-748e-4572-9ff6-5267213255ab", "value": "T12EE23AEC3AC602477F51ED3A265261687699BA9D3CFA840740B833B93DBF4C1E712725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273323, "uuid": "83e6c09c-a894-490b-8d3a-fe87b9d11fca", "value": "192:m2TgoYgGzvtM4k/Yhk8H4E+aYQwd5Ph9kMmY8AxhDdG:TgoYwClr+Dh9kM5PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273323, "uuid": "eb661762-12ab-4160-9f5d-b6cde794d7f6", "value": 31678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273323, "uuid": "572f98cb-14fd-45fd-8047-c0226523300a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273323, "uuid": "b6224798-852a-4a20-940e-8ee7e18275d5", "value": "SWIFT COPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02032e72-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271486, "uuid": "19ba44ec-58bb-4f1c-a6dc-0c640c9d4043", "comment": "Malware payload", "value": "aee1bec9a56d3e6b5c78a4c46b67741a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271486, "uuid": "8f085bcb-31a6-4500-b4ec-3dc1633e4007", "comment": "Malware payload", "value": "b9d96f8209d349fba30a66c422222533b563dc909fd457f1ea61fb9ec0aaf067", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271486, "uuid": "92a7569c-a602-454f-88df-2f79a80e2ce2", "comment": "Malware payload", "value": "f46feaf0d86b55e501d581a37b077247ce7676f5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271486, "uuid": "0476ef44-853b-4f7b-9483-a16333c6a764", "comment": "Malware payload", "value": "59df663270bfd3f26dd465fcf64cdd1cb452e0a0773cb00c91b4b82c972a03985e6e271c5bf449b5745be18360ab5ae4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271486, "uuid": "4f06bd18-f7c8-4a3b-aa2a-6450e5d25e23", "value": "T1D2C42304340741D5835A2B1EAEC4E6E0BEB560DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271486, "uuid": "103af4df-7db8-4438-b99b-656f5a921e98", "value": "12288:z6wlOMWROC/FTeHo22Qm7NzofOr68mZeA924EwCf:r4MQOC/gHozN7NzomW8TA98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271486, "uuid": "1956684c-dfdc-4dc6-8e67-ee42e21b6adf", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271486, "uuid": "44b4be1b-eaa8-4568-934f-15478e2e884a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271486, "uuid": "7272c8ed-ed35-41f2-abba-73d82264aa4b", "value": "b9d96f8209d349fba30a66c422222533b563dc909fd457f1ea61fb9ec0aaf067.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1121b319-c147-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791264639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264639, "uuid": "9d425a48-3b6a-43cb-bcd3-0a8eda80b90d", "comment": "Malware payload (Mirai)", "value": "42cf786ce64658d7082ec01009e0491f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264639, "uuid": "5c481b0c-3f26-45e3-9cab-ea4897a2fc05", "comment": "Malware payload (Mirai)", "value": "b9e000d1cdebfa6c3073cbddabcfe80095a8d20d85a4f092b7424298ebdfb709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264639, "uuid": "bc7e5262-a95a-49a7-8551-5baefccfb3b9", "comment": "Malware payload (Mirai)", "value": "15fa75c8d487b37fb930611c0d5d670297592a91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264639, "uuid": "2bf4e48a-cdc8-4bdf-8d77-47a5c235c7dd", "comment": "Malware payload (Mirai)", "value": "b2769d81f03b99080e05bdd30afcf7b5bb011770eb562370d8f8ff742e7990bdf460debb70e45ad298730759d4f5af51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264639, "uuid": "e78cac01-e61f-4e5e-95f1-c87f1a6077bd", "value": "T1470485ADEBA19EB7D80ECD3385994503108C957A02D9AB6FB2F6C518E787C4E08D3DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264639, "uuid": "2db57e2a-0f88-4768-bdc5-605342308b93", "value": "3072:5Jarjp2CnQOj7Udq/F/Xaad2nHXDKpSIeZ8tjTl5:5YjHnQOPUc9AHXDKpSIeZ8tjTl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264639, "uuid": "e6e66fdd-3ac3-467b-ac83-05724f5cc026", "value": 181831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264639, "uuid": "1089be75-6172-4e33-ade5-33c43dde7f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264639, "uuid": "5e528964-b934-4bc4-a817-3a945f56921d", "value": "ntp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aedbb8-c14d-11f1-927a-4201ac107004", "comment": "Malware payload (WannaCry)", "timestamp": 1791267363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267363, "uuid": "623a1205-523e-4d0f-a8e0-dc242e290cdb", "comment": "Malware payload (WannaCry)", "value": "fbf5502d96d5e50e2084d6f11269460c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267363, "uuid": "2741a388-2a40-4c81-90e2-fc72909e7362", "comment": "Malware payload (WannaCry)", "value": "b9fcda5008f194cb1d90a7fc1c30ac6240b7ca3fe1dff8c6e7c42c802ba25abd", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267363, "uuid": "8f5144ce-5e8e-4b63-8246-cf20f9b01866", "comment": "Malware payload (WannaCry)", "value": "0697d44ecf34afb7735e1bfccc1bad07ce60be5e", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791267363, "uuid": "f8f4ff9f-d1e1-4ac5-a3c1-a999d44008fc", "comment": "Malware payload (WannaCry)", "value": "fd56d9673608d52086a16a7cc843b19356bfd89229ca62c14f90a5213a1248cf6c12fc9b106f7a32de5c5bfe704e22d3", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267363, "uuid": "12f90df1-3359-4120-918b-05def083fd6a", "value": "T1F536BF0A37DC80F8D4569274C8B34E25E7B3BC4A1739864F1B64CB6A1F63391B579B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267363, "uuid": "168c0d7c-c27a-40fc-ba95-cde2b387d3e2", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267363, "uuid": "95b93468-000e-4d29-af5e-3880367799b3", "value": "6144:jIYVTH5DgSgmE9l9yeqIYVTH5DgSg8ajldktM0XXr:jbLgmVbLgPlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791267363, "uuid": "96c1f320-0883-4245-8eb8-39368b212b72", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791267363, "uuid": "98dc1fb9-b7d2-41d8-b8c5-d744c109a194", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791267363, "uuid": "ffffecd2-5312-4406-bfe5-9b9837297fa9", "value": "b9fcda5008f194cb1d90a7fc1c30ac6240b7ca3fe1dff8c6e7c42c802ba25abd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b0f108-c173-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791283515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791283515, "uuid": "e5da585d-2735-43b3-b480-4051e7f6d53b", "comment": "Malware payload", "value": "4994f95185f0ac28be8898ce388cda66", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791283515, "uuid": "f522d8d9-7e31-41ab-a9fa-d332f960526c", "comment": "Malware payload", "value": "ba8baa86040927a1ffc8ef712055b2646bbac5da6fee235c7f866482951b0ed6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791283515, "uuid": "5c1d26b4-8d3f-4f2a-9ad5-f2ac5182d314", "comment": "Malware payload", "value": "c7a839742acb625042e3f0e593f44adcf0df64b2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791283515, "uuid": "04751158-f63a-4c1d-89fe-6ce281480c1a", "comment": "Malware payload", "value": "a7b459eac9090c21edfcbe7a06f2641bfbc4a1f78d50ef6daf5e1b95b602ca71659624eaf35257df961b28ab4c312d5f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791283515, "uuid": "0449b706-17d6-43a3-ad44-0ee2907b7098", "value": "T140D533292A9031A8D5FA55ED02A95FFEEF40063C6695489F1D81704E2D9D0E2CBEF07F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791283515, "uuid": "c5008cb0-2314-424d-bb23-7177dd46a654", "value": "49152:W5UXMulIuaY7znvwSWqybkL0Gb5ElwpnlKz30nmCOcpnHg9lQh7q8iW9l:W5UcuG8wSWfbRGNEolSnNjQh/rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791283515, "uuid": "c806d962-656c-412e-8a8d-45a7f608d49b", "value": 2758111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791283515, "uuid": "2fbadb92-6205-4009-9f92-f8389497849d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791283515, "uuid": "92d00ffe-c896-4945-b8bd-c5757579a208", "value": "GSTR-3B.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a65c57-c1aa-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791307273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307273, "uuid": "e2f9544f-6816-40f2-9fdd-60e3d0baae52", "comment": "Malware payload (Mirai)", "value": "edcba899c42693eae54c3d596ae5fb48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307273, "uuid": "bda5f27e-798c-4e1f-b21d-dcf345cd167f", "comment": "Malware payload (Mirai)", "value": "ba8ea35fb544e00be375e3ff080e5ed10af088c27f7cf12ee283e5351d740f2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307273, "uuid": "8cafd2bb-5017-479b-b7ca-396f0459fa04", "comment": "Malware payload (Mirai)", "value": "182f92d2fbb760e23dc35194b151153fdfe87ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791307273, "uuid": "f38cf78a-6a92-4f9b-88a4-e39c67f3fad2", "comment": "Malware payload (Mirai)", "value": "2d90c66d2f2793035d9a69e5d9456ab4e03262c23b543e494fbcfa3f0b469b60a1743304e41454a61e17054359970992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307273, "uuid": "51bf71b3-e663-4704-a4e3-8ead3b0b70b5", "value": "T196442366BCE73B61B44174B4A42A940514C3D1CAB782B6675DEF7D30BAD8FB5A280343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307273, "uuid": "2487aee5-d7e4-411e-b910-74e2d99656d5", "value": "6144:CvcYXcGPfgFItwrDuXJcmGCPSA9lJmnBKBsyUUZI1Jd3w0b:CvBJvtSDqimrSsyKBsHIIH13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791307273, "uuid": "3eb1879c-b141-4c54-89f2-40155d11a71f", "value": 273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791307273, "uuid": "87bf30e4-7596-44d1-a2ca-c1f61b76ac38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791307273, "uuid": "2ecdd0f8-efce-4b83-91d9-79b6d50bc864", "value": "sarm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62c75fe-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273989, "uuid": "3a1bd6a0-8e89-4534-9e07-73c0920d9cdf", "comment": "Malware payload", "value": "ee95af79af9582b3f12595e2341c6e3c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273989, "uuid": "1ed20724-558f-435a-b47d-bae27e9d3332", "comment": "Malware payload", "value": "bb9b9dc0d3628de64b7aa7af8ffda2ab6a16fe9a925aca7f046a96c8f718120c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273989, "uuid": "e5a85fb8-8a5f-4f79-9086-28a3a086e207", "comment": "Malware payload", "value": "d0dc3820ac4b1a78ea803c3643fe43cfa0bba1a7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273989, "uuid": "0aa3d424-6cc5-4e0e-a201-32bd74d0f246", "comment": "Malware payload", "value": "9ea4934a8aa83f8297d69a6c26dbac24dbdfc165ca925035642314673132b15a72272cccea3ef1cf1869525a0f8371d2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273989, "uuid": "62e5933f-93a5-48f3-8cdc-cb53cff88410", "value": "T1ABB423CE5A286CAC5BE85E834F5DBFDA2CF8413F862411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273989, "uuid": "efeb56e7-9e23-42e6-9f7b-9bb8d3c7d58c", "value": "12288:BGRl4nbDDGIabs/7iiEVwYg2l3/2NHHy+wK8t:tTabs/7iiWw0KSxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273989, "uuid": "09cb0f45-94f8-4901-9f25-bbde6918f7c8", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273989, "uuid": "bc398a40-6c79-4fe1-8c88-3c690cb436f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273989, "uuid": "fa437544-8335-4e55-9723-bee5850e385c", "value": "bb9b9dc0d3628de64b7aa7af8ffda2ab6a16fe9a925aca7f046a96c8f718120c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ba3294-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276084, "uuid": "4b7ba3db-d374-4503-8360-dac7999d5e24", "comment": "Malware payload", "value": "5ca6b061dc18d8328fc4e81a0e78b8fe", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276084, "uuid": "76086da1-e127-4a03-a8df-6b55ada96da2", "comment": "Malware payload", "value": "bc2ec920cab1ff0aae9f0fcc42afe49c0b3ec4009827dfa68139b19c8983604d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276084, "uuid": "01b31463-ca51-4f3d-af04-aa0807577304", "comment": "Malware payload", "value": "7fe4b3c8024794ff1772618114eb1c704d41dab8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276084, "uuid": "70145ddc-f5d6-4147-9121-5e1679bba9b8", "comment": "Malware payload", "value": "d5476ffd08034a08712eb00983f1e8e887e3c5e10c828ae78e36fba1b0cf708cc0fdade4248ebfd993dc1d584ca6f422", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276084, "uuid": "7d79e99f-ee29-467c-b5d7-48b762d60e43", "value": "T1D6A42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276084, "uuid": "433cf2bf-b5c1-4c53-9364-6987392a8170", "value": "12288:KSCDe0U+m1V6ECbniSPfS3e2R3feeintFckMTsuC8hHG:KDe0wUTiSWzeei4sP8dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276084, "uuid": "26f846e1-edf3-4db2-a695-1977582a6140", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276084, "uuid": "68ab3d7c-c1d3-4bda-80a1-da246b0a9f75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276084, "uuid": "122b6fb4-f66b-4748-8e62-63a5a9785078", "value": "bc2ec920cab1ff0aae9f0fcc42afe49c0b3ec4009827dfa68139b19c8983604d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc784dd8-c19c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301541, "uuid": "9697025f-9f10-468f-bd9b-b691db88e5fb", "comment": "Malware payload", "value": "6f74cb4cac4454af0d8d44a7ab44e5ff", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301541, "uuid": "4471c2b8-d7e6-42a5-bb1a-1bd00cefa9bf", "comment": "Malware payload", "value": "bc3dd1d5920bab4caf21f701e9aad00d5a59d7f35ffbcaf731816f7613d10066", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301541, "uuid": "fae12963-e554-4518-9ed3-9ead1b30beef", "comment": "Malware payload", "value": "67bc79ad56127b3efa985bbd992c4b207ae5e38c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301541, "uuid": "2bc0789c-654e-4a05-bae8-8ed150e9ea23", "comment": "Malware payload", "value": "d10e69b532fb335c58c45178146d46bfb7c2b8a635db308cafbbd880ca8f63179aaa37d57833c167aceb497866ac667a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301541, "uuid": "efb96c66-b0cd-424b-82c5-ed22150217b2", "value": "T1C665F12A5EBE5674DF43B372801ECB15B83C2550E48A64123AB387DDDC41EE92BDE349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301541, "uuid": "7fc2b685-d52a-4055-9ca6-005f0dd435db", "value": "24576:bWfbm2ZQGyHetWMXJC9pqkzpP552r02acDxU/GdS6dW8wLyrO7cbM:KzmLNHetWMZC9NFPygjc9MGeZq0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301541, "uuid": "dff0f86d-7e68-4327-8ca7-3346571978cc", "value": 1462125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301541, "uuid": "532b3256-0398-454a-b391-546e553220ca", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301541, "uuid": "5315a313-30ec-430f-81d0-21efdd8d6646", "value": "Tuff_Client-cr.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5b2485-c196-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791298667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298667, "uuid": "49ec15df-129a-4fca-84c1-5e5b3c06acfb", "comment": "Malware payload (Mirai)", "value": "9f8df64a8e19eddb2dd922f200b01c12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298667, "uuid": "f33572e6-ecdb-4be0-873b-21cfdcf2628b", "comment": "Malware payload (Mirai)", "value": "bcaad64daed3f829c418abe5d8fde4d2588afbec16f95f59cb225874524809a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298667, "uuid": "218c7fcc-2305-4118-a7f1-97667e7c29bb", "comment": "Malware payload (Mirai)", "value": "26d9ec637476d580295c4f77d01ce12d47f6bf38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298667, "uuid": "fec7f2c1-9360-4018-84d9-ec1843d9d4b1", "comment": "Malware payload (Mirai)", "value": "932dad1e6ba0ea2e0e47ff724a1124451a5c7260f423e63b6fe373cc464ba9227af76acf62231f9c49ae99f594483e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298667, "uuid": "fdb3be62-af4d-4cea-b7be-52c9913237fb", "value": "T1EDF48D2AB2F3B1BCD11BC03047DBCAB25535F47526212D7B26C4DA353E5ACA1136EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298667, "uuid": "fd759649-5463-4548-a4ae-7a1c401aa06d", "value": "12288:BspwgQZpOqAlAJxL9acFkGJNg7jrjLndaHQqCLxVCFaN0ayUtiDHX:OpwgQZpONlAJxLYGJNg7PjbVCFaNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298667, "uuid": "91a204ef-266d-403a-b3f3-0c0490741c19", "value": 772408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298667, "uuid": "bf9f07a4-567e-4931-a636-7c8434e63bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298667, "uuid": "e7241acf-47b9-449b-a04e-58f20c1a740e", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd19e6b-c15a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791273195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273195, "uuid": "0a992ac1-7bc8-47f0-a04c-7bd715742eaa", "comment": "Malware payload (Formbook)", "value": "048f1f8a0bed5f74fcd248736c1bf302", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273195, "uuid": "858ac49a-94a7-410f-8894-17d21d9927b2", "comment": "Malware payload (Formbook)", "value": "bcc3c61d48a5175add48c45b344b340cf4dc26d4b4a637a17a8bad95a5825320", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273195, "uuid": "a9fa62df-587f-4aea-b36f-154998edfb7c", "comment": "Malware payload (Formbook)", "value": "4de039b6c9482428f448bfbf652d6884586b941c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273195, "uuid": "040ec2c6-248c-4a53-9415-8ec3ef979837", "comment": "Malware payload (Formbook)", "value": "f496c655882e64b30c1d0a6ea8175457a23c8807af7687d9207fd231a6f680bf4abad7da363cdad0d53585aecd9b931d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273195, "uuid": "58360d03-2b0b-4ca5-a453-851d79adf442", "value": "T15775232D958F56CA0B0092FBF04AE81AB5CE238B88425737476DC1D137F9154A7B7EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273195, "uuid": "2fcd2666-0fe8-4d7b-902e-463fb59da478", "value": "24576:8wWO4gEY+ylAzkP1soX1aeDdhRWGDhYO4tHHUqYonzDSt9DN/FT6rmp2EpJ/:8pY58o/nylUDo6pvp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273195, "uuid": "1f5e8810-e1c7-4e8b-80fe-dc5715192ac5", "value": 1551101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273195, "uuid": "ea242f57-c84c-48e3-a17b-9d9bd659052e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273195, "uuid": "2a6abe57-9b9f-4975-aaca-d2d58777b190", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ff261e-c184-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791291092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291092, "uuid": "b4a07509-3ba6-4415-bbea-cb787c4a0b0f", "comment": "Malware payload (Mirai)", "value": "ac23fa2c319cd3493b2a69d456fc2878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291092, "uuid": "285e9358-7ae8-4894-acba-c4f837da3d3b", "comment": "Malware payload (Mirai)", "value": "bce1fe5219c46705a6dfb998ecf5ef2b0b2745d39032c7d06fcdb957ddd89c29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291092, "uuid": "fae1c72c-974f-469b-be56-e3b25424d339", "comment": "Malware payload (Mirai)", "value": "5a8f4c4ef7725248b3459601152a320cca326dd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291092, "uuid": "8be0055f-168d-4f06-a06a-1273fc8c2afa", "comment": "Malware payload (Mirai)", "value": "243e6c697facadeadb7330a56cf93e9ec7d590c8f6d1e4139c4208f0d89595433c446f4f1f2870c0e15e5758bafae945", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291092, "uuid": "f200cb9f-7991-4801-bd49-ac3cfd378204", "value": "T117053A076F509DF7C86BCD3306B5CB2625CCB4C332A53B6A7678DA88BD1960746938B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291092, "uuid": "8aa70d03-5dcd-49ed-a2ad-87868922e521", "value": "6144:ks6r9VLIgTaIqbX9bYtOmcpImccR/8Bm1BvcVUY7eRb+ZdWYSVGEY6WIhlxmp3:k5xJTahT9ktvCBhMmbyzR6Dlxmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791291092, "uuid": "b7ef79ba-76fd-471d-9e18-93b8ab5415f2", "value": 858584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791291092, "uuid": "e56e2110-3de8-4bd4-a4d6-ec21bb1114c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291092, "uuid": "cd34c367-bff0-439f-8e5a-11e2a7820083", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ba481d-c19b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791300799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300799, "uuid": "c4144154-68b8-4406-b877-b96aef548435", "comment": "Malware payload", "value": "b6f993d9e3de504cb187f2b33e7890bb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300799, "uuid": "2be306e4-9d4e-4841-8e62-8baba67a0b0a", "comment": "Malware payload", "value": "bd6cef986161a85f4849d1b57b54969443d50be2ae6a5ec096330756752bf031", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300799, "uuid": "19d3a91c-0437-4a9a-8a70-b53086c960ba", "comment": "Malware payload", "value": "57178b2096c39b1fad99b54c6bf11d481552dd89", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300799, "uuid": "19f17a5d-9773-491a-a419-a24abc05dec7", "comment": "Malware payload", "value": "2b528d0bdecaf0fe87c415d039e8887397349d76015ceb2a718d07656cc834848a5b7be2eed6e8aa3654e4130210bb21", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300799, "uuid": "47e50d75-7f35-44db-8938-3731217ee615", "value": "T172463380CCDC527CDD17633C6B88BC42615A2358EBCDEB225631D66EDB94FA10F1AB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300799, "uuid": "0dcf6d32-101f-46e9-97ae-a374ed9ad088", "value": "98304:8IwANZ8pNjLTIbmlI/mQ68WfjrBIA3aGK/CpIhk2lMio12bPkQuQ0qc5vA:kAj8pNjiaIeQtWfjr6AdqCp2kL12ZTyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300799, "uuid": "63cfa028-7e63-4e50-820f-a08a7db76ff6", "value": 5740112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300799, "uuid": "90925269-c7e0-4545-85d5-f765f1a85650", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300799, "uuid": "63e8d42e-96f6-413d-b570-41c1eb052e65", "value": "PEAK-CLIENT.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dd3cb4-c1e1-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791330795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791330795, "uuid": "1e854ee3-5a26-46b2-b4de-7162aac9ba87", "comment": "Malware payload (Mirai)", "value": "211cb081b81838f0c67de34e0aac4d73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791330795, "uuid": "b44404a2-2fa6-43e7-a5f7-432d8ed4105e", "comment": "Malware payload (Mirai)", "value": "be2c28842c350d43d2b3ca8822221164e190d0594be464ef80bff87c8f352207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791330795, "uuid": "d4333bda-9abb-4f9a-9175-104d76c89574", "comment": "Malware payload (Mirai)", "value": "33c231c314f880e40f4918cccf7c4a1a56d16b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791330795, "uuid": "add85455-eb7c-43d9-99e6-7ebc2bca0c2b", "comment": "Malware payload (Mirai)", "value": "6a97ef66841273d186b0308542727a2d9e3f1715b54f052fa1467bb203f3cb8cd237a173220021d5033f0078f661d01a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791330795, "uuid": "3ffdd496-319f-491d-bf4e-c03369366242", "value": "T18B0474ADEBA19EB7D80ECD3385994503108C957A12D9AB6FB2F6C518E387C4E08D3DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791330795, "uuid": "32ca5c17-4060-43f3-bc52-5a3cb082142d", "value": "3072:CXO/Ar3n2QGu3kizqLiNADKpSIeZ8tjTl5:WbrGQGWRmLieDKpSIeZ8tjTl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791330795, "uuid": "3022d056-7958-4f11-9ad4-36c387869c48", "value": 181798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791330795, "uuid": "18f883c7-fa3b-44e3-90bd-99e10763d093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791330795, "uuid": "5822b59c-cda3-470c-944e-d4b757ab7290", "value": "ntp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905d62e3-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276020, "uuid": "295482df-3acb-415c-a03b-5df636010a7a", "comment": "Malware payload", "value": "2fb14b37c782a56feb3e2bff31deed32", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276020, "uuid": "6005adfc-c874-4e3c-96ea-00686e9914a7", "comment": "Malware payload", "value": "be4c274db56411e567ba29023efc78f0e13229aeda79d2be3a5b374f293197b5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276020, "uuid": "d298d254-001d-46cf-bca1-63bdcbd0fc20", "comment": "Malware payload", "value": "1a714c2a736e3bffc9b1fbd80d4f45f875706c60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276020, "uuid": "f12d27e6-461d-477a-ae2c-57c9644919f1", "comment": "Malware payload", "value": "3ae40a2150179d02b066c1228f77cef9076e5d848f0f6b7671ec5b6305223fbf655ad9e63c495228e2a98e6ac922e281", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276020, "uuid": "06cedf6a-add9-4199-980a-cdb33e5e484f", "value": "T148A42397D39996EC8CC47ABA8B2C0D08B27CE7745CCF06A8537E5335E1688A29E0751D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276020, "uuid": "9df40bd4-3371-46fa-8e59-d7b76e095495", "value": "12288:SsS5lyFd6R+6sVXkvgSe5yzqr++rVOje+yH5m:SsgxY6sSvPmy+6eTH5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276020, "uuid": "2bdc07d4-1b76-48e9-a027-bb5e2979a526", "value": 492541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276020, "uuid": "8718ebdc-90ad-4c41-8b5a-ae7df77980c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276020, "uuid": "53871256-2acf-489d-95e0-2753821fcab9", "value": "be4c274db56411e567ba29023efc78f0e13229aeda79d2be3a5b374f293197b5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19487cbe-c140-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791261647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261647, "uuid": "fc9e2890-1659-4d67-81ed-268531ed3a8b", "comment": "Malware payload", "value": "6fc94f5c2f03ec2a0bc4ba1c35b37b0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261647, "uuid": "328dc10e-6bc3-453c-a4f6-a06ecbae8faf", "comment": "Malware payload", "value": "be6251b0a4cf2d5f0d2eac02caaf5fe1def80a215561d355a44528f32d881cf5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261647, "uuid": "58718afd-2852-4334-9d14-bcfd252cb2b9", "comment": "Malware payload", "value": "7bff6b70a1e5fcc2ba221854999bf4b17ea23352", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261647, "uuid": "aeb3d828-603a-474b-84d8-1578df231e55", "comment": "Malware payload", "value": "827c8f1b0b93bcc360625f6454ff62746920708da88d0d71f2c27c0ad3a635452f8c8924808a39bb3ab333c15b95ea32", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261647, "uuid": "3c7794dc-079c-4462-abc1-7de9fde8cbae", "value": "T10E41CCF3F9B49C31F429842CFB4EA2E579935D7F41E0A85A84AB7911AE5C01A60DDF30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261647, "uuid": "87a31e63-b886-4f72-9480-9090da787c04", "value": "48:H6vdV+SAWS6T16TO6TjE6Ta6TWRQTFjoTsiAGWK94nmpJL3EOnTGwQHJKm:H6vmLWS+laERvSoMGWK2UJo26pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791261647, "uuid": "4480400e-7e72-42ba-8bbe-d17ddcf62253", "value": 2289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791261647, "uuid": "11a1448a-004e-4dec-96bf-10263c5bfc28", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261647, "uuid": "b2e8c95b-7902-4478-9f77-c1ce4ca292e6", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51639269-c1a7-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791305979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305979, "uuid": "8e9917bb-2d78-4aa7-bb93-d258005625a9", "comment": "Malware payload (Mirai)", "value": "f3f842922609a0a6e30a1510ad42f8cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305979, "uuid": "ef5a3ca5-cd51-4038-b3e8-e225bb9d9624", "comment": "Malware payload (Mirai)", "value": "bef45f3b51f4d42e2f0d5c4b44946d11e002f2b589be2fdf3e5ed2d0aad68ef3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305979, "uuid": "6eaac38e-d2bd-45cc-9643-0550dfe63ded", "comment": "Malware payload (Mirai)", "value": "776f02922e0211bb4e9413c09e7803a825115cd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305979, "uuid": "4ae1644e-0e47-40a3-98bb-51ebec30360d", "comment": "Malware payload (Mirai)", "value": "cceda24c7f9e281ba44d18b9dc1f388c6dc5453fa39f160a74b93d828885e76b9bc1fd8c00437b181831ea7ef93254cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305979, "uuid": "da4bf928-67c3-4ad3-992c-55ce60037524", "value": "T1DC043902B70C0E47D1532EF0377B0BE097ABED5225B5A280751FAEC882B5DB66446EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305979, "uuid": "a0a329f2-b99b-42e4-8f32-529c415772bc", "value": "1536:5yXuJ9Gs9zbeEhBVx67xXUQqlPSmJ8svxLx922k8nSqxnoNDZBvDb1XTb7+fhQ9y:5yXuJ9GsF5zlTPdxaZ5XVQhQ4Wc4VpT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791305979, "uuid": "edd882c1-dc21-424e-8966-6ad0d9d771b0", "value": 184456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791305979, "uuid": "9f97a079-fa9a-4ed6-9fd3-e950e5d82331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305979, "uuid": "1c3fc02a-5a0d-4b26-8437-89173d0e6462", "value": "vcimanagement.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479b07a1-c163-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791276757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276757, "uuid": "9943964f-24d1-4ea8-bb85-435dd4329f93", "comment": "Malware payload (Formbook)", "value": "43094f7a52eaf3dd6296c402253691bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276757, "uuid": "7495b55d-ad1c-4b70-b7b8-7f0ac55d5166", "comment": "Malware payload (Formbook)", "value": "bf92c8212abce3804860ea70b84cf5bc43d46e53ddc3613e2e9364df568b6f45", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276757, "uuid": "9f0bb494-524f-42ba-8b05-e9e87f42f662", "comment": "Malware payload (Formbook)", "value": "78eb17640c972f682b66cccddbda2cc0cb615e2a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276757, "uuid": "7b3a4c19-e98d-44dd-9d33-6060daf0f096", "comment": "Malware payload (Formbook)", "value": "f21d7980e045b7f49ebe9e703b078a59228c85c404a87d5a8fd81a1eb5670c56ce975bdb00cf443a1a6883f510eeb28b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276757, "uuid": "c5ef84c6-2595-428e-9a80-282f659cfff8", "value": "T196A5F15085C03FE8EB79561941FD962DE3B10A9B482D6946B73FFE45EFB390486030AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276757, "uuid": "3d1dc8ef-94fb-470a-bff5-1961bac749ef", "value": "24576:cwLw5BN2RvZwZuTH4BUT3Lg+QYsYmvmRt3+TwDIlGpYJOI+taRzqI2NhsyyX1V:vIs0o31iKu+IlGBA2NwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276757, "uuid": "0a3190ac-181f-4373-9df9-14d95ea952ac", "value": 2106640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276757, "uuid": "38e046b5-c9b4-4ff6-95f6-98797217b425", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276757, "uuid": "0fc1bd8b-e84a-44b3-a449-74706e091a07", "value": "SW_0129191.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e78ad02-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791273225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273225, "uuid": "b69f6b96-5cc0-4190-90ba-5c2320ba7726", "comment": "Malware payload (MassLogger)", "value": "006afa0146168845200f37f1dbcff257", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273225, "uuid": "f26e01e4-9aed-44fa-9e1f-c50f41cedbb7", "comment": "Malware payload (MassLogger)", "value": "bfd379d8db16263ff5529e483ebe4ca7fbf8051b89999e627147deab4f7559fa", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273225, "uuid": "75517d33-a4ad-4649-b68b-7d4f46b5c6a1", "comment": "Malware payload (MassLogger)", "value": "7240840826f604ecc9b9d0692f170c485bbc32aa", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273225, "uuid": "499caab3-96cb-4ba6-89c3-710f665d4527", "comment": "Malware payload (MassLogger)", "value": "f6f0eff094f225a454df2cb798e95a951bd10f935742290e99203411915b3b51516513e4771ce1ea224ee0f70432b1f4", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273225, "uuid": "be7f504f-9748-429e-886c-d8f51babd313", "value": "T182452374804C66EA4D13A1F6F051B45AF5FA168B8A42534A23FCC7A93398460DBF7CB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273225, "uuid": "e757ae11-fa60-4867-b566-4526b7cc0fe6", "value": "24576:CLI8AU/d0djOxLXTkvcWUrWbX3GL2PvJlAMqfLcCXLYrFLO5t:Gid6L4I2WQnA33Ehst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273225, "uuid": "d86d9821-48ec-4565-b4b1-771546470f82", "value": 1240349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273225, "uuid": "ff3d421e-05c7-4ef9-b1f6-9c3ef4f0f948", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273225, "uuid": "241f9cff-8c13-450f-8aca-e5e9c5c9323b", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ece3c4f-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273870, "uuid": "d2efb49e-9856-4945-9a0e-bc1923cb798e", "comment": "Malware payload", "value": "4d648dc80785cfff78972e12c2d039cf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273870, "uuid": "06ce10b1-c1c3-4ef7-8618-3861f7392d91", "comment": "Malware payload", "value": "bfd7b4313189d02ce3b1051cc206693f347e4efac57b99768727a1910ec7c4bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273870, "uuid": "0d98fc02-c1e7-45ad-ae20-d2fd77bb7481", "comment": "Malware payload", "value": "9d1b746c85ed7c7169610e43ac1c85832d7e25e5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273870, "uuid": "895cf9e2-5b77-4bbc-830a-8b61ebe0cfad", "comment": "Malware payload", "value": "825b18dad91fafbd68a5bec8ded42a03cf27a03c2993844692df79aa394ecd38cdf532bbed9fe63ffb0c785c083f5467", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273870, "uuid": "caf189e6-5ad9-4b8e-afd5-9e825e21877e", "value": "T1275533C6C17C25C84F7C0A736BEFA55C51188DFC200208676F6A48E7363E79F86B599A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273870, "uuid": "da08f478-1454-46be-b683-d754d9de93d9", "value": "24576:Dgnp4wVoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRj:DkO+oZ9bq+MmMEL+hcjXHC/wnwdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273870, "uuid": "c25cd02c-e0a2-4e12-b081-bda6967b1854", "value": 1389021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273870, "uuid": "97eee647-93a4-4922-9a7e-e8d8262b2976", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273870, "uuid": "1839fc2e-bc2b-4629-93e1-3df4e3366d3f", "value": "bfd7b4313189d02ce3b1051cc206693f347e4efac57b99768727a1910ec7c4bc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a474427f-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275195, "uuid": "a67248bb-be89-4939-b308-b7563ba715ce", "comment": "Malware payload", "value": "eff5faf39867a85a405c564d2c24f660", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275195, "uuid": "b0d914cb-ef00-4e0b-99c9-c807ac383940", "comment": "Malware payload", "value": "c00847e25a91c89e03b9ab58c9ab71930acbf33d102b6c4e6fc1f76dc28a0e6b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275195, "uuid": "01a22497-ef69-442a-b9e5-99db6b9e0ee0", "comment": "Malware payload", "value": "580c1795c91defec8f40133e3a8db357bb95fa9e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275195, "uuid": "6b9a35ab-40c4-46bb-96d6-381b268858e3", "comment": "Malware payload", "value": "38e3769745076cedb97a524958b907c99f687fa702a24bec9ec691554088c0a5105aba4b8d0635a98c3399d91e9ecd27", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275195, "uuid": "b659b798-8db2-4d3b-b59e-e725ab9fad4d", "value": "T1855533DB807C14C44F7E0A62A7BF906CA1248DFC20050C776AA985F7653E79FC9619AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275195, "uuid": "917877f2-73ea-430a-8372-09fcd4be6cf4", "value": "24576:bf1pO4soZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRB:DO4soZ9bq+MmMEL+hcjXHC/wnwdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275195, "uuid": "c00148ac-e949-4946-8bd6-86c77201b56e", "value": 1397380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275195, "uuid": "e2fe6983-15c1-40b0-9374-fb0a90f8f21e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275195, "uuid": "416c54a2-6bdf-40c9-b654-77bc1f686692", "value": "c00847e25a91c89e03b9ab58c9ab71930acbf33d102b6c4e6fc1f76dc28a0e6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1396e3b1-c1da-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791327780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791327780, "uuid": "14f235ac-e023-4abe-a675-2f91fbe1ad65", "comment": "Malware payload (Mirai)", "value": "f1fcf72c6e677cbd2f937ecf2a3b4b96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791327780, "uuid": "51098772-bf5f-453d-b707-7fdbd3792074", "comment": "Malware payload (Mirai)", "value": "c027df0ed143719add201430d47033f8cb33bfeb74f830c73f5fb01c4932a041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791327780, "uuid": "a985bc71-ad17-48af-80d7-e22412f9beb0", "comment": "Malware payload (Mirai)", "value": "76e617e6ae06ea9732460b5dbe56dc902f5760a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791327780, "uuid": "3818630c-bc32-458e-b91d-3c2b48e8add6", "comment": "Malware payload (Mirai)", "value": "460c7354a7848a4a56bedd415646c52c93c956c2012b0f581bc8b0f735a21be0e1b95a970d43d232f45123907aeb36ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791327780, "uuid": "ae91bd3a-6654-489a-b440-55e0d6075b85", "value": "T12D358C1AB2F3F6BCD007C03097DFC6A24531F0756A312D7F26C49A392EA6DA51369B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791327780, "uuid": "781b74b4-b9ca-43de-a683-e28f80bad819", "value": "24576:Q9TKE4ICvnygUvpgbENg916rThFr7MJlePHau/AfWo1:dbENg91sX7MSIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791327780, "uuid": "259a9fbe-9b1f-46ec-84a7-d7295635ec3b", "value": 1090592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791327780, "uuid": "27e28b67-0d89-49af-a848-3100d5f915b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791327780, "uuid": "02ac4ef5-ff0c-40b8-bc41-d391bf3ba343", "value": "c027df0ed143719add201430d47033f8cb33bfeb74f830c73f5fb01c4932a041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163daa75-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791273238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273238, "uuid": "140a8bce-43e6-48cb-8888-077ae7a275a9", "comment": "Malware payload (RemcosRAT)", "value": "9574a39e61aa1840a6d99caf6486fb55", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273238, "uuid": "40c83722-a1f1-4834-9b85-f3b6682f9dd9", "comment": "Malware payload (RemcosRAT)", "value": "c062561eb071e15cb80d58b21fc4f5f20ed09b60cfa10f7dc80493f341d8cade", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273238, "uuid": "8482ef49-e0be-4a22-a0ab-233c9d7963cb", "comment": "Malware payload (RemcosRAT)", "value": "b935ba7395a5cdcd4dacfae8521e5775b0166bbe", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273238, "uuid": "5f046362-5647-4376-b5a3-9d44607c2452", "comment": "Malware payload (RemcosRAT)", "value": "043e3936bd7386e7cf397fad96c10f14b2b2752af73223a7a81c29b2679478a082fbf2ddb4597bcad11613d706bd3a2a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273238, "uuid": "ab2639a6-4123-4d4d-90e4-08bc0d32206b", "value": "T18FA3E0007175E44AF2584E3E9CD6D1DB1B287CA36F4BC20F72807B2D447B4C78D66A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273238, "uuid": "83a44939-6ed3-4585-b7a0-580a0594d366", "value": "1536:y7IStvRDGH87zMOZYnyRnLbEHmI3sRw5PngwsNZ1VZORiX/+b7drVQ:y7ntZKjOZwCLbEHsRwyDORiX/+b7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273238, "uuid": "35991d86-eac7-470d-a1e4-410d30b38b61", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273238, "uuid": "19edcd94-2820-4699-b002-bb2c2b4a2a50", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273238, "uuid": "d1a541c1-a6e6-41df-8515-e46427efdcbe", "value": "DHL No. 27 1054 89930.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f946e5ce-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274048, "uuid": "dd7c6cf1-98bc-4589-a775-f348467fc9da", "comment": "Malware payload", "value": "e6cf0f889c467502d90b6622f054dce3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274048, "uuid": "ba8a3ce6-19b1-408c-9c29-943d689fbbb2", "comment": "Malware payload", "value": "c088ab68743857f3d931bf127fdfba498174dd6d1fa490826cd07a6518b561fe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274048, "uuid": "9657b377-0b9a-4cc9-ad6b-83387563faf0", "comment": "Malware payload", "value": "063146e44a404c44c9b9ffe9ad195416add9846f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274048, "uuid": "ab17a8dc-ff9f-4a8d-b79b-436cf2b41391", "comment": "Malware payload", "value": "a61e9ef850b6a4c13ec20d99b201adfc6a6dae657ce8e6b3bb1d1e321366308aa69ea41eb201ca5360bdaf27224d3005", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274048, "uuid": "ca666fd0-fca1-47f8-b565-da0660eba6da", "value": "T12BC423ED0B6E70884C7B13659B8322145E2E0F725A10B7D7A2E8D64D4E17A9C9F78F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274048, "uuid": "f4223c7e-b53a-4b05-ae5e-d47f78a831b5", "value": "12288:pyBXIs7rM1LcqOqO3g/ALyYG0ZaDajTCXMO8xzDOee5g:MImQ1TEA/f0Za6TCXKBxeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274048, "uuid": "47fb3fe9-8b93-43c4-bca6-c4c56d4c4a7c", "value": 547027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274048, "uuid": "ca5aaa67-c8f5-455f-99de-e337702ec5be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274048, "uuid": "5ca871b7-de44-43f5-b778-5dea69d22ecb", "value": "c088ab68743857f3d931bf127fdfba498174dd6d1fa490826cd07a6518b561fe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33118e8d-c1b5-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791311941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791311941, "uuid": "a4a77edb-e0b2-404d-b0d0-2a0defa96f91", "comment": "Malware payload", "value": "5f7d5f849dafab6a376f668b8f287fa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791311941, "uuid": "87b0e6c3-69d4-40f6-bd51-ea42093ea569", "comment": "Malware payload", "value": "c10b05f1e4780e30f31f78777b682093c7e3733d31a3cca229ba684865faa621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791311941, "uuid": "5d470c70-56dc-44d1-95fa-5fd4e17ef6ae", "comment": "Malware payload", "value": "d8748709a0a6a4062938073393cea4b6a723adc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791311941, "uuid": "53c5f02d-a4ec-42a7-8dfa-b4cef0754630", "comment": "Malware payload", "value": "40fb300de9dbbd6a7a2f8c31a3439065b96e7b9b66bbb7840787f1794595a96fd029b969530a8ac554540bf28cc5fd5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791311941, "uuid": "dcc25b14-b2ff-44d5-b2af-b9e008203eba", "value": "T1C34633945B4205D6ECFB423A94628284E6B2B4AB1330E5EF4B6173376F137F4683D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791311941, "uuid": "c607d580-624e-4cd8-a8ed-85e0fb6c8d95", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791311941, "uuid": "3c8272e9-5207-4936-b932-3cc5958f4249", "value": "98304:F0l40xoCdizDBElf9E6Z+b4AMtd9dxfE1z1eaie9jKtsRpr:F0mSZdmD2F95Z+sJd9/sbeqBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791311941, "uuid": "3d2a6d71-9b6a-4bf5-a986-b2e613670fb9", "value": 5366992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791311941, "uuid": "9d4a9029-df44-4552-bb73-7634e86c4d24", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791311941, "uuid": "cb63b597-0d33-4249-b2fc-f89575c5c0ac", "value": "Vlmc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e0d99d-c154-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791270528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270528, "uuid": "ec3363cc-6117-46cc-ae62-bab397c33986", "comment": "Malware payload (Mirai)", "value": "a8c225d38218e51b764310b1826efe8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270528, "uuid": "b8664398-7590-46c8-85a1-96c4aac54eee", "comment": "Malware payload (Mirai)", "value": "c152be10adb1d4034551b84a4d8d4f777d71548166119fb5c5f9b626ce2739f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270528, "uuid": "b37f0939-c99f-4ee7-b43c-ded4a5c568f2", "comment": "Malware payload (Mirai)", "value": "e701b52b8b807bddd58dad211fd6cfa375f675a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270528, "uuid": "ce269f0b-440c-483f-8953-bb29ac4ab72e", "comment": "Malware payload (Mirai)", "value": "052900d2bb4fd9c9f5e19ee08d577ed625a1aac7732b4496d30e20a525eeb72471138b7b5a0183c9d77126bea0d8de91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270528, "uuid": "252553f0-9d57-4ff1-8e21-f42b9f146663", "value": "T109063917FCA545A9C0AEE2358A629253BB717C894B3023D72F50F7782F76BD069B9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270528, "uuid": "94fff98b-15ea-44b7-819f-763bb57c23ed", "value": "49152:NPCL3JgVTBV+bPbrS8wRoQpSu5EnUeO9ucbD6qL:agqrBOhELoD6qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270528, "uuid": "8afed777-39b3-47a0-ad34-5c6aa88358ad", "value": 3854336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270528, "uuid": "202987f4-344c-4a6d-b2bb-c616c3a37471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270528, "uuid": "ce53e240-2578-41b2-bcdc-f40569f61339", "value": "b3.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e91dd38-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271292, "uuid": "ca6adc19-c456-4cc0-a98c-6794dfa80a05", "comment": "Malware payload", "value": "4f6bee6cccbd0d0ba7e9693575874dfd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271292, "uuid": "e1a34a7d-d709-4649-bbd6-b19c1e2e9f0e", "comment": "Malware payload", "value": "c1f6e773451134a0d8cb8ddeddaed24ca6d9f19fa58156fe0ba30374d6715781", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271292, "uuid": "41fa6f61-ead5-47b0-b513-3b5a7640dcd9", "comment": "Malware payload", "value": "21cb74328480bd451263bcc38788b069d2272e9b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271292, "uuid": "720e3993-7a29-4b04-a41d-e79aa3777e4d", "comment": "Malware payload", "value": "d277d23f202cde2834ac281f1d7c8702b929d6271692437711e022347db4b349939b0681494e3d5f90a4fa84c5be4b27", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271292, "uuid": "a60dcf44-50ae-4b91-aee1-85e1ae67fe3e", "value": "T19F55338AC17C1CC49F3E0AD779FF555CA2248EFC200208636B2A59A7253E74FC7B595A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271292, "uuid": "5a30322c-e856-4a0c-821f-0890527619d9", "value": "24576:CPTJsZg556oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRq:CbJZ56oZ9bq+MmMEL+hcjXHC/wnwdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271292, "uuid": "953f8150-34fe-43f3-988c-8d74c65f2e79", "value": 1381613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271292, "uuid": "8ac8256e-28e2-47e9-9a5d-92825adcca83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271292, "uuid": "34a7b588-9d42-4faf-a935-958639d40bf2", "value": "c1f6e773451134a0d8cb8ddeddaed24ca6d9f19fa58156fe0ba30374d6715781.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c63c5e-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273955, "uuid": "0f76743f-f701-4c9e-b473-1947e48f7752", "comment": "Malware payload", "value": "61460fb5499f8d4dafea2f3aec9937c0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273955, "uuid": "2d0639f7-2031-48a0-9454-b2b8bff22681", "comment": "Malware payload", "value": "c2011c12873ad4bbf0f77b0894be3c35e06b5249b11b01facbc97bd0a399ef67", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273955, "uuid": "bcfbe242-c159-40ef-8540-9dbb8253dd05", "comment": "Malware payload", "value": "ca24d7c32d8f997210bb6eb56fa28d1e8908ad44", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273955, "uuid": "5d42ded9-1a59-4078-aef0-7313ff78c324", "comment": "Malware payload", "value": "07abbe793eb95ce23ccda4e5ae2978e96ccee6a5d92bb516e2b3851ec962fcf0c80425d6b72ca3e9b2e2163ce867ccca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273955, "uuid": "fd975738-9be8-4199-adf8-81b7be5d2e0e", "value": "T10CA4236D921594376D67B9D0AD1D2B020A70D18932DDDBD5CE0F38A08EFAC9C1EC61AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273955, "uuid": "ba8e69b3-b8db-4414-8581-5db7a14fb424", "value": "12288:fW+GusvMa+gzYfcEaN9B/Jm0LU0gM7aQx:fWF/vMa8fclN9BhmSHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273955, "uuid": "80b1056a-307b-4b33-b3af-3488e19e3968", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273955, "uuid": "0e7a1d44-86cc-4f4f-a832-7e9a09ef21e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273955, "uuid": "cb612e52-7a25-43bb-86d8-2d9ab06086fb", "value": "c2011c12873ad4bbf0f77b0894be3c35e06b5249b11b01facbc97bd0a399ef67.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9511a82-c184-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791291094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291094, "uuid": "c57c65a5-52ca-4963-b192-e95f7f83c500", "comment": "Malware payload (Mirai)", "value": "88942889877067321dd90a4bee287963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291094, "uuid": "b0e7c3c6-41eb-41d1-a417-eb92a626849a", "comment": "Malware payload (Mirai)", "value": "c21573527acba5560a561d066fab993b86a0a2c7a51b65fb36c53955f1374955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291094, "uuid": "bec5fa24-abe6-43e4-8632-944a61971499", "comment": "Malware payload (Mirai)", "value": "cc9b95eb5e71e8fa9400e903bdf6264bc15fb84a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291094, "uuid": "b8024491-a756-44f1-a4ba-ea6844a6c365", "comment": "Malware payload (Mirai)", "value": "1479f6f6e7398722c1832b04ffd1316bdd71b5660604ce96141b7ba8f658d3541ac62f6bb9478d3e69781429bfb71206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291094, "uuid": "5f8b35dd-37ca-48ee-9088-183b7026a0e3", "value": "T16753E749FA51AB05C9D232FAFB8E418E33176FA8E7F931219D305F9023C5ADB0A75521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291094, "uuid": "0a02c656-6bc9-4d00-921e-21ba55d88e8f", "value": "1536:8RnNF6BGBdHc5r+t7Aq4vEIE2Gl7yhjiwItllKr5r:U/BdHUr+t7Aq4hzpItrKlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791291094, "uuid": "5d388425-64a2-4364-b955-ebb0ee4b7368", "value": 61344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791291094, "uuid": "395a7e75-8777-4d2a-bcc3-1d2212bc6223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291094, "uuid": "c5dceb34-0b48-47c9-8507-91d30de833c3", "value": "main.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261fdd92-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276271, "uuid": "7f9e2118-c171-45f2-9078-953c7f94a349", "comment": "Malware payload", "value": "d0a10d120737a353cfb5f1aa004d5eed", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276271, "uuid": "0a05b7f5-58a7-49f3-b5b3-2fa9ee25824c", "comment": "Malware payload", "value": "c24e58ddebb8653290ed1d8a4585b4aa1db946f22ee481cab8f6f8c82ab11688", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276271, "uuid": "e22bb882-7b67-44af-9b9f-b692e44686a8", "comment": "Malware payload", "value": "b61245bc329589a977131252ccb3b59e6e6f9405", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276271, "uuid": "dc8a24bb-71dc-4bc0-b5ec-d948c619a74f", "comment": "Malware payload", "value": "a837b7263aab9258afd13c53975f6bb27ebf3cbeb74fa43d777b9bae7684ca4d504e851ce6c262620f7f5e660254f536", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276271, "uuid": "5bc54cab-0109-4ec8-bc8a-a79273bd066f", "value": "T1AFA4232C59610F367DB777808A395F02472498073BDDABEAC70F3AA84DDEC905A66748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276271, "uuid": "78ddef86-c6f6-40d2-a59a-c04f8f2e569a", "value": "12288:6/pj5tFltx5309/rzYfcEaN9B/Jm0LU0gM7aQt:6jPFj30BQfclN9BhmSHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276271, "uuid": "51b4b290-b822-439c-b4f7-3434279c126e", "value": 467527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276271, "uuid": "bc650817-e8ea-4dcd-948e-439ee7b7403a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276271, "uuid": "1ed3d077-e74e-4202-a39c-3c24b93b6e18", "value": "c24e58ddebb8653290ed1d8a4585b4aa1db946f22ee481cab8f6f8c82ab11688.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991a1c27-c165-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791277752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277752, "uuid": "984693a9-cfbb-4be3-8c9a-6556ef2fa993", "comment": "Malware payload", "value": "35c9b95455b0f69c675500fb7fe9850b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277752, "uuid": "575d115a-37b0-4b33-80e4-ada3e1f8a1f2", "comment": "Malware payload", "value": "c27403be262aec312ce680d4e89871f00d114bee6c7872374226dc315c9db74e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277752, "uuid": "6144d7a4-3918-4e53-a274-944edc02fec1", "comment": "Malware payload", "value": "ddc155fbb3afb4ee213286729a4ff4f624059000", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277752, "uuid": "f4604279-6bde-46b5-88a7-9cfcdf2b524b", "comment": "Malware payload", "value": "8762ddc39e636722827ef6faa5a101a9bb685e8c7e793ba5ddf6f15760d9cc9e9029d1d7ee069e1dbe10be4efb1b58f4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277752, "uuid": "36c3242e-e2a4-44f0-be8d-388678fd39b5", "value": "T1C2461201BF4AB6BBC5F245379D66C9288C418D4447C3E843A9ADB47D18BB7F0E71AAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277752, "uuid": "23507efd-f061-457a-86dd-056a3a43621d", "value": "98304:aBRLEBgVEFQo7e9skAEAeS4l0xUdU2ARB+gTIDQnvNWNV83SE6c/Ru6WFsws7:BGVEFJe1JAeS4hqD+cIgvNiV83xrPWQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791277752, "uuid": "9e931a5d-f6c2-4849-aae9-2ab40d2ff3a8", "value": 5843940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791277752, "uuid": "44b3df57-7f4a-4dbd-9b69-e5797e905b00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277752, "uuid": "4e1c8520-0ee0-4c18-8885-912ae1484f33", "value": "Cloudflare.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dc8352-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274303, "uuid": "0116b4cf-3fc1-4c98-89f3-d3e7dd04f50a", "comment": "Malware payload", "value": "8b44634dc90ccb1aaee6593fa725373c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274303, "uuid": "4aaf0460-b3ac-4174-a99a-703cbbcdf988", "comment": "Malware payload", "value": "c31b84af71a9769255291c803314aee0607c4eba21c4164ca89a6422d2847e8d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274303, "uuid": "5e91ad78-8037-44a8-afa4-990b1667b93d", "comment": "Malware payload", "value": "67e6b949df95858650ad460ded719f64cf5d253f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274303, "uuid": "99f3ad9c-9f48-45a1-8328-54f39a0d17ef", "comment": "Malware payload", "value": "e79630d2edf7e9b72ea4f5395611a648aacb665fc74d714911fbe28457e34fe5a8897910526e37197f49425a9e56c2b0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274303, "uuid": "cc60a5a9-7503-4fce-b023-8afc981e60f8", "value": "T194B423CCB6CB88CC55A63134E6A20B4154DBBF33B2DF7391B5B849700DE6A6710297AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274303, "uuid": "9cfd7fe1-5dde-4fda-869f-8e8060f4af3b", "value": "12288:UwsK8MG1KnyC/G76u6M0gXar5qdufct2ien3P+bea:cKGcGmuwjXQen3Pwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274303, "uuid": "396cbdff-e36f-4822-93cc-b5186b064446", "value": 515391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274303, "uuid": "2eb38d00-59d7-4f59-945c-2202b4ce0954", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274303, "uuid": "da4533e2-65a2-4635-8f9b-e00fb94a682d", "value": "c31b84af71a9769255291c803314aee0607c4eba21c4164ca89a6422d2847e8d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d599bb-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275140, "uuid": "6926c8d0-7c0b-4d21-a249-8f163c44007f", "comment": "Malware payload", "value": "f963cc9bec91ae2a2aed27c57320e0a2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275140, "uuid": "b3d152ff-f4a4-4714-8b47-b82a3f23a8e6", "comment": "Malware payload", "value": "c31e10cd09a7c250d87136de80a3f99edbfa44b25f9417b27373b8ee27c33fff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275140, "uuid": "4eee704a-e414-4051-9d36-5ce217197266", "comment": "Malware payload", "value": "5893d9c29af20bfa9951352cc1acdf0e78b14747", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275140, "uuid": "add82f58-a37c-47cc-bedc-93227dfa48b5", "comment": "Malware payload", "value": "c26af3b1b039085d38c0acd4e52dedf721fb0b8ca7127c054a39efd3d201a62efcbf3623cd9a621918b968d6608a4b29", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275140, "uuid": "e71e666f-ab50-4829-bfc2-5a3129b0aed1", "value": "T176A423A8A5D06FF6DE773A104D241F160628A50F29EBADAF9F033640CD6DCD056971CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275140, "uuid": "31be71f5-3353-46a3-a4a4-f097a19e8b68", "value": "12288:jzYfcEaN9B/Jm0LU0gM7aQd4HphuCmCJ91YqEZ2:ofclN9BhmSHnSuCmIzq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275140, "uuid": "72ba416f-a0de-427b-bc27-92adcc36fc34", "value": 467850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275140, "uuid": "67d62fe4-9b11-4562-ad21-1fb5b9e7d91f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275140, "uuid": "b29e2de7-92ff-4c99-8386-c7a0883f7037", "value": "c31e10cd09a7c250d87136de80a3f99edbfa44b25f9417b27373b8ee27c33fff.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470ce1db-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273749, "uuid": "c0462c47-5084-4e61-9089-4ec93c4282dd", "comment": "Malware payload", "value": "730f17b29877c7fe8c25e06f383b2497", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273749, "uuid": "b6a5098d-62e2-4011-88d5-7afb8aa10a7b", "comment": "Malware payload", "value": "c3b1038e7f089c915410ca4c2bd0589a4a36143cda9ac02a1c63ff0383bbdcc2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273749, "uuid": "b6751a0e-f02a-4294-ba23-eb13ddfdf688", "comment": "Malware payload", "value": "b474e0d51ab6eee7abca0ef6bba0b0a89373925c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273749, "uuid": "03a5b1fb-f4d8-4270-b36c-50a82f2a7438", "comment": "Malware payload", "value": "ba0f39710ad5ba3a34bf6bcb7b5e78f73022610d8e96c1ee0dcd306f5987cba88608c2d79b9dcce0fb3ec0d7fa5a2f87", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273749, "uuid": "14323588-fbe5-46b5-b694-1b856414ee1f", "value": "T163C4231DA0547B51F64B6A78B323CDB09B2AD03FD219C388A0840B399B5BF5769CD376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273749, "uuid": "b2cadecd-9cb6-41be-b537-b672f85c85ba", "value": "12288:OMU+0xq75aS9iYIp6cP/G2Bku6zXLNHXP427b0:++J71vI/GzXpftH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273749, "uuid": "dd2fb94c-b0af-43be-a8f4-2ffd814de687", "value": 587431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273749, "uuid": "21f8909d-0364-4ef5-80d0-95687073ef9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273749, "uuid": "c1d8901f-67a9-4f38-bb44-e5f4a0a6a162", "value": "c3b1038e7f089c915410ca4c2bd0589a4a36143cda9ac02a1c63ff0383bbdcc2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ead80f-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274169, "uuid": "85943c1b-ccc5-4b0b-85b3-50afff413b4f", "comment": "Malware payload", "value": "4955e651e7f29dc72248c5082acd1bbc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274169, "uuid": "254cd72e-b287-4aad-8a17-2d4f35e7a813", "comment": "Malware payload", "value": "c3bc6249eaaf55234c6f68ad5b32d1b446a114de45343a3b5e58d9cf325696d1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274169, "uuid": "554fa25f-c464-4c22-a701-beeba1f0e2ca", "comment": "Malware payload", "value": "bb75b04a55de17e539f9c35b49b69027bf9857a3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274169, "uuid": "033a57ee-0487-41ea-9b94-0699b8893e24", "comment": "Malware payload", "value": "9cb01d59d28507c4634cede2ee65fafea0952500e6921d9f0bb93ef1a67be7e5131459e765a546737ec13b465150e71b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274169, "uuid": "e2312424-ff05-4496-8f5f-44a5d6160ad4", "value": "T13FB423CE5A286CAC5BE85E838F5DBFDA2CF8413F862411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274169, "uuid": "10555271-d35b-4e04-9782-b09e3c78fbed", "value": "12288:7GRl4nbDDGIabs/7iiEVwYg2l3/2NHSy+wK8q:DTabs/7iiWw0KNxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274169, "uuid": "192ccc99-3ef1-40c3-80f9-42e4a2cbef28", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274169, "uuid": "3386fe14-e153-4815-a5fd-219b35a6dd08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274169, "uuid": "fdb8a83a-dbe3-463b-8298-a3476501bdaa", "value": "c3bc6249eaaf55234c6f68ad5b32d1b446a114de45343a3b5e58d9cf325696d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbb827b-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272288, "uuid": "59d04ad2-644b-48fe-b363-eb5e0f5e3920", "comment": "Malware payload", "value": "82fda0e29cae2c5d972fdd91d39d4f88", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272288, "uuid": "6d92cc90-5dfd-4298-a42c-646d7fee6ba8", "comment": "Malware payload", "value": "c41c950cf5659d56f9b93a12e12409a2d95cd8c04f861b6c3cdb3d3085032f05", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272288, "uuid": "598dbdc8-d183-4a39-9013-e70b1e8bd371", "comment": "Malware payload", "value": "e0c647378b44c34d75f48dd731b0d1becad32ba3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272288, "uuid": "4f1d9602-ce12-4946-a043-cd0ac5dcbd15", "comment": "Malware payload", "value": "4a7d6d322d798a65c363133860b5bf0f825d78fa3510a078fb9b16c14839c43f72749c806d0de4c8349f4959b590d665", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272288, "uuid": "a256262c-18ee-4c1c-b408-792ea110fe69", "value": "T1D7B423F193429E0B23A4DAB457E3DB3375CE7292769D9301CA06CA9F487072886DC16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272288, "uuid": "20c2302d-e56e-46a5-ab67-5fbf513dddb7", "value": "12288:bkmht7DrvdyiPCCH1oHF9nJ/qjuycgoJrrzTPwkt:bkmHzMgH1ELnKcgoJnn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272288, "uuid": "2063dd93-635f-4c21-b5f5-893f18d760ad", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272288, "uuid": "28820f37-7a83-43c8-86f1-308849989b95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272288, "uuid": "ddc2b318-f82a-4f8a-b7b3-8c575655676b", "value": "c41c950cf5659d56f9b93a12e12409a2d95cd8c04f861b6c3cdb3d3085032f05.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79e6a8b-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276139, "uuid": "050fac72-39da-40d8-b8dc-1c46613b1c81", "comment": "Malware payload", "value": "c13e659ecf38da788d64bdc98604a209", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276139, "uuid": "93d228ce-05de-4f80-a7e6-8b3c6e5972cb", "comment": "Malware payload", "value": "c46fc82dcbf92c1d094b4c13fda563e51dff4b4ce37f3b51d979b1f7a092a1f7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276139, "uuid": "9206a387-3688-445b-b1cb-adbd46dc4684", "comment": "Malware payload", "value": "0020b2b1fd976509f459741ce2767184d3ca0fe8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276139, "uuid": "721cd429-56e8-44b5-a25a-bca059a0b823", "comment": "Malware payload", "value": "054b9bc9a4bc69ce9cc3910a2e223bb646bf1984bb1f8bb63d3f47ee989a6f6ca73640f9752bb68369a0451b401391f7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276139, "uuid": "ab34b5d3-4e95-4ffe-9cdb-5a7a915b7fe7", "value": "T1BFA4238274716D06D0A6CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276139, "uuid": "3303a1ee-b2b9-4826-bb46-b4ac35ca30c3", "value": "12288:8r06jUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZr:8r06jUv4t1cNk/wjibhv4b2Onp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276139, "uuid": "a741ddd1-a452-44b4-adcb-1de8a9cfea69", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276139, "uuid": "843a8380-e0cc-4051-96ad-079d22c82169", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276139, "uuid": "55549607-c36c-493b-89f2-f94112ec7649", "value": "c46fc82dcbf92c1d094b4c13fda563e51dff4b4ce37f3b51d979b1f7a092a1f7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4205f7-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288306, "uuid": "e34432d7-f661-4556-bf18-24dd4c88ef0b", "comment": "Malware payload (Mirai)", "value": "c7088c32f8046df716eaa8345e8caaf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288306, "uuid": "ea81c753-b2d8-4296-858a-59e244d22240", "comment": "Malware payload (Mirai)", "value": "c4cbb608271f541be9fdbc2e55e50ad154c707856879509a77ff8c8206525d87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288306, "uuid": "abcfcab6-e635-4bf6-adf6-8629512e141a", "comment": "Malware payload (Mirai)", "value": "8c9fa015227d2d11b9cbf0dc2cfc51a65c025f24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288306, "uuid": "70561b54-7f78-4f52-b01c-6c085a1c81bd", "comment": "Malware payload (Mirai)", "value": "654f3fd54ee42b513ecaa3460a4e036d6882d9f6205792e3880aac5609b3b9898665ff9611661166f025cc14164c81eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288306, "uuid": "35bf6e4c-9fed-4179-a1d2-3a61b723e4c1", "value": "T1D1E2F1D649B7A879CEB21D7BF823074D252EC6FCC6BB112367B4362423B49D64AB0403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288306, "uuid": "69012934-eafb-46e6-a334-a321afdbe55c", "value": "768:q8Lm6COq1fewdHy62pud4yNOYSOyB8Lr3E9q3UELdy:zLJCmjpkcMKUpLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288306, "uuid": "de4aaf93-9441-4ec8-a8a2-5c860e34d3a1", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288306, "uuid": "79438ef0-33fb-418a-b980-cce3179b7ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288306, "uuid": "2aee6865-037c-4236-bc57-e1db2f670629", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14183cf-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274894, "uuid": "b2025302-251d-4ed5-a42c-c7f12f21efae", "comment": "Malware payload", "value": "8383df8437807aa29b26c3dd1d6c9384", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274894, "uuid": "174c9b34-1d78-4bed-8e6a-1f55aa0c9f3f", "comment": "Malware payload", "value": "c569169f0d2fb617435c7c490abb875da9e4a21e5f97d6bac35d182390c85625", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274894, "uuid": "558186a7-851f-4ea8-83fe-53b83a7b7f2c", "comment": "Malware payload", "value": "97338e865d8eab57d6b951d4faaaa65153cd3838", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274894, "uuid": "99e1a09d-38a9-4f9e-9455-c6fde197bb79", "comment": "Malware payload", "value": "72682e84eaeaad6005a02dbe940f38e190b3873c32c65ceedd2b1d51d70df9908b378ade8bf781413e99b2a798151a4a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274894, "uuid": "a2f32b7d-8555-47a3-9cb7-8a71a75027ab", "value": "T13BA4236CD5820E71BCD336202F885F401B60A41A76ADEAF5DB2F32644DEEC784DD99C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274894, "uuid": "e4b75975-d63c-452c-b792-b6e5b0c01f44", "value": "12288:FLSl5r0s3bmIzYfcEaN9B/Jm0LU0gM7aQQ:9Q3bmXfclN9BhmSHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274894, "uuid": "5a7c1f76-95af-4ab6-ac88-3a20578791df", "value": 467443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274894, "uuid": "be4fdf81-f4d1-484f-8958-24bb5feb8a62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274894, "uuid": "4108c62c-02f9-4864-84da-5e506b5dde4e", "value": "c569169f0d2fb617435c7c490abb875da9e4a21e5f97d6bac35d182390c85625.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323bfb87-c19d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301632, "uuid": "52b6e495-9d12-421e-bd79-a053b08e791c", "comment": "Malware payload", "value": "b3d31f6f3975114fcf049abe94394cbf", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301632, "uuid": "6cd41d2d-aabc-4db6-814e-621efaad17b5", "comment": "Malware payload", "value": "c5d79a9b49de4d96d893fa71d3bcce2e3e4b6e5cfc45ce6e39c18c51110df66b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301632, "uuid": "1810c70f-18ac-4714-9ebd-765a632d8f86", "comment": "Malware payload", "value": "fa0aeb8b6ab9fce33138ae5daab1150f02cbe829", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301632, "uuid": "0007e565-7e24-40b5-a29d-e7634ed04fd2", "comment": "Malware payload", "value": "e2153e7af20a670d8b8322990474e98c9f3e2a21417e688c90a486a9cd6d1a0cb450d7e422ce50c3c35ebb2df94ce584", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301632, "uuid": "c01cc2ce-0d0a-4713-b044-e62018040bfc", "value": "T182350112F76FAD63D8375370B8214A51FCF961C8E9C9F01713EB8662CA4F4992B4825E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301632, "uuid": "a787be18-1c73-4c04-9975-985f788a0e70", "value": "24576:dAdz4ONfkFpny7w8Hik0JyJIpU/DRPaDgQmenCX/swIlb:wfYpy7wfkUyJx/DRPaDgXx/s3lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301632, "uuid": "40d2bb1a-9a9e-4ff5-ad8e-e5dff9489d23", "value": 1121204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301632, "uuid": "fa331416-bb82-41d2-b3e0-b122c117aee5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301632, "uuid": "18e67dfd-bca9-4028-856b-7aa341ed09ef", "value": "VieClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437fe709-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273314, "uuid": "58de2c15-79e9-4a32-b1fe-79fed26ab927", "comment": "Malware payload", "value": "a7ff57a0f3a218c1a7478104b6009545", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273314, "uuid": "e338806c-7ee2-499f-94ae-50101e71d0c8", "comment": "Malware payload", "value": "c6e38eeb0fc38d0e6960ed5e296e3f1c480f4f13e9cfe987f38333259759d24f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273314, "uuid": "a680847f-b902-4d63-a5e3-8c86fcee7855", "comment": "Malware payload", "value": "f6e8fc0e00bf1c688bc9434860e09bec3be7e40d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273314, "uuid": "1bd784a9-1e9e-4d53-a1ae-d526b88468f3", "comment": "Malware payload", "value": "6004058bb27726d67fcdc2043cd872282cc30f890bf8cdde1abba42b152713c5a1e1624c8c0f1193036f7549075d6c76", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273314, "uuid": "654f86e2-12eb-4245-ace6-7b3642482628", "value": "T192D22214A7D8886CB8EBED091EB09A576C672D2B673353243C81033D66B07FA9C52D79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273314, "uuid": "aea2e899-5e22-4b09-945a-d2f29df1e282", "value": "192:vfyNwUqPEmAL6pDdZFkfoOfRj2COTThebslY8LKXkKUH/6qellp4Inps67Nsv1o9:yNoQEGYroLpWeWWtnmEpdcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273314, "uuid": "db8d32d2-6f13-452b-8342-53b783233404", "value": 29578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273314, "uuid": "627c5f69-5fe9-48a5-b845-def34b9a85bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273314, "uuid": "73d74fb3-ef89-402b-9377-cc09f21fa93a", "value": "PO 0138801.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3ee346-c143-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791263021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263021, "uuid": "c91fea2b-7f4f-4953-abef-3760821562c1", "comment": "Malware payload", "value": "0e6ea7209119a2de5763af56d8206c27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263021, "uuid": "cf726872-1208-4be8-a0ae-a57eb9fa5b63", "comment": "Malware payload", "value": "c6f9260c9b1cebcaef47a7a944f656c9d8abfbbfe73cc7e9c0ea4eb0343e5a54", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263021, "uuid": "f919bb37-e7cd-4568-844f-c111c5822bab", "comment": "Malware payload", "value": "a0ac68db0d77b084742eddb99f69c38ce30a50d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263021, "uuid": "64cd569f-bf1e-4220-a0e4-54b971ba26f6", "comment": "Malware payload", "value": "a4dbcafbaf988f7b66bd999503ee7635b8abf3b267cec4dfb76d876db696843c892940596cc0f5d30b774e4e4ea4c7bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263021, "uuid": "e53ce069-b275-41b2-8547-40620015eec8", "value": "T19B7733C476C508C7F64B433EDCD265A68AEAFAB91725C11B8BB8C1421D672E4ED3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263021, "uuid": "b9c9aeb9-11b0-42a6-acd0-4b1f8a7c0b98", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263021, "uuid": "7342ee23-3b21-4def-9bae-8d13d5b41230", "value": "786432:qY0W0b4QL0wFlUR1OHYcW8+3nGCnkvqaV+sEbnFiVxvi2nRyeYB+fMNtpHf4:qYxhQL0wEW3WN3nGCnkSaV+BbnYk/Nta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263021, "uuid": "b9b2600a-e137-4765-8b15-d2e8a56fdf7e", "value": 35889685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263021, "uuid": "fdd495d3-9de4-4218-be6f-1895879d5051", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263021, "uuid": "b571f14a-f251-42c8-b3fd-bf75bf2544dd", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50005c7-c147-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791264995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264995, "uuid": "b299508d-950a-4a00-808c-b41fcc73c7a5", "comment": "Malware payload (Gafgyt)", "value": "bceaecb0c20dcaaaf2184d63e4b92ca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264995, "uuid": "827bc484-bdfd-4a91-a274-47e9cb680529", "comment": "Malware payload (Gafgyt)", "value": "c749b54ba8d032787dc4c990d63ceca1e43cdf49aed74775931ad3a73558cf0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264995, "uuid": "f5861bca-992e-4680-905b-ba1a46a3f3a6", "comment": "Malware payload (Gafgyt)", "value": "6ee3de4dd50cc934c0c59970f137df7527f79368", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264995, "uuid": "b470a766-b404-428b-966a-a2198f4aa9ec", "comment": "Malware payload (Gafgyt)", "value": "6a06f92fc780f690ade891f89d7f38a5f165264d95d9380a835888a3f38ce6d5dd99c154435f2bf6fea66d8c56bbde48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264995, "uuid": "579f1544-9c8a-42fe-a1a7-5d6272c1c2b0", "value": "T1C3E3F4CCFD64476FC2C223BAF749428F37261A78979BF32159A7E9B02BC57481D28191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264995, "uuid": "59736720-7593-4f84-94fd-cf1ec2c18eaf", "value": "3072:kklR8BGM3+mgYwGMyaRgi8KGqiPc+k3WL7tX8h3GbF2lLothTpKkinzrVoyuz0DR:HzrV7S0YWBTcnExD6knQCquS5hA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264995, "uuid": "9ff199bc-e0da-4441-9293-df53043feef4", "value": 147867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264995, "uuid": "3617c7e1-a767-40e4-b923-a1120ea1fd06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264995, "uuid": "02fb0c05-2ff2-4d4f-865f-0e4f843512c1", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdf1d3b-c141-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791262456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262456, "uuid": "0018986d-6712-41e9-b204-17e5e920d29b", "comment": "Malware payload (ConnectWise)", "value": "cd44fdd1585f6be07433627dbf3aa5f2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262456, "uuid": "9542e3c3-5e09-4e6e-a3c2-82275a92e8fa", "comment": "Malware payload (ConnectWise)", "value": "c76e92a033cbe870d282303a146c11a4dce6741169f892cbd482be21a7411cf8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262456, "uuid": "f0ee49b6-aa1a-4fe7-a1da-f15601f5e948", "comment": "Malware payload (ConnectWise)", "value": "31148865f30bd59de756a9b41925659929c1f54b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262456, "uuid": "bc9d9795-b195-474f-932a-83b03a09dcd0", "comment": "Malware payload (ConnectWise)", "value": "593e96cf178e8a36e119931be82b2ef19f2df3ac3b1fd46b704a5e26b3029d4e62405e41b221509261657f454e34b06b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262456, "uuid": "d97aac64-355a-4992-bb16-5848642add21", "value": "T1C646E111B3D995B9D4BF063CD87A82A99A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262456, "uuid": "f5de47ca-1257-4ae0-93b3-8dbb6f037574", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262456, "uuid": "e224c4a1-a9ee-4555-9a25-84c4590a3384", "value": "49152:kEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:tEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262456, "uuid": "30da6c5a-7515-4489-b0b9-8fbb965a885c", "value": 5622096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262456, "uuid": "80021537-ba97-47fa-b99f-85a6a89ea39c", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262456, "uuid": "ae903dfd-4140-47d5-a830-0bee60e218fe", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9791c6-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272529, "uuid": "2a2748bd-f074-4233-8bf3-b78a234554f9", "comment": "Malware payload", "value": "c61dd93abccc09dd1867425616b095f6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272529, "uuid": "0308d06e-078c-4b08-a064-54f77c976fa7", "comment": "Malware payload", "value": "c7adc9a5222677b3a4bd5b11184160d8679847ab8c2110e33004126743e5b4bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272529, "uuid": "49f334fc-72fb-46ea-87f9-ad3c8292a665", "comment": "Malware payload", "value": "f6f26beda33aa874ff3c858afb8d19d50d4ce4b4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272529, "uuid": "c53811ec-0c25-43bf-9844-8def9dc2af1e", "comment": "Malware payload", "value": "0f5e21fdb73bc46d5c12ef6a4a29b01afdd9bedef9857d8cba5ae2a57dd62fc80b9c1a38002891f80910378b0c1ea1b9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272529, "uuid": "e0aa5d78-2d32-4d23-b3d8-912ac975d029", "value": "T186C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272529, "uuid": "51b53384-b04d-4190-9167-4ef6007a9f13", "value": "12288:/+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byFH9I1P0QKw6FEd:/+QqldA/TSO713u7xnFH9IaQKHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272529, "uuid": "2434aae5-5015-4a08-a825-eceafde7e16d", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272529, "uuid": "bb8d4ac8-d4df-4ef9-945d-f4ade9d24e86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272529, "uuid": "37304fef-3f1a-45b8-8e64-077d0f41cdcb", "value": "c7adc9a5222677b3a4bd5b11184160d8679847ab8c2110e33004126743e5b4bc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dc6e0d-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274022, "uuid": "ce26b84a-9a36-4f4e-b99d-5f2465608aac", "comment": "Malware payload", "value": "9e5e878d19ae486001b727a0be266e36", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274022, "uuid": "e54e9351-a08e-43a3-8c8f-e3bd30b302a7", "comment": "Malware payload", "value": "c7c89c4c21376909d044aed7512b88225e97e5109b19dfa8ee75e2019dd88db4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274022, "uuid": "f2318c5b-ab5d-4ef8-a253-7fdd13d10cff", "comment": "Malware payload", "value": "3d3730d30202596c799236eb0e072d8444717fca", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274022, "uuid": "4ae0b0f8-819d-4b8d-a650-2015306bf352", "comment": "Malware payload", "value": "f9b70e00383f6b71d7a21a4da4de4638ce9ea714da64579035f3fa49c469b2bd0f7391aab29a2dffc522c97e1e4d6240", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274022, "uuid": "faada5d0-6e96-4272-a107-4e98a4ff47bb", "value": "T10FC4231DA0547B51F64B6A78B323CDB09B2AD03FD219C388A0840B399B5BE5769CD376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274022, "uuid": "d2f7e647-3fc9-4a0d-b961-f8474e756210", "value": "12288:qMU+0xq75aS9iYIp6cP/G2Bku6zXL5HXP427bY:C+J71vI/GzXVftHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274022, "uuid": "1dda5375-462e-4b57-993d-bc2f94351dd2", "value": 587431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274022, "uuid": "e8cd7f25-af06-4b65-afee-913dc7642f43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274022, "uuid": "ad8d8e1a-1c7a-4779-bc1b-dc8447e794b9", "value": "c7c89c4c21376909d044aed7512b88225e97e5109b19dfa8ee75e2019dd88db4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409717ad-c16d-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791281040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281040, "uuid": "a672428e-8c51-43fc-a705-08b3f33553cc", "comment": "Malware payload (AgentTesla)", "value": "9efd1cf07f82d064b4c6913b7e81b692", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281040, "uuid": "358da9e5-dd01-494c-a20d-a722fddc0b7c", "comment": "Malware payload (AgentTesla)", "value": "c8398ab9792e1e89b1258484cdb5156d6bee564171d0865bde2315b93e07dc8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281040, "uuid": "1e7af5ce-1e23-4eb0-b904-d2890e9846de", "comment": "Malware payload (AgentTesla)", "value": "848c8a7a27dce01cab7ffda01280d2fa846eaf21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281040, "uuid": "cb54c452-c76a-4ab0-b32e-3e7f9e1d626f", "comment": "Malware payload (AgentTesla)", "value": "182780d271f6b7e798e355fadd17df1c7c47379756b6fe9612b155beba963fbee91b5e5d6c19935425199cae6fb03a56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281040, "uuid": "adfafe92-cb0a-4e0c-8e18-152ed42f52ed", "value": "T120E4F0884804C561051C835DDB9B47050EFBB5C0450CCEAAE7D8BBD26BDD9A19CEBFBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281040, "uuid": "9b01f31b-ebcf-4918-9942-3ffeb2fcf5be", "value": "12288:PP7SNAeSGSo3DgqXEIUah1yImuIqnGvciYYqM3Gv3m16TPFhxWEs3aK0G6p8fSLx:3olpxUahMIIOGP9qMuo68eJ+fSLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791281040, "uuid": "154667da-e3f6-464c-99d8-c53b9996f845", "value": 664086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791281040, "uuid": "1e0537b4-1768-4af9-8d11-e7630165f207", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281040, "uuid": "7f470adc-8046-4521-bdaa-5d832fb19b35", "value": "Purchase_Orders 6000310102700267992_for_Approval Globus Incorporated FZE_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230c77ee-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272400, "uuid": "0ba4ada6-1a7c-4b2f-8416-6e1b0671bdb6", "comment": "Malware payload", "value": "30f28981fafd7a794ff2dbf4231ea52d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272400, "uuid": "3b2af7b7-c6ea-4d1f-9a26-05dc42985700", "comment": "Malware payload", "value": "c902d0f4d467c9c1a4dfab213382de478642249c70f6e93451d27232e7f2ac9d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272400, "uuid": "e376e86f-acee-435d-bdfb-ce95c2820cd0", "comment": "Malware payload", "value": "de800e788964ed96e6848b2aac124cce039d0ba0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272400, "uuid": "70a6f391-a52e-41f2-a99f-e398a28582aa", "comment": "Malware payload", "value": "5e56f38d754d1440f68d57004e2693c6aa01d5896933a47e0cb4ba228a7ca53ec58e4e4fc7059cd10810b1984210778b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272400, "uuid": "a5232072-b3f1-4242-abf4-e72eba07124b", "value": "T17EA4236D922554376D67B9D0AD1D2B020A70D18932DDDBD5CE0F38A08EFAC9C1FC61AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272400, "uuid": "1f612798-13bd-4da0-9359-28dbf0a77d91", "value": "12288:DW+GusvMa+UzYfcEaN9B/Jm0LU0gM7aQx:DWF/vMaYfclN9BhmSHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272400, "uuid": "5f7e1728-36a2-4e49-9770-76b6edc22df8", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272400, "uuid": "859539c8-c6ab-4f85-8072-f98a69bed703", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272400, "uuid": "6e0677fd-e218-4d27-979e-0e4c69808a05", "value": "c902d0f4d467c9c1a4dfab213382de478642249c70f6e93451d27232e7f2ac9d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ebce42-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274586, "uuid": "f8e8024e-cb2d-4189-addc-093ddc266295", "comment": "Malware payload", "value": "1d3fd303713a20cfd7604e3834ac8832", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274586, "uuid": "65399568-48fd-4497-a2be-46b88722c814", "comment": "Malware payload", "value": "c946af32cb5a278e8ba9232cd5c3368985e510889fb6490324eed442bc56b525", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274586, "uuid": "c53c70dc-d767-43d4-be87-7af498def45f", "comment": "Malware payload", "value": "16d63b1a71abd184149c8b75793a4d95c6e47fc1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274586, "uuid": "0436bb65-886d-46ba-b3d9-6c410757ac1f", "comment": "Malware payload", "value": "de892f4cb0232bb4dc2da2e64487c869df9f3bcfd78103846a134322f76ae75e02c92d0d682b9ef3625a1e0080ae4070", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274586, "uuid": "2d0b67d4-280f-442f-8d3c-e6a829327e84", "value": "T12FB423CE5A286CAC5BE85E834F5DBFDA2CF8413F862411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274586, "uuid": "c00c942c-672a-4863-b91a-4664990e9a1d", "value": "12288:1GRl4nbDDGIabs/7iiEVwYg2l3/2NHby+wK81:pTabs/7iiWw0K2x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274586, "uuid": "a4ce83f3-2cb2-4131-9830-396b52ab24db", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274586, "uuid": "0168aef0-10e0-48c4-99ff-9fac88a4f7f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274586, "uuid": "eb5c44e4-08e1-4ddf-b62a-bdf0d8f1ef3f", "value": "c946af32cb5a278e8ba9232cd5c3368985e510889fb6490324eed442bc56b525.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af8baf4-c14a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266079, "uuid": "29b0367e-5054-4949-8c81-ea96d08f226d", "comment": "Malware payload (Mirai)", "value": "baf92a644880788e5e5414a673d3eff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266079, "uuid": "82e4079d-7bc8-455e-8211-57ffc2c32b85", "comment": "Malware payload (Mirai)", "value": "c96d08e2163b1fac0fa653d30dabf6735069db40b0b8c0883d455f0b8b5ec4c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266079, "uuid": "ae07403b-bb6d-4c84-bcaa-3a70292b2f95", "comment": "Malware payload (Mirai)", "value": "b378b1637c7d647eff7f64498b260b9a4c8e535f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266079, "uuid": "cca7c10e-cbb8-4d74-b564-18093b34c43c", "comment": "Malware payload (Mirai)", "value": "44745433a761acc5c922f6cdd8ffc12ffc23635b9f7f28bd1f518052fb77dd6b1de2272c4db2da5d7ebb5183606c3f56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266079, "uuid": "920449c4-4b6e-43b1-92cb-4075eb8cfd90", "value": "T158B44C87BA01DDB7F446A336845389057120BB73D8825F37703A787DEF7A1A85522BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266079, "uuid": "61620670-3173-4d4b-bb47-b0fe7b2bd810", "value": "6144:+xR1T3nfbJ+J3/s4HKFueIBvmE/x/3sMism6X8Ay146VwEEokUgLOmyNIqqDLEoU:w17n9yfZZmplE67qn60mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266079, "uuid": "2dc50fc7-62dc-4b5f-9c93-1745882ac590", "value": 531372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266079, "uuid": "ba3879f8-9ba6-491b-86f2-814ee1cb47e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266079, "uuid": "38cc87f2-faca-4f18-8c30-0a3bb67e51dc", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919ca674-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273445, "uuid": "b2c6cde3-947f-4817-9574-dea5ce04811b", "comment": "Malware payload", "value": "3ee5f2ae575d149cf4d2c3b721acd117", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273445, "uuid": "8630f306-9b01-4f4b-a8c5-9303a72fe848", "comment": "Malware payload", "value": "c990fd4ff5328d9c60bb5f5d50f8beda0a99f35850aee3d030dde606dd0b5ed6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273445, "uuid": "fed3c674-0a07-4134-a993-0fa84350fd3b", "comment": "Malware payload", "value": "0c434a96bb43979781e2a363e222e4d90672f1ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273445, "uuid": "2512ab00-de6f-42f8-b910-76aa767cc0cb", "comment": "Malware payload", "value": "759e5da36fb4333f1dcc41ee4d5386489f72ebfc43dab2f93b1260b98ca7d15a55f822abdcad6f7d6c3322d47742aa2d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273445, "uuid": "1a0d3a70-3278-4843-845d-b4344ddaf6ba", "value": "T1E6A42394C1B857962448E3F9017F19AE5F302CB6CA3DA78E901FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273445, "uuid": "7b583a3f-1907-4523-b3cc-b91e6128c3cb", "value": "12288:qSCDe0U+m1V6ECbniSPfS3e2R3feeintFckkTsuC8hHe:qDe0wUTiSWzeeiwsP8de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273445, "uuid": "b0f46aec-f5b1-406a-b04c-25b96cee2503", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273445, "uuid": "4a662d3a-3a82-4aeb-94bc-9c8296eba054", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273445, "uuid": "d14be48d-ff48-4f1c-a7dd-a2af7ebd795f", "value": "c990fd4ff5328d9c60bb5f5d50f8beda0a99f35850aee3d030dde606dd0b5ed6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64414b74-c182-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791290119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290119, "uuid": "d2190175-c9ae-402a-b339-5a2dd73f4969", "comment": "Malware payload", "value": "aa9d49d2dfe8b578250e2fcdfefcd696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290119, "uuid": "a1607029-39b0-4130-9ba6-d753297658de", "comment": "Malware payload", "value": "c9f1619235ad7752f2709402bf2a207cdc6e3a78ff8071f51385172ba1396dcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290119, "uuid": "e7a2d8ad-d590-401c-8dcd-128bf8fd799f", "comment": "Malware payload", "value": "78e3c59350485f835dea9ee208493b14148df2b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290119, "uuid": "e71282d8-7515-41e6-b851-e1bedf53a625", "comment": "Malware payload", "value": "a44eba29b3590f03aea49136134b75cb1943b34ed49971036e3b0dcedfae07b479fff67ac4379c7b7d902d3714c5c3e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290119, "uuid": "d5e43005-5dce-4421-aef8-252f40ca8575", "value": "T14D664A53EC6518A9C0AED5708A769253BF317C491B3063D31B90F6283F73BE0AAB9754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290119, "uuid": "6be4e9a8-1e90-4aa7-9a1d-b4a9873a97d5", "value": "49152:JfwfV/VxS7J//DPvb5rij3F5p4VGjaNZg1hmSzMf7c8zN31zJOsLdKHK5K2NIHrT:9s67tbA3BOs1hlWN1zpvTEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290119, "uuid": "c565f15b-3b23-40fa-b8dc-d600dd3a4c86", "value": 6774944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290119, "uuid": "3c2947cf-8570-44aa-894d-3fe6ed59a7e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290119, "uuid": "21ec637c-f6af-4d1d-8d27-79fb68546f51", "value": "agent_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0254bf7a-c14a-11f1-927a-4201ac107004", "comment": "Malware payload (RustyStealer)", "timestamp": 1791265903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265903, "uuid": "e1206272-e3a6-40a4-9ed9-0fc310f6fdce", "comment": "Malware payload (RustyStealer)", "value": "df241bd3374ab72337100903f4ee161e", "object_relation": "md5", "Tag": [ { "name": "Antino", "colour": "#D1F5AE", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265903, "uuid": "3d8df7d4-55da-458a-91bb-61035f3d3b97", "comment": "Malware payload (RustyStealer)", "value": "ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800", "object_relation": "sha256", "Tag": [ { "name": "Antino", "colour": "#D1F5AE", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265903, "uuid": "09c84773-0271-42f3-9368-a412ad07ce78", "comment": "Malware payload (RustyStealer)", "value": "5fc2fc9f15d522d5ca88d99f4bbeb45884215cd6", "object_relation": "sha1", "Tag": [ { "name": "Antino", "colour": "#D1F5AE", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265903, "uuid": "1c3f4a5d-f1f3-408f-a34c-42196263a628", "comment": "Malware payload (RustyStealer)", "value": "240c51a09590b118a1c22243efba80bec238d8d6ec2fa9ee07266a4fc2e13ff1e66271fb4dea164ffd98922a67667130", "object_relation": "sha3-384", "Tag": [ { "name": "Antino", "colour": "#D1F5AE", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265903, "uuid": "80cab1ea-7a37-4fd7-9839-1161b3193926", "value": "T121063913F651A09EC16AC178835A6232F6B2B8C9073079FF5FD09B302E65ED0663D799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265903, "uuid": "fe1d2b86-5b27-4b15-aa85-cfef25af3a23", "value": "49152:kSk2I9aZxyzXVdj2V+9qv+Zvo43/Y/CMInIwoif/Ta4RIU6iGd+X:k+u4lvIQ6rO4m+Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791265903, "uuid": "a4ab37cf-cd9b-4bf7-bda7-78753656dbb8", "value": 3747328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791265903, "uuid": "363ac76b-df5d-4b69-9bfc-b54c4f529c98", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265903, "uuid": "c44ce1f4-1e14-4a32-b915-7acd2b384dfd", "value": "ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c10197-c18d-11f1-927a-4201ac107004", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1791294739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294739, "uuid": "54112237-a4ec-4b52-9bf2-b4c9aa3829bb", "comment": "Malware payload (QuirkyLoader)", "value": "61401e999d0655f1f3f49e71d43f4347", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294739, "uuid": "53db0b47-04de-46d8-8585-061c3753ce28", "comment": "Malware payload (QuirkyLoader)", "value": "ca5b62520e1452a26b3c83357d36bf0b3bf88db37a0bc8050062be4bd0851a16", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294739, "uuid": "3aed6a03-62d0-49fc-80f8-e20f0a3e90bb", "comment": "Malware payload (QuirkyLoader)", "value": "8e31088cdb560079a13e139096e4941e14577b0a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791294739, "uuid": "ba1e06c1-cbb1-4e50-8d4b-ba5290bd4778", "comment": "Malware payload (QuirkyLoader)", "value": "5339adc0146042f479c9f80107ceb221b956e67b5bdda1e6b5be31f35de72f7b696f3711c2f0d7a1c750e7f974e264d1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294739, "uuid": "0c4db89d-830d-4356-a5e3-54dd5b02b805", "value": "T1EAB5CF16E3E401B4D52BD274CA568333E6B1B8552B34A5CF07A5EA592F33AD09B3F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294739, "uuid": "deba2600-6e36-44f3-bb98-5d239d49b139", "value": "782c5940d8169553a41932a7e5c50ff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294739, "uuid": "9de75784-8922-4d12-832c-8401cc277718", "value": "49152:VlZWyo/+qgcWDU4bA5Zh67nCjJLTY/S71bPnoVHd8JWO:yXh6gJJ71oqJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791294739, "uuid": "e32d2331-eb36-4dbc-a68e-c28c8b26afb5", "value": 2285056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791294739, "uuid": "713d717d-aa30-4c1e-9d26-caed8293447b", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791294739, "uuid": "bf9177a9-b00f-48a9-959f-4950921b621b", "value": "newisbest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef2c245-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303103, "uuid": "0e62a7fa-c295-4414-88f3-5ccdccf9c693", "comment": "Malware payload (Mirai)", "value": "bb896be1866c32d1fb3923a2aa70920b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303103, "uuid": "f8caa277-16fc-4c34-9fdb-dbe4dfafcbc6", "comment": "Malware payload (Mirai)", "value": "ca7572bfa387832fa4e8656fddb1f1ef6a5f82a3482fc0e8a38c7b3b367edff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303103, "uuid": "e05f43be-74ee-4cf1-b2cd-0cf5f2f94f21", "comment": "Malware payload (Mirai)", "value": "d1074f406ae5c66aa95d5a655514b2e137a5db42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303103, "uuid": "c5b36a54-b645-4759-a970-0df7362e9c9d", "comment": "Malware payload (Mirai)", "value": "6ab2bf34baf5f72d97ce6d6687b138f4fc660af3330c06b2f477b96888edf5b4790063ff5d4e8192fed9125bc81966ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303103, "uuid": "5a7d2da4-7381-416d-a6e1-495cf9d70e13", "value": "T12ED46C56BC919B91C6D24ABBFBAE4368731757B9D2FF7007CA045F903BDA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303103, "uuid": "133c72ca-b9cc-4bfb-841e-47b5e9fe7cd8", "value": "12288:eip6hHS6KBB8SElcE4aJDvVY35nOvw8WgArlnKd1e:n6h/O8SElcE4aJDv238Nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303103, "uuid": "4a5bb5c1-eaf7-48d0-8411-090931580283", "value": 629896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303103, "uuid": "e6d20269-0157-4ecc-873d-5a6d1b53aa2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303103, "uuid": "2e7903db-8501-48bc-b1a9-80c4fe700b91", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69afbf6b-c14a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791266077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266077, "uuid": "a493ef06-444f-414e-b745-786ee2470188", "comment": "Malware payload (Mirai)", "value": "b0b890e49377c0408221bf7221e4add4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266077, "uuid": "c561a211-699d-4fd4-a7e8-ed18fe4b40c2", "comment": "Malware payload (Mirai)", "value": "ca8686e0a699624e8df0d558af680a5ddbda7522b19258e7d200c9062cc68d97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266077, "uuid": "ca1c7d44-c3e0-42e3-a238-6fd20515f6cd", "comment": "Malware payload (Mirai)", "value": "8a37197fed868a5254ba8758b5c23d5c94bf4a10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791266077, "uuid": "f9e3b32f-18ac-4739-8987-b694c5a749e7", "comment": "Malware payload (Mirai)", "value": "310c32c439f00a5df62b52cb68fcbbbed9b3516b10ebd81db7b7d24e04ae1ac14b7fed7b21bd57282368272c5fc67071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266077, "uuid": "1ebd9ffa-a00c-4098-ac31-011fc49b248d", "value": "T10C758D4AB2F364BCC067C430878FCB629935B86511227D7B75C4AA342E66E705B2DF63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266077, "uuid": "7da3a7fd-1494-491a-b23e-8a2ab3860b7a", "value": "24576:A7kDsBuXkrD7Vcl5TjW2SMXw5PqFGr6wm8QfSwbZ:MkA80LVcl5XW2tXw5PqFfwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791266077, "uuid": "956e8725-a7b9-4747-81c5-8499649bcb7f", "value": 1673608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791266077, "uuid": "8cc36d91-56ad-437d-81cc-aa248048b30a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791266077, "uuid": "853b2ade-177c-4f5a-994b-77c976c07410", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd873da-c196-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791298670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298670, "uuid": "72434d63-e363-45d7-885f-03a6538343ac", "comment": "Malware payload (Mirai)", "value": "04b2c6df4c73cac71abc7fe85ee82408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298670, "uuid": "21aae6af-8358-43af-b08a-fba1f026456d", "comment": "Malware payload (Mirai)", "value": "ca99453d28f3a530faee0a0d7402985d37f9ee1162f8b5f5c3f332209a501945", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298670, "uuid": "60117ce0-6aa0-4421-a4ba-c98d5976c380", "comment": "Malware payload (Mirai)", "value": "e133feb5d31b654550aa22158a1af72b0b8e6896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298670, "uuid": "5196393a-a22f-4bf9-b732-43b235987d0f", "comment": "Malware payload (Mirai)", "value": "a539a7600573d80c97e2a76246b1a5749d3b01f97db0ebcf205bafbd0ad4ec33967bcfb0c7af85c8a553c0577c83ea54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298670, "uuid": "6677a626-10d3-49cd-b870-040bbe2565b4", "value": "T10AD3E8CEF802DF76F50AA636C4C30A1772B0BB750A52D62172CBF96699371D43826BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298670, "uuid": "d382abf6-02c1-452c-a36e-6d0c3be0878a", "value": "3072:Cnv9B2P7/aY9zw5HrYIou1vA6yESPbMHD7JoYWBthL15:+9B2Pja9LYIN1zyE0WD7JoYWBthL15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298670, "uuid": "c1891b63-034a-404c-bcbb-f78dbff96892", "value": 134925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298670, "uuid": "1b6eba81-9600-414d-97af-4288993f9568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298670, "uuid": "3934af4a-4af9-4d12-87ab-a74357215807", "value": "kernal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ef2e74-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274264, "uuid": "e6caa1cf-0185-4663-9b4f-5f6d84b9dcb6", "comment": "Malware payload", "value": "5c91431d1a14d8e23c1ca73d141b5cbf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274264, "uuid": "e7282a45-a9bc-4609-8aed-70fce5a2dae5", "comment": "Malware payload", "value": "cabe1371ab5b1c21652e2483ec9d909bc6b26e5089d36c36d6a27f5ba9c0c50f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274264, "uuid": "c33225ac-b8fb-4858-a986-bbb61a548523", "comment": "Malware payload", "value": "761bf12017137ab8bc7b5c1c377966d97354414f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274264, "uuid": "df74e6c0-2747-455c-8b6e-a287326dfc94", "comment": "Malware payload", "value": "c632961f6df9581920f93b6e5c8a9b4c9a0a9e888abd606d4145a6624d7f069ac38435b1a54f3a97686b12826556bc84", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274264, "uuid": "d5896927-20c9-4b99-b9e2-e60e5d570118", "value": "T19FC4231DA0547B51F64B6A78B323CDB09B29D03FD219C388A0840B399B5BE5B69CD376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274264, "uuid": "d824e1b7-b97e-4e05-835a-16fe538de848", "value": "12288:MMU+0xq75aS9iYIp6cP/G2Bku6zXLMHXP427bn:o+J71vI/GzXQftHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274264, "uuid": "4efc7e12-b78c-49b2-9b41-cd5e487dbaa8", "value": 587431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274264, "uuid": "537ac197-64a0-4692-9cbe-8b204aa4e32f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274264, "uuid": "966cad5c-ce72-4255-9848-00ab05292be3", "value": "cabe1371ab5b1c21652e2483ec9d909bc6b26e5089d36c36d6a27f5ba9c0c50f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd8e04f-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250565, "uuid": "7d9cd01d-358b-47f4-ad0b-a2ed7657feb0", "comment": "Malware payload (Mirai)", "value": "8838939fe9c21fad4fd5a5bfcc63d79c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250565, "uuid": "8f9436f6-71fd-4f3b-8ed0-dce56cb07b49", "comment": "Malware payload (Mirai)", "value": "cabf573501a20b39423b32fe9a3f1ebc9b1e07fff0ce3863403f85c7e0aedac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250565, "uuid": "23d600c6-758f-44f4-913e-b670b2f26bf4", "comment": "Malware payload (Mirai)", "value": "8dc53bcd6b33c65e32158a3a5851da56cf635ddb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250565, "uuid": "37cc0748-7388-4a00-8860-54d113cc4b9b", "comment": "Malware payload (Mirai)", "value": "c54ad42e4584f34df255f53839de071ecfd7502461d32c54f0bbe73849af8eaeb7aabf4f700cdc2d692a51584ee9a89b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250565, "uuid": "ac718cd4-32b4-4710-9175-d25104a84c6c", "value": "T172A2D1FBB8E5094BCC6E907AA16D08D658F97C1013F7C3911E8B70B288AF415FD3AA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250565, "uuid": "47e4c02c-406f-42c7-92e2-ba46a852895d", "value": "384:MOcDqRfKUWFH39z+/49ETXsayqWruQ7eqOZi5MoJz0H/k+v1RpO:zMkKJFH39CBXsaAyKOZi63pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250565, "uuid": "edda2cf5-b775-402a-aae2-134abca3949e", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250565, "uuid": "eb98c438-ae74-425a-944f-3e2aa4bc5462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250565, "uuid": "2ac31958-16b5-4ad8-877d-22eb98849b32", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0dfefd-c17b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791287102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287102, "uuid": "901ba583-a212-4fff-b424-2e4d08c0ca31", "comment": "Malware payload (Mirai)", "value": "932c45510d0b3e7403166f27722bc6b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287102, "uuid": "4642dcaf-7add-4f5c-8180-e878dddfceee", "comment": "Malware payload (Mirai)", "value": "cae704192eed5a544fc7e08e3107d5e3a3aef6e805920a6d2d3df254c993d5ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287102, "uuid": "dec39a76-4a87-4bd4-85c1-a7c69c1f349a", "comment": "Malware payload (Mirai)", "value": "6962558af4a73da497861629489e1304c4efb593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287102, "uuid": "63dc371e-c72c-484a-8a30-308499ae4d68", "comment": "Malware payload (Mirai)", "value": "9e26effed4c226e2e20ece7ab0ef5bc875b0759ade307941a98cc765749d99f1a7f50c590b719aeda2ab26382078a2c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287102, "uuid": "fff2f621-383e-4e1c-9ee6-7616f31b27fe", "value": "T1C9833A97F401DDBDF80ED77B84530A0AB671A39119830F36678BB953AD371A84962FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287102, "uuid": "2aa84a4f-9e60-4d1f-8daa-ec826950c2c0", "value": "1536:iBnOepZrypznNjgHT9wX8F8Y7XqF/iyC0ZJcPJNVFqhWWPVyXFW:iBnOeXrIJgHT9wRyCiz0zOqhWQ6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287102, "uuid": "aef4d5e3-2ad3-45dc-88b8-17df0923dfcb", "value": 83940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287102, "uuid": "dfa1a185-0b07-430b-aed2-33ec89b86202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287102, "uuid": "9f784084-d940-4a8a-95a5-9dc9022de876", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16ee701-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273552, "uuid": "bb319506-de93-45af-915b-1fec74143950", "comment": "Malware payload", "value": "c7ef5870bd14da965aba841ff34d7b3c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273552, "uuid": "e5e70cbd-7862-48ef-b944-0d06f3fc9956", "comment": "Malware payload", "value": "caf46345f73f879002bca604908cb0875ee19e3cee9935357aa7c83d619bf3a3", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273552, "uuid": "6d60852b-ac40-491b-8a6d-ef706a66e482", "comment": "Malware payload", "value": "a520014709558f2e5ae22def65292fe60ca175b2", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273552, "uuid": "7c525d75-39d3-4038-bbfc-183b4a209c4c", "comment": "Malware payload", "value": "bdd38389beefcc2ac681eb5facd71700df3d6f9022769a4ef3709e49001e13354ae0ca00e7768cb9e7fe5da379dc37d1", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273552, "uuid": "d2d22595-672e-45b4-8833-09e13e38bcc3", "value": "T106F6D7429AA7CEC2E6F75B78E6E8A36362367E177A3140493BD81F271F332508593351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273552, "uuid": "6ba054cf-4723-4628-b2eb-ae703e352f1d", "value": "196608:1mLxFpcBhORoZbHiXUxO/RJk3IWhlbntjE:1mL/Ewm1HiXUxO/RJk3IWhlbntj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273552, "uuid": "089fc94c-44d9-4bed-9803-db4050537af7", "value": 15609856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273552, "uuid": "e7da54d2-63ff-433b-ae78-dee619e0f56f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273552, "uuid": "f2d2cb84-ce90-49a4-8799-2fdde3f97d66", "value": "4.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2948d2f-c141-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791262360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262360, "uuid": "d9e7d05d-211b-424b-9861-1c4bd3c73d5e", "comment": "Malware payload (ConnectWise)", "value": "17461c93abf833a9514ee410f1fbafb1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262360, "uuid": "7a9928cb-70a2-490b-9f9f-3077e319c430", "comment": "Malware payload (ConnectWise)", "value": "cb84fa7a6ec4de958b6af34c155a709773378e299fe82d0edd02c80b8debe66e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262360, "uuid": "47572ea6-a3fb-4fa2-a22c-7613de1f2aba", "comment": "Malware payload (ConnectWise)", "value": "bc892516aabd7b0ce5a216c6075aad7da2a2b736", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262360, "uuid": "f3628292-8ada-4772-964a-9a8d7734403a", "comment": "Malware payload (ConnectWise)", "value": "b4c9e0afee28021316976bc8562614c379477def126caded64f908657f60d9d3133740c99479a34da7a19120c8ede29f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262360, "uuid": "17abc212-dfbf-47d7-aaa6-f532460d3ab5", "value": "T1A946F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262360, "uuid": "ead974aa-6a38-44ae-af95-4835b5965669", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262360, "uuid": "5034ef5e-ef93-4d53-9a1c-df59f25bbb9e", "value": "49152:mfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:iqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262360, "uuid": "9ba45751-569a-4b6b-ad18-ae88c6e32f21", "value": 5648712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262360, "uuid": "3259b0e3-fbbe-4fd6-b6bf-dfc77d334832", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262360, "uuid": "b6881f09-75ec-46a1-b0bb-1d17f90c3d47", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2a106f-c17d-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288017, "uuid": "f87cc9b0-b20e-446a-a399-d03d4aad2bb4", "comment": "Malware payload (Mirai)", "value": "75786bfd6cc330780a92140d6f387ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288017, "uuid": "6634c086-59bc-461c-b416-3820309fd8c4", "comment": "Malware payload (Mirai)", "value": "cbb0349e65494ca718e2b363fada01fe6bcc0ddf26be41feb670a26d130a8bb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288017, "uuid": "ce0100a1-7258-4e07-ba25-e205f0522c9f", "comment": "Malware payload (Mirai)", "value": "11225f3e1887ca986796898f8ef5b4bac064d94b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288017, "uuid": "c452ead5-3258-4d50-903b-c8649c15c0f6", "comment": "Malware payload (Mirai)", "value": "4601fcb6a154f4c49e3da63c3afbdb9015a82c232f3141d562f74a9b0ab62147f2e0ba82e33ca762a49bc7c2bf0f4ef7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288017, "uuid": "f0ab514f-3e3d-4335-b732-d24c5e458c4b", "value": "T13FD45C66BD919B90C5D149BEFB6E437872035B79E2EF7106CA045FA06BCA8D50F3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288017, "uuid": "83e33a8a-8d0e-4485-aede-7db55fd1379d", "value": "12288:GJeJOkIo1+u394JshlipfNKaEt3VwN8IjET:g29s6n9e8Ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288017, "uuid": "f2b0b4ba-e5d1-47f3-a6fc-625d9874beb8", "value": 652604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288017, "uuid": "2f5c0fcd-e20c-4bc3-8f77-e329c3521c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288017, "uuid": "c1012d63-b483-46e7-9b81-52115dfab316", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225374a8-c150-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791268534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268534, "uuid": "36b51f56-33d7-4e20-bbbc-b76178c51c38", "comment": "Malware payload (Mirai)", "value": "57100d1df69292eefd94cc4a25acdc9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268534, "uuid": "21a0fe9b-f786-4ebc-a24e-9cc16c6844b8", "comment": "Malware payload (Mirai)", "value": "cbb5985876e7bae7ac70f5053d1ce5b4234c3fb96bbe947c71b27416aeb61fba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268534, "uuid": "a86e2173-57b2-4798-998c-27049244ce9f", "comment": "Malware payload (Mirai)", "value": "8e8f156d045ba31293b3843242410e3aec4a1588", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268534, "uuid": "65211894-8946-4393-a444-8b454f57a1db", "comment": "Malware payload (Mirai)", "value": "f3238871fd3be9322fbb4f8ec0fdd4dde8a5939eae32875f0d7973635703bd6bcbb3566368d90de78d8e2218cfb06fcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268534, "uuid": "6c72d182-7d84-4e34-9331-30d630b6f998", "value": "T15DB33A80FA8BD1F5D90345B4C0ABB33FDB31971D4031CAAADF999E76E923B416916348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268534, "uuid": "ed7ddb0e-e0a6-42bb-8d12-4d9b7eb14034", "value": "3072:xKMUVcx1LyqhZWFHLP96mF1GrkC/EwzxLQ:xKMUVg1LyqhZ4HLPBF1G5XJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791268534, "uuid": "7cee1e16-ed07-4ff5-ba87-f30074aec40a", "value": 108020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791268534, "uuid": "9035a5e0-8943-435d-bb6a-06b9e421b673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268534, "uuid": "da9ea9eb-4a9f-43b4-9101-4aa2e454be2a", "value": "keroro", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0a96c8-c1d5-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791325967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325967, "uuid": "5e0fcf46-ac15-4aaa-8c4c-2b26d94bbc54", "comment": "Malware payload (Mirai)", "value": "d789255bd1ee435db07e4008e0a3bf8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325967, "uuid": "da4f2d84-e4ce-404c-80b8-ad98c09f8afa", "comment": "Malware payload (Mirai)", "value": "cbcefa22c0ff043ff55e4e4ad1bea200b32d8fe420fe6d9c0d7a4f4dfcec1642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325967, "uuid": "01927118-0e0e-4a7d-9f06-a5be94c16a7b", "comment": "Malware payload (Mirai)", "value": "b4f5c772352bcc625752a70415b8a40eb6619db1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325967, "uuid": "ce5ec2fb-1228-4eaf-a9a0-df3db408358c", "comment": "Malware payload (Mirai)", "value": "6179b233b92a861d40eaa30818e4c8027ced43f3f92b84c8fc97017d42a301683463c9165e471395bf76a0cdcc467728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325967, "uuid": "0f764ee7-83d9-4d7d-bd41-19a8bd04237a", "value": "T1D6358D1AB2B3B6BCD007C0305BDFC6A24531F07569322D7B26C4DB352EA6DE5136AB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325967, "uuid": "cf977ff2-9315-42d6-af9a-585540eeeff0", "value": "24576:OpHYYu4346up14l6hxAeNg8pnnAEhT48Q7Ui2FeTWo1:7AeNg8pBhkohAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791325967, "uuid": "3f2d9288-3c6d-4228-bf95-35d3dcb53ff3", "value": 1090592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791325967, "uuid": "4f95bf43-dd2e-404b-b5d7-eca5f3078c91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325967, "uuid": "1bc0b1d1-d7f1-4004-841a-91531b0dca41", "value": "cbcefa22c0ff043ff55e4e4ad1bea200b32d8fe420fe6d9c0d7a4f4dfcec1642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e32e87-c18b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791293909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293909, "uuid": "4f5d24ae-6bb1-46ab-b7b1-cf044ca8499f", "comment": "Malware payload (Mirai)", "value": "eef62e0a81c0901b93016dce192335c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293909, "uuid": "34cf4ca8-e6e2-4931-a7c1-788f287e0370", "comment": "Malware payload (Mirai)", "value": "cc05a738850ef03919a277790ddf030ccd80fbb8e90ef925b7d8490ead865db7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293909, "uuid": "a0dc75b9-34b8-4cdd-97a2-3ef10ddb7652", "comment": "Malware payload (Mirai)", "value": "00554930e10c6eb88b334bfc3dc05a1dee53ab30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791293909, "uuid": "144c295f-8302-44be-8371-d34dbe96b9c7", "comment": "Malware payload (Mirai)", "value": "284d0814e8cbf55180e4b7cc01b8f03a9107931be16061e850819446bb4d644460d399d1a6f62eef731b07e178e26c93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293909, "uuid": "dec47a87-a6a6-4302-9568-de93103b9de9", "value": "T191243B07B5D08DFBC4D6CBB517DB95218923F8291B32320BB794BDE92F4DA986E0D214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293909, "uuid": "8d650b6a-ef4a-4389-830b-ac0c9554b11c", "value": "6144:qXQMVePU4MUMkp7uUifXEQeLot+MM5j4Ja4bpKQzI4bHl:qXQMkU4M5kpyXE3hMM5j4Ja4bpKQzI4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791293909, "uuid": "d598bcdb-af8b-472e-baf3-9c79842e2579", "value": 222367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791293909, "uuid": "53556594-cec5-41f1-a207-209f411a488f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791293909, "uuid": "926a892c-ddc1-44cd-98ce-f0521c3c9762", "value": "qv3.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fc6232-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275434, "uuid": "c3d7bab6-9fbd-476f-9cd2-292da8ca0249", "comment": "Malware payload", "value": "5ca2d5f4a06629a4c4ad1278bba672ff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275434, "uuid": "b1d71f4a-5180-4277-bc3e-04a4effbe5d8", "comment": "Malware payload", "value": "cca56a6771b0b0b75df363585ecbbc1209b6d62eddf949f83b5e9c4f2e7b7133", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275434, "uuid": "ae274ec4-b37e-4e22-a7e7-4953b7737997", "comment": "Malware payload", "value": "1ca8e9b42c0fb112574f4e3c37214a3ea6b82f9b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275434, "uuid": "45b59390-d859-4248-a8ba-c09deb8c5918", "comment": "Malware payload", "value": "c073a4fb9ea41884a0dacf1f6b97ea515b0e9401a2f5642a7e7a24512b8159a9f8c66a122876d852e873ccbd460f4127", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275434, "uuid": "50488092-ed3b-4241-b73b-5729cf6a0cdb", "value": "T10B5533D7813C28C49F3E0A5767BF851C62188DFC204308B76B5A89A7663F39F876495B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275434, "uuid": "c317c2b4-8ccf-4769-a954-802b65d1cf9f", "value": "24576:moZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRzX0nv9Abdg:moZ9bq+MmMEL+hcjXHC/wnwdQKbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275434, "uuid": "fc13cc26-8a86-43fe-87b1-c3f943ab2bb2", "value": 1386685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275434, "uuid": "bfeb41a7-6ab6-474c-93e6-04b712b9182d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275434, "uuid": "106b26e3-1a7c-4222-a371-7d91316cccdf", "value": "cca56a6771b0b0b75df363585ecbbc1209b6d62eddf949f83b5e9c4f2e7b7133.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555e0ecd-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1791273344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273344, "uuid": "6e60e9b0-bef5-4195-b825-bfc936ab9057", "comment": "Malware payload (VIPKeylogger)", "value": "0fdc65c5995d5ce3c231dddfe12af6d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273344, "uuid": "60e9830c-86f1-43fe-9c57-514137e899e0", "comment": "Malware payload (VIPKeylogger)", "value": "ccc92976992919d4504acaf71b245f9ce0db65404f232e2884c29836e92e54ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273344, "uuid": "439684f3-5d68-4012-a617-85ae66879b96", "comment": "Malware payload (VIPKeylogger)", "value": "31db764567e3b940169732f6ec467f84540d52c6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273344, "uuid": "d02c70c3-b514-4000-8d51-b3f70eaac5aa", "comment": "Malware payload (VIPKeylogger)", "value": "a55d3e06777207dc0cc3153d85cd69b7bd080c31950155fe10ddd9c88e6868f2f3acafff85ed5e9e1b7c79d8f5477dc4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273344, "uuid": "ba66e32d-31c1-42bf-a0f1-12c94a37c5f3", "value": "T1B8C22F00499178845373ABBFAB1798E8FB7B056B01948447B86CB850AFF2D1CDEE4DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273344, "uuid": "92c9bc07-c6f6-4de0-ac0c-3ce3d86e7572", "value": "768:PQ6Z6RylvbRcXO1fl1HYwt9wwVeraTP7idghCPxm7atjf1MPjXvcUsarQCP0sMWg:ImVZueJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273344, "uuid": "f48e3bc6-2b17-44ba-a269-88a75ec53816", "value": 25730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273344, "uuid": "2d0b4792-78ae-479f-9777-2a8e098c8e23", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273344, "uuid": "e54e5f4c-cf45-4b94-8cc5-dd9f5283313c", "value": "1C26TQB_00012535.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7230ea06-c185-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791291431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291431, "uuid": "d7052354-8cde-448b-85f8-38deb6ec53ea", "comment": "Malware payload (Mirai)", "value": "7704e6dbb95d6f6d4eabeaa57ff1aea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291431, "uuid": "1b4ad438-badb-4f02-8e01-e7c72755a5fa", "comment": "Malware payload (Mirai)", "value": "cd130d312e291e6084f882296d1ca1ffaed371f1da229184c2f30594b380a089", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291431, "uuid": "19cad9b8-64b3-4104-a4ce-606ae7dcf657", "comment": "Malware payload (Mirai)", "value": "d72a5b662591ba8afb6ad2ade31d42b8e01a34ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791291431, "uuid": "f79703b4-a26d-41fa-88e9-be3d624db978", "comment": "Malware payload (Mirai)", "value": "f851cf812e3eaac7e86db6d1f4fa4254dc5f978605e14d153d2eb5952a64803986726ef2181669470bc295c17c3ad3be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291431, "uuid": "030baa33-2847-4db1-9e09-ad1af87302e8", "value": "T120D46C16BD919B91C6E24ABBFBAE4368731757BDD2FF7006CA045F9037DA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291431, "uuid": "f4d393a3-79f2-46a3-8aa4-0c8d09cf9747", "value": "12288:XzWeEfKRyQzqFIleKEOJwvsgaKQ0Fu1R0AI1tLRIzdtpe:SeEQVqFIleKEOJwvSN1Tzdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791291431, "uuid": "6c1aecb6-c547-4f28-ab59-07779b9fedb5", "value": 626280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791291431, "uuid": "81b220e6-0998-4811-b7d4-22c8b3b9c4fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791291431, "uuid": "a01ab52e-028a-4432-9956-ffeb8cfaf3af", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15df3892-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290417, "uuid": "7e2637c7-bd60-4d6e-b5d6-098e6262f63a", "comment": "Malware payload (Mirai)", "value": "ede5d9686eccac6bbde5a6df51ea2258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290417, "uuid": "4d674f23-8114-4223-8928-f8f9a91056d2", "comment": "Malware payload (Mirai)", "value": "cd142e9e9f92cedda16970c528d2f5af7edd5f2f2a18d0d454b8b7ed77d95126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290417, "uuid": "c3e104a4-1ae1-4c12-bbf6-ef4405868c5d", "comment": "Malware payload (Mirai)", "value": "9a6ef80059157101afdbbe5625fe999b0fe6f861", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290417, "uuid": "f8e5cb76-8cad-4197-9ec1-ea5b1031bdf3", "comment": "Malware payload (Mirai)", "value": "9f9fe3387d139b00753a77c69bfa34add8baed83bdcf1e04e5e3bf99aec09bc0cececac2e6a39ed2c2d455b3ef9d0c16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290417, "uuid": "0e7fcd13-92ea-4798-97c6-090f4cb888a5", "value": "T160B3AEEBF24715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290417, "uuid": "a6e97fb3-ff67-426e-9c5f-04c78bc71323", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgD1/LWW:8YSZ3e8ZE3MYlphDgD1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290417, "uuid": "bfa9ba93-10e0-4831-8178-c10c82f1ab85", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290417, "uuid": "96247e33-277e-4bf6-86b4-0c4be4461faa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290417, "uuid": "226ae3f6-87d2-4046-9ad7-dd0bd89a3ae4", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaab09f-c1d5-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791325943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325943, "uuid": "c28f0af4-6502-466b-bcc5-67cc299f4d5a", "comment": "Malware payload", "value": "41943a34fd0115c01bddf99f57b1dbf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325943, "uuid": "3a49c70e-10fe-40b3-8c06-1b363259c608", "comment": "Malware payload", "value": "cd3158bdde5b7145a69e72579fb14577c0f8eb1e49de549968a8ecbf6c3c4701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325943, "uuid": "6ff38d00-cb97-4257-a6a5-b19d27966bdd", "comment": "Malware payload", "value": "a9ee679dbd1cd29ed6050b058fb739cdbb62ed99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325943, "uuid": "063824dd-f640-4e01-a38d-9bbcd01fcada", "comment": "Malware payload", "value": "5a145f7ed7b02f5b213c88d31e361e6144610fd9ef0b6c7eb724145176d4a2d5457cd80a400839526099180ad520864f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325943, "uuid": "907bb9cb-472a-4df3-a9b7-8343f299ccb8", "value": "T10BD62917728800DCC94BD67584B41D7A12B13DEE5532BB8E0E99BE902F177996FACF08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325943, "uuid": "cc4e1ad0-1a67-4fff-8c44-eca3d854d861", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325943, "uuid": "f096e4b9-97a0-4bdd-be53-d78bf36f28ac", "value": "49152:LEJtOrWW+vA/uahu/kPeLj1TJQiO9+PIdlq+U4Ypf3YHdMqcq2s3vnfSQYYq/qvj:uAW3OboVcSxykyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791325943, "uuid": "ceb40296-cc13-480c-a5fb-d5efbb5472af", "value": 13695392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791325943, "uuid": "7b5e05f0-626b-443c-9d99-80a2d143def8", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325943, "uuid": "daea94dc-4742-4b64-9702-165db8a388a9", "value": "S\u0435t_U\u0440 [U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea57852-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270729, "uuid": "cf4c23c0-3d61-43b8-b42a-78ed7dd80d2c", "comment": "Malware payload", "value": "1d51fa37bbae1ee0a8b9034903ba4706", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270729, "uuid": "a3a3ca55-b59b-4d23-bd39-f4239a28b8ed", "comment": "Malware payload", "value": "cd6d13f22ed89360b67e13c04940c9cb5cda3edfbdb9e946318a4488927e836a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270729, "uuid": "a02cbd5a-fdca-4c48-a364-eee01a60aa57", "comment": "Malware payload", "value": "c16e3a794dd7ab40053120cf049c033a839f0bc0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270729, "uuid": "c611c386-3846-4a0a-acef-1ebcf60b2516", "comment": "Malware payload", "value": "9766aab4d6fdddef7e92c2d9c79ddcb3cd365926e8a09f27d0f6fd4b3788bb365ec9596c4e55a4f3beaf6ae34ede4040", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270729, "uuid": "dfa49406-37b0-4d53-9a0f-09a5d2e8997a", "value": "T157A42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270729, "uuid": "263314bb-13a5-4624-92a2-d26f083fc8d7", "value": "12288:wSCDe0U+m1V6ECbniSPfS3e2R3feeintFckFTsuC8hHf:wDe0wUTiSWzeeiFsP8df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270729, "uuid": "194537e8-7be6-47fb-b36d-2578b0c61831", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270729, "uuid": "bfd07052-1ba2-4e4e-b587-17fa41408fbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270729, "uuid": "cb6d3667-f039-40c5-b2ed-5d482aae18ec", "value": "cd6d13f22ed89360b67e13c04940c9cb5cda3edfbdb9e946318a4488927e836a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a40d18-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273026, "uuid": "b1f3120d-8c08-4a8c-87c0-a8eb1c136ea4", "comment": "Malware payload", "value": "2a5c0a175262afe98b535be3e836040c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273026, "uuid": "2c4633bf-0009-4206-bbbb-afd3719c3b13", "comment": "Malware payload", "value": "cde8b50d4568e5d49572df292570a02ad515c790a269bb070c5f3500eb6fefab", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273026, "uuid": "9113e05c-3f91-4b3d-9bcc-376d3effaeda", "comment": "Malware payload", "value": "695cb344512eb0a42f445142309d4774f30e91dc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273026, "uuid": "db45e4ff-4925-4f65-afa7-72b0f3bdd361", "comment": "Malware payload", "value": "b5b208a54dd5a1bac0a636a5bf1b7497d2d78d9fb98b1e5e41bd40f9560e19eaf26a3d8f49dd3252583832a650c063d8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273026, "uuid": "a1dd3593-a470-4f3b-8bfb-437ab42e53ea", "value": "T184B423816C6C2B73F541F59C1AC4342CD4202C3B9AB762DC5E8844D3687EB66BD6A9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273026, "uuid": "5332e14b-c68a-43f0-82fa-48697fd3ac10", "value": "12288:gjXlNMiiXBZT9ViRziobl9jcr91+rTY3r8qhfUhurq:QXR2BZh0RLbl2rKY3Iy8Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273026, "uuid": "7b450c2a-6986-4906-84dc-5a69abe4efd7", "value": 530766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273026, "uuid": "7a93148f-cced-4698-816d-300abfe325ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273026, "uuid": "f96cc57e-1ad1-4fa3-afb5-ed5f1b918006", "value": "cde8b50d4568e5d49572df292570a02ad515c790a269bb070c5f3500eb6fefab.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511c15b6-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250573, "uuid": "fb99ae0c-cd5a-4fdb-a47c-ee072899c55c", "comment": "Malware payload (Mirai)", "value": "b2016940c0a3d68dfec20137775285b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250573, "uuid": "dba4fcd2-cb5d-4c46-bab2-bf03625210f9", "comment": "Malware payload (Mirai)", "value": "ce02bb287d9e0d4679984be0371ea157eed0ef0369636f541073f89578fc532c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250573, "uuid": "069d128b-0754-4400-9ac1-ad77728681f8", "comment": "Malware payload (Mirai)", "value": "2ad266f402953edfa62aeeabeb661de64571d5e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250573, "uuid": "da15af61-baa8-4785-bb34-617b76faa89b", "comment": "Malware payload (Mirai)", "value": "1995d4d8b08905110f01d413524db9ea042059cd88097c4ed65a174ca1450fee7577b40e4d08b88292082b72f3042b3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250573, "uuid": "bc52d75d-bb75-4969-b0f2-744af4ea896e", "value": "T10DB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250573, "uuid": "9293c941-2c7b-4d7d-8b3a-55ad4676959c", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1f/LWy:c9sSyzz36YaWWgg1fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250573, "uuid": "07a1e1d9-e6b9-4512-b3d0-4f9f152d2d9b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250573, "uuid": "7449f32b-8894-4197-81f0-2b5e5a39ee62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250573, "uuid": "21786d0b-718b-48c5-b37c-2651ee097030", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16666d9-c18e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791295456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295456, "uuid": "cbb87980-0332-4df7-8887-d588ba0f80a7", "comment": "Malware payload (Mirai)", "value": "5be9f0bb0b003e5ccbfb8c9761235bb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295456, "uuid": "46729076-27ff-4231-8fbd-741de0ae8206", "comment": "Malware payload (Mirai)", "value": "cfa6b7d321207fa36924c8da13488361ce3ce59672fa7f58800e66d0da633790", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295456, "uuid": "35f2b3b8-9c91-49b9-8205-d0cb99bda442", "comment": "Malware payload (Mirai)", "value": "87af6d2eb0287b46330ee9be2bad1cd1c850bc5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295456, "uuid": "5626bb94-0442-4be9-b5be-1d443a60bf8d", "comment": "Malware payload (Mirai)", "value": "c3161b89523b8657fc4702492ad3fc30407099058f95848394052cfc1eb8a3b8c300cf0591443ad6055c0851928ebd2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295456, "uuid": "7497068a-28f7-4bfc-ade5-b0e84dea981a", "value": "T10BC49D009E0D6831C6C5F0BE4D8E0F91735F78AC5622C3A62D27D65CCD92BA4ABB9771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295456, "uuid": "01557ea2-888b-48bd-b311-8cd82d5063c6", "value": "6144:0WsyxZQOZ7j1yXSERILOZLnMUdqgSG9wOa3K3n1a3pkP98mlgTGPZvR67YKGjZiE:pxtREcOhvqbOeKX1OpkPSmlhZgs/iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295456, "uuid": "a80a1b40-e16e-4269-9938-14ed06481300", "value": 596440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295456, "uuid": "3eee4843-f6bf-4b28-aa98-ec0bdbf37c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295456, "uuid": "c96dce2d-b0b2-4a44-85b8-1471c2c79fdc", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417179e7-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276317, "uuid": "028b2a9d-d978-478f-b221-a6e0ea2a4751", "comment": "Malware payload", "value": "41a06d7b5a09273c436da894f1acdcab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276317, "uuid": "a6417d9e-b255-45e4-b42c-0f7a446c654b", "comment": "Malware payload", "value": "d000f329e0466eee0ad11733581ffa1469380108ef42ccd4e49048e793ef67b3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276317, "uuid": "886425fb-0513-48de-be0a-0b5abe6c3604", "comment": "Malware payload", "value": "b9727db6ef4e93add8b03169d805241b964813ce", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276317, "uuid": "91a4f7ad-bd50-4c0d-8a5e-a12126c9ef59", "comment": "Malware payload", "value": "5a0c4559b20300ccc54ca4816622540dca68831945438389edf0f43c2a9ec40f37b10cf7481c592fcc1c8b9581769725", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276317, "uuid": "9f2a192e-163b-4389-a08d-2399ea5df65c", "value": "T1B1A4238274716D06D096CFBDD4C1AACAD06A023D35263BE5639294CABD940367F9BF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276317, "uuid": "c1a0515f-9998-4df0-98c7-fb68c973e5ff", "value": "12288:wr06hUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZ5:wr06hUv4t1cNk/wjibhv4b2OnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276317, "uuid": "33bf99aa-0a65-4e1d-9e4b-ad6529c9816f", "value": 487153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276317, "uuid": "c473f1b3-6bec-419b-8c26-49cb8ae2ab91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276317, "uuid": "578bfa59-008e-4a98-819e-b94acdf3aadc", "value": "d000f329e0466eee0ad11733581ffa1469380108ef42ccd4e49048e793ef67b3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65654959-c19f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791302577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302577, "uuid": "231d47c3-0643-4217-a558-a4348da964cb", "comment": "Malware payload", "value": "eb521ccc6cd94312c8ee1d655a7f247b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302577, "uuid": "fc7654b2-90e8-4e75-b0b5-6d89c0c2f0a5", "comment": "Malware payload", "value": "d03b57a8a19b81c31a1e4fce79cd6fcbb5f08195b1026e6fa988f0d4e51a65ff", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302577, "uuid": "b8f3ed19-53ac-466f-b6ce-97468c14ee82", "comment": "Malware payload", "value": "128224ac18dd197fc56ca080fa7a876cbf5af4ea", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302577, "uuid": "2130b4e7-83fb-461c-8fbc-f2a242e73713", "comment": "Malware payload", "value": "bb2e77909afa40b790eadbdaa9f104a7bfa3041b4020b23500941df75ba7c6b1b7f13209762ab21b348680a135e9470b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302577, "uuid": "4ae111fc-3bb1-4497-8bf0-435a73d58708", "value": "T1F6363344B8EC18A5D0BB113342CA0BD7B660E5DDCC98FAAF67BB6B40A5479971B0434F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302577, "uuid": "39f9320a-ee70-4593-a123-2012a4405eee", "value": "98304:zksoCv88UXPz0zrkfsqi+ffG3xNKEacEkOa7LFFQBHZ4Y9LQimrH:zOCv88krg+faadFanboHWKcimT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791302577, "uuid": "0087369b-4f3d-4b1f-beee-1a4bf4cbb771", "value": 4910589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791302577, "uuid": "55ee2a93-fdaa-4fe6-a622-ad1bb9608f97", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302577, "uuid": "c48ff43f-fe6a-45c6-a458-e9dc5f5a237d", "value": "67Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c6bdf7-c197-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299309, "uuid": "1d355a40-87d1-4fdd-92cb-ae38bc537ba4", "comment": "Malware payload", "value": "ced18e0bf1cd027c5c57ffb8d18b0d27", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299309, "uuid": "4778bcc5-3265-4306-b7b9-afe9fb23a2b2", "comment": "Malware payload", "value": "d060dc5dad33bb681ed64f8d3e775d0dea9db6343ba5ffa735e05d37b50642b3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299309, "uuid": "2d47d95f-d2e2-415c-8e2f-93240842ec28", "comment": "Malware payload", "value": "5770e517d0b3ba87744fcb004e895358e4b330ae", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299309, "uuid": "6de70a52-ee47-4dfe-9f78-879ab5282612", "comment": "Malware payload", "value": "6b139d9e3942356cdecf5f1b45e79a34d98009f4ffa53733d93c935f1501a0db8de477e39f165c86ede024a7a0387f92", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299309, "uuid": "a3fb6a05-85df-4fec-8a92-01c7249d1505", "value": "T133F533A64ADE3C98D433353CDB412DE25E3B5380D18B5C7A0428A5E3199FE6B1F4B399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299309, "uuid": "8859c0c9-ba58-4df4-a9aa-2b3807c9289c", "value": "98304:/SUX5veuQ0qKzP4GbxX12i1GrjvAXsLG8sq3ACgnBd+B:NXMTGbB12rfvAXsLGOwtyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299309, "uuid": "a6e58f70-4dca-4c8a-b9bb-32d270d2f206", "value": 3524241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299309, "uuid": "9555bb9e-39be-4cb0-b130-6c620d5cb4db", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299309, "uuid": "de913fe3-56b0-4205-89e9-3ba48c2a39e8", "value": "67client-1.6.2cr.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5974e6e3-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274639, "uuid": "b443f33d-646c-42da-a0d8-bc8c855c5648", "comment": "Malware payload", "value": "e086fc55c2c500320ea145da0277d4ce", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274639, "uuid": "5807ad5c-82b7-4a19-81b5-f763d1f45da2", "comment": "Malware payload", "value": "d0628a5dac0462b759a0397664191b7e7011c57aae3680983cbb5e895cc13f07", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274639, "uuid": "929de683-8e01-4220-8a9e-f39fd618cda9", "comment": "Malware payload", "value": "b4e3b09020f9b2cc5cfbf3c3cd8298a5e37771e5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274639, "uuid": "c3195ff2-fdb5-45ff-9457-0607601f7297", "comment": "Malware payload", "value": "6a57c9e45b3fc007e21e761371ce4abf9da5448fd727b132dd28dc866a407ab5f85968f69e4dce12ede91a151c42746b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274639, "uuid": "bee27cf7-4a42-4989-9f9b-9c2ba2746645", "value": "T166B423F5A7606BCC9D20522F2F4A2BCE19274B41B403C54A1ED2875A421F6FF4E7AD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274639, "uuid": "f900bcce-de20-45eb-913b-f42a52f1368b", "value": "12288:WBRdpQ73iBVYWiCwvEXgbvM0a4OTHiQIIFzuK9Gd9IUN:WHUw2Wz9XgbM0azTHiQIouDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274639, "uuid": "53253f1a-5966-4938-beef-88ae579608cf", "value": 542317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274639, "uuid": "10aea3bb-ddb8-4c2c-8f02-13789fbf23fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274639, "uuid": "f909d306-927d-4ff7-9843-b64ce24ec007", "value": "d0628a5dac0462b759a0397664191b7e7011c57aae3680983cbb5e895cc13f07.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babc24b3-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274373, "uuid": "b6e9dc03-1232-4fa9-a82a-a431a4c8d4c2", "comment": "Malware payload", "value": "adf52c813f0fd416e672ecb725d9c4e6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274373, "uuid": "c46e8f30-9327-450d-8f89-4d65fc4bf9f0", "comment": "Malware payload", "value": "d066a39f540617313733d8771864baab6db66173c2793c139fe15e9a81017f8e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274373, "uuid": "54648721-4ad0-46bc-bb59-b888901f19b1", "comment": "Malware payload", "value": "6b56bf5df07cc91f055d3c6dbf90623da8d8bf2c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274373, "uuid": "c1fbc2c8-5cc8-44d0-a96a-e396094b27a7", "comment": "Malware payload", "value": "455c6cb9ce0da023c0a98d69c35f6cdd4224ab9c5fe298384eafbec33bd4c195893a3b20ba507f873b005222b22f5ea6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274373, "uuid": "63726178-c042-4e1d-a6ab-cf25354736fa", "value": "T12EB423CD64BED0A87B658DDA9FDCFFD30CFC00366D7526F2A51C1A13A1C404B64A958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274373, "uuid": "239e0bbe-9391-473a-af40-38113d3ab47d", "value": "12288:gB/e4pqNFTFbEXkBDoGbDDGIabs/7iiEVwYg2l3/2Nys:gBm4pgTboGTabs/7iiWw0Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274373, "uuid": "fe6a0d60-a180-4b30-b49c-5bbfb8139f6a", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274373, "uuid": "b8835600-7749-43ec-8f88-cb8519a3f8f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274373, "uuid": "f644cd93-95a4-4564-aecc-a24828ca90f4", "value": "d066a39f540617313733d8771864baab6db66173c2793c139fe15e9a81017f8e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7494e11-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275199, "uuid": "240807e9-61d9-48bc-9c8c-13c264f74b0c", "comment": "Malware payload", "value": "28f003d1e0831aaedff3ac0a33cbbc66", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275199, "uuid": "231ea38f-e38d-4f7e-b263-7181841c311b", "comment": "Malware payload", "value": "d0a7b272fff2c9d5e0791a26606c3695b16fb332e33f423960fc1e864bd20a6c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275199, "uuid": "ef564f19-9337-4f98-a652-82b97afa1bb5", "comment": "Malware payload", "value": "8891b6029416c28f8169579018dcac5d48c5c81c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275199, "uuid": "ba85fc90-8b94-403b-8443-559f4512ab99", "comment": "Malware payload", "value": "1262d31b590e1793241bad3d789eb7c9b0f001155de03ff5cfcdb21314d72c139903d8a87a0bde12f366ddcd9ae8f4f0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275199, "uuid": "f266b459-94ce-4524-9ee7-574317315125", "value": "T109A4236D922554376D67B9D0AD1D2B020A70D18932DDDBD5CE0F38A08EFAC9C1EC61AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275199, "uuid": "8ea2a692-31e5-4edf-aa0e-058297a5ab12", "value": "12288:UW+GusvMa+gzYfcEaN9B/Jm0LU0gM7aQa:UWF/vMa8fclN9BhmSHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275199, "uuid": "6613b909-9f4f-4950-a1c0-54e0b97dfc60", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275199, "uuid": "d768d778-2d62-486d-9557-aee572229fe3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275199, "uuid": "863382a4-7759-4985-b795-a46ba60f52a6", "value": "d0a7b272fff2c9d5e0791a26606c3695b16fb332e33f423960fc1e864bd20a6c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0cb22e-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274748, "uuid": "7f5099ef-62c9-4dfa-8f9a-9cc82eeb3bd7", "comment": "Malware payload", "value": "5891ec945f7bfe452cbaf25f6bb145dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274748, "uuid": "dcd0d792-9cac-4896-9000-0d5c68e166ee", "comment": "Malware payload", "value": "d0e665fe9235553c91250b42629652bad0c21c256b2ed34e66f71fef01246a60", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274748, "uuid": "dfc0693a-c1ab-415a-9c22-b0786a1a83b2", "comment": "Malware payload", "value": "f1109fd027e4b7d8eb029256d394a10d08b41882", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274748, "uuid": "6eb7c5d7-b347-46e7-95f7-c5db81fa17a2", "comment": "Malware payload", "value": "7bd77c7109f5c50c95ce9d05697a16a8a3bf07959802244ef13b670ffc470f069be9dc2519231e42f520479a625ad7a6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274748, "uuid": "c4a7ec13-0f2e-41f8-9c3f-560d20d23bf4", "value": "T1F3C4239603689664787407B197BF9F8DC6028E1329921BFD9FC8BF0CA1356489D5FBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274748, "uuid": "5fd08fec-277a-4325-a0a2-816248996fa5", "value": "12288:eOCBcIqBPliubzqtYBpfsz4TKPozt4CTo4Pl/2Ar54:eZ+IubzqyB9sz4TKPE1l/Zrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274748, "uuid": "b353983c-b449-4640-bbeb-b5d5459a2386", "value": 546982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274748, "uuid": "00a76ea0-c367-4b73-960e-6200ecdeca67", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274748, "uuid": "e9f3d99f-ae5a-45ae-80b0-272e6a956d97", "value": "d0e665fe9235553c91250b42629652bad0c21c256b2ed34e66f71fef01246a60.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb09ffc-c163-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791276822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276822, "uuid": "16b9a2fb-5716-4d02-bf8d-bf8b4600818d", "comment": "Malware payload (Formbook)", "value": "150690e42c8e2f4d68a3e5c348c32f7b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276822, "uuid": "76dff917-14c2-458e-b941-f45cafa33a8f", "comment": "Malware payload (Formbook)", "value": "d1183f5ef4afd2710c31dc8274f861e4ce1f46ee0aad4234fab75d1844ebe2e5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276822, "uuid": "cd1769ba-5e7f-454d-bba7-9c8d4eb0c026", "comment": "Malware payload (Formbook)", "value": "944de485b1edfe097058d8b6201cd8f89bb1bbb2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276822, "uuid": "fdc135b6-38b9-4708-98bc-7a25467d51a4", "comment": "Malware payload (Formbook)", "value": "0d9ac8455d4909f06ee8e0e3d69aef3d198d3eed95fe405c918a418d892641c244e4fae6406327b633214c03f2654cf7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276822, "uuid": "5cdfed9c-8464-4cae-8278-49d2ec87e1f7", "value": "T1237523288CDF0AEE0D20F2FBBD55F584756826460D4B62671328C6A433F9494FB63D6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276822, "uuid": "74bb615c-5a9d-4d72-8000-db2880e4842d", "value": "24576:KJaGLT/OWJnyKs+IQLKm4vUyK0ltSzHFFpEyLnCo/8NcTJeL/Vuocy5qicgGw:KJaartBYtYJcZ/5vDGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276822, "uuid": "6ef93c31-91e1-4a91-9137-f41ccdcfde88", "value": 1558763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276822, "uuid": "b7603921-7b5d-4467-ab60-305ae088b90d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276822, "uuid": "ae54bdcb-4f84-4c0e-ae60-10a864c4da3d", "value": "millssecured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fdbab3-c1a9-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791306869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791306869, "uuid": "aa1b07a8-5066-43c3-b42a-a3315444f813", "comment": "Malware payload", "value": "8a611642fb4ac78d061de94ea64da8ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791306869, "uuid": "ea09d807-4467-4239-9c94-924126242eeb", "comment": "Malware payload", "value": "d14e45479e964178f165e330954120cf0e3c26714af9a4339ccd41aa017a4c83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791306869, "uuid": "73393591-9bcb-4702-98a7-f10260958c47", "comment": "Malware payload", "value": "51d35c4d2e3c7e5673775b5cf5943947e69ec33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791306869, "uuid": "bd78fefe-3d51-4aa0-87f4-1d10b08fc0fc", "comment": "Malware payload", "value": "e114bc2f8afaf3954fb6a6e50e13af49d4c3d6e37e6a5f4580cc95381752b5b0fa14dde62f383f70bf6555b8144a7310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791306869, "uuid": "b6e2f7d5-f63a-435b-a580-0f821bdefb40", "value": "T1BCF49E31627C905D2967A45B733BB1237A1EFB2DD2063B4045FE43C671E60BA92374AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791306869, "uuid": "317a816d-769d-4009-b965-201bf995b785", "value": "12288:qIqpz9qQxmyFxIs+aE0L3y73dpDDxBNDu1Hfg5c92gR2D3NUBpSmuKFkIdB9gFUJ:qIq59qQxmkxxZ3CbdpDdBA1/Ec92gR2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791306869, "uuid": "bfa9df4a-967b-4754-a3a0-9c47959be7f7", "value": 733116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791306869, "uuid": "695b040f-2155-44c2-923a-d7c4da1e0988", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791306869, "uuid": "c7a8fcee-a3af-47d6-8732-3e243dd65289", "value": "INQUIRY -2026-17085.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fa0c52-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273696, "uuid": "3e7f7dea-8c63-4372-8f2c-ef9d0eba5379", "comment": "Malware payload", "value": "a2697ac8bb7d9dfe6de510e6b8b5f4a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273696, "uuid": "f174952f-c729-4dce-8143-5f378dfeb882", "comment": "Malware payload", "value": "d1965481e03f0554d99b93756903d5b5600036e216fc49ca69d2b6034860a004", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273696, "uuid": "d5ef4d56-53ea-4092-845d-cf221d186f23", "comment": "Malware payload", "value": "1b2bdd578a3b92b8d679c7fa7d16d5ac3186e16d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273696, "uuid": "d73beea6-5cfb-4a3a-be16-51f4365334bb", "comment": "Malware payload", "value": "fc53792b1a401d485adc571ba2d695dc2249fa63d87bd0ba1e11e9d860f134dcf403e5ab6b006d838de52f8d4a20d388", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273696, "uuid": "40bd763a-a408-4ba3-a47c-d10bde4bc68a", "value": "T125C423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273696, "uuid": "1a093f26-dc02-48ff-b6c7-8bb5ca57e69b", "value": "12288:mA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWmSFyorOIic/7MPr:5m6Jj6ESfUxZ91kmY/99z83FXicTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273696, "uuid": "e4b7a901-2a17-42d2-a53e-ed547fd0234c", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273696, "uuid": "b212db14-2e67-4b2c-8476-e6a286f4a76c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273696, "uuid": "b192b34c-ace2-4207-bb6f-805617b4a852", "value": "d1965481e03f0554d99b93756903d5b5600036e216fc49ca69d2b6034860a004.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bced860-c11b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791245921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245921, "uuid": "57c7954c-d478-4c94-be83-5052bc179324", "comment": "Malware payload", "value": "8a8793fb6467f08974dc1c15fa89dc3a", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245921, "uuid": "5f1b07bb-45fc-4576-82ca-5cf8c24354e9", "comment": "Malware payload", "value": "d201a44d067b1d5c79cebb4b1cd9fdb80e61258882186da74771cb63f89f03c0", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245921, "uuid": "9ae0dfc0-8e45-496a-94b4-649f1bcfc367", "comment": "Malware payload", "value": "babd68c35619b502b9ffc094d82d7c16f1ccf666", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245921, "uuid": "c5cff060-6a02-4058-b3cc-cc5f0ef7a9f2", "comment": "Malware payload", "value": "1542fc15fe7fb879c68d3c516ca9ef5a2ed1fbd2b1efd3c805650061eb4a266a9c3852f68b6ef1fbc1da07df7be3dba7", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245921, "uuid": "f76fe592-5f96-492e-a2a4-a731a48938f1", "value": "T11C1160E5329051A2CCE47FE275206904604ECAC385D4ABACAECD5C729849C51B316FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245921, "uuid": "b476cf52-8b40-472d-ba93-d248f932a319", "value": "24:GPOmPPBHJTBSB6OtB6PP/B/BqZ3x1tn92zBWx7BFKHRc8:GzPDNy36PRZ659MBkBFKHRc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245921, "uuid": "f0bc3868-21fc-4001-aada-89ec3fbcd5ea", "value": 1092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245921, "uuid": "6db9e831-f387-41c9-9d79-f59d426fddf3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245921, "uuid": "46609e85-4a69-4163-93dc-1d7af8d81fb0", "value": "mbupload-nlukip49.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb13ef7-c180-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791289461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289461, "uuid": "752c248f-bc8e-453a-accf-304a8ab220b1", "comment": "Malware payload (XWorm)", "value": "b0e3e427d0fae9fd9b8d68951ad75d65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289461, "uuid": "f31127f0-173a-4f40-b198-3264e8928736", "comment": "Malware payload (XWorm)", "value": "d2695c2d10486ff2f506a502105740fae7ff05b8777129065390960cb0023189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289461, "uuid": "7e2fbb62-5a7e-4f3d-8c68-b6eb8de4f4fc", "comment": "Malware payload (XWorm)", "value": "28782c35d2cfca64fa1f56197e15f37c3da69d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791289461, "uuid": "4e45b082-9e26-42c7-87b6-56e6584b414f", "comment": "Malware payload (XWorm)", "value": "e8293acda7c2244b689d27f04882f72b0643fce36568bb3653fdea5b76aa5ce84a99c363ea8d109afe304fcf1cd70bca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289461, "uuid": "fc0e3ddf-d59f-4ec9-85f0-f3bee70ccb72", "value": "T1C8140D52078917BDF68A0ED8C99B240721F1D4177D285248BBBF6AE7BF3B9845030B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289461, "uuid": "f2573540-a6e2-4149-9b24-af0f866d7cd1", "value": "1536:lUDxjxAB/4odicUFD5Q/5+VKIsTcPktS2/QqWbRHZ4RmzOM+wEqnUIVpqKD1fPDR:XIVpD7ufIN38Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791289461, "uuid": "25a35ffd-9c1f-441b-acfd-1663e60f2a01", "value": 207707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791289461, "uuid": "6cd5bb7c-406a-4b78-8b7a-f90a87d73833", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791289461, "uuid": "3e7aa368-c5a9-40cb-b6b3-282f2aa01691", "value": "COTIZACI\u00d3N PARA OCTUBRE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a24d7a-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274824, "uuid": "a994ede4-946a-4c8b-a8b3-4e754dc6bf09", "comment": "Malware payload", "value": "901dbfe93052923941710db3aab0bb05", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274824, "uuid": "64e7231d-db1a-4a92-aad0-aebd2e3df89d", "comment": "Malware payload", "value": "d289a3b576befcd666e600f0f9022efd829062ea88a5f306ce7376f92e60acc5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274824, "uuid": "36ebe539-4af0-4eea-a5df-90bfbaf0df3d", "comment": "Malware payload", "value": "f35ef50518ceaed7b7a4aea8e30d6a5ac9e016ab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274824, "uuid": "4a5bf10f-f263-4593-a3a5-035877c3d668", "comment": "Malware payload", "value": "fca281a5fb30cfd197d439396579b0ec05d8ce61825ed3cda527ea8fbd3e8e87da1187dbbdfdaa88b264429121283cab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274824, "uuid": "3061ddf9-4350-461b-98d4-0a1df2dd173d", "value": "T120B423F193429E0B23A4DAB457A3DB3375CE7292769D9301CA06CA9F4C7072886DC16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274824, "uuid": "1cdde4e6-c803-407a-90b3-a020919ee75a", "value": "12288:Xkmht7DrvdyibCCH1oHF9nJ/qjuyogoJrrzTPwkp:XkmHzMsH1ELnKogoJnn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274824, "uuid": "62225ccd-7c0b-4eb4-8111-a44463b78bea", "value": 493748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274824, "uuid": "ecdbb809-4a50-4322-9831-f67097ce1304", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274824, "uuid": "0433710e-8d3d-4f62-9f2f-e54dba5cca1e", "value": "d289a3b576befcd666e600f0f9022efd829062ea88a5f306ce7376f92e60acc5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fd2307-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275060, "uuid": "7ea76556-086e-4859-8e98-3108cf8925ae", "comment": "Malware payload", "value": "40da9a875dde6adc4c25c1df5247b590", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275060, "uuid": "09f711ad-929f-45f2-91e6-4b1b1fb5519e", "comment": "Malware payload", "value": "d29b412528c57e761c46f7a8ee621d7fd47d40fde2484761282c55972d2463af", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275060, "uuid": "758ba5fd-6b46-4d71-b597-1a47f6eb6852", "comment": "Malware payload", "value": "24c5c92221c8fc1a72a2141fdcfbc5a7e29afa26", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275060, "uuid": "45aeba0d-0f41-4062-9040-ac6da31a8f18", "comment": "Malware payload", "value": "94e77c6917c016b7251e68e34d1f6097ab55bcc44e33af9d9379b5b5ab685e22ebcfeeb5a292665b2c2481622e9e2b4f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275060, "uuid": "7836ff4e-ad3e-479f-9e42-e20afc328b59", "value": "T1B1C423445C187B6C3AF6A0FD2AB65D83631E1DFAF0D23DBEA43484FE1C16264A18587D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275060, "uuid": "c131e8d4-5c5a-4d7b-b053-e41cd5af170a", "value": "12288:Eb7TqKR2IkSlQ8ALUMF2G5SLjrlFlU7ecTUNZhmbs2sYbl7P:q7fkSlQ8AIMF2SSPrlFYTU3hVYbl7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275060, "uuid": "62cae75a-08e5-4716-84c5-9c25bad8f0a2", "value": 584990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275060, "uuid": "f675f253-2dd2-4c6f-95c7-0881c3229b66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275060, "uuid": "adb6ba3c-ccb6-4d88-b304-59dcd1917f4c", "value": "d29b412528c57e761c46f7a8ee621d7fd47d40fde2484761282c55972d2463af.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd011a0-c143-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791262995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262995, "uuid": "9f36ed73-5030-4c14-a86a-252cba71f174", "comment": "Malware payload (Mirai)", "value": "3aa5350b772818d00d2c535817ae52b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262995, "uuid": "bbf213ba-936e-4f47-a131-55a9a75b66a3", "comment": "Malware payload (Mirai)", "value": "d32953f35a7f27e058dd352e9b20f829ee7681bc3d47da2cfa486e93d37ede79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262995, "uuid": "6ab6aa12-ddad-4605-9491-6fb038f97db1", "comment": "Malware payload (Mirai)", "value": "9cadb708a3c2c888f9d285149b73bbfe9991ae80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262995, "uuid": "7ab5c205-1736-4381-80a3-680a43b61e93", "comment": "Malware payload (Mirai)", "value": "b086249cdfae8c3a94b02ebe66e8fcae63bbfdff3c00c96866c252065f10f374ed8e906e31d2b1dc13b57e7fc0058fdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262995, "uuid": "374a24f1-ca79-4b5c-9b98-d4b6f783f1ae", "value": "T1550474BDFA11BB6EE268873187F26FB2C39521B22691D341E1EED6185E7118C085F7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262995, "uuid": "6b458d48-6e44-4013-be81-73c57d6a8622", "value": "3072:841/Wq0K/xbI8hUYrNcR1EqeJqJUx7DbpSIeZ8tjTl5:31us9BBrJqJMDbpSIeZ8tjTl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262995, "uuid": "34e893de-dc1c-4353-b58d-fdc46caf730b", "value": 181798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262995, "uuid": "22fcf706-6d25-4dc0-893f-347fc0eded39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262995, "uuid": "e4a7d1b5-7b54-492b-8928-af9aa853ad17", "value": "gnome", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1362fd5d-c19a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791300291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300291, "uuid": "a50dc04f-be89-4ceb-aef4-e3d6bdc78885", "comment": "Malware payload", "value": "7f41f2a149d440adc112e4f75cd33083", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300291, "uuid": "99727070-be01-45ca-a22c-c375f6b3c252", "comment": "Malware payload", "value": "d340418d4c91daa1fb6b22d4549337db6d5f6d7f0be41e6130f69020782e6cb5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300291, "uuid": "6221c32e-a7b1-412a-b1e0-41696497a6c7", "comment": "Malware payload", "value": "88c4e990538edf350076e304602971d2c5edffe6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300291, "uuid": "2fb49b55-8d2a-4d85-9c1b-3e3db0e06720", "comment": "Malware payload", "value": "ec43482bf0c877b7aae34c69bf7ce115802db9b37d1ddbaa4f29399e3222b52d5f65224fd0e979913176d135ac275c39", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300291, "uuid": "6bc7f5d4-c037-429a-af05-b02857afbdec", "value": "T13A17335154B83A35DB373230881C4ED2F66C0284C2DEB59DAAF88FE5B4934D3CF5696A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300291, "uuid": "9f06179e-68cc-4a20-a0b8-9a6e68168a0a", "value": "393216:VrC+rCxu0keY1eWdB3IHr9ODWMMsap9NEFZuLi57K2XbgCP0Ss:VrrxJeY1eG3ILsq1po2W52OfMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300291, "uuid": "dddd725f-dc59-4d89-a2ae-5d00f29c6f1c", "value": 19744852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300291, "uuid": "78afcfd7-b485-4434-9da4-e7e6a141c7f4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300291, "uuid": "6f0615d2-c389-485b-be49-74ab5ec7bfa2", "value": "GoobaCracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f460256f-c179-11f1-927a-4201ac107004", "comment": "Malware payload (XorDDoS)", "timestamp": 1791286496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286496, "uuid": "ff4f0a93-043e-4d80-8c75-5de5863185b4", "comment": "Malware payload (XorDDoS)", "value": "dce6d5f553e154c327bb80cb0344709f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286496, "uuid": "bcdd64e0-f118-4bb8-bf26-3a6baa483dc6", "comment": "Malware payload (XorDDoS)", "value": "d35f07b2001d9d5e2c74ec95f055c7701270b918f7795e671af0e2cec2dab80f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286496, "uuid": "45231ddf-423c-44b0-9f4a-bda3cbcc29c8", "comment": "Malware payload (XorDDoS)", "value": "eca630bce5ecc5061c69bc635570fdb53d389ae9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286496, "uuid": "6c345eb8-db03-4b09-a688-f00b811d59ad", "comment": "Malware payload (XorDDoS)", "value": "8ba7993169fa7290601affc6dcfe2aa45cc6b627506d1e747f620264a6ff1130a25cf034b72297c8cb5e52c46c2da7ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286496, "uuid": "432786f9-f0a8-47f4-b1cc-9752b67146bb", "value": "T14AB32801F742EBB8E68308F5087ADB64FF354D1B023088EBF7D166B4B8A1A9154E755E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286496, "uuid": "7161a4c0-8246-4bd3-9530-b1f9281d923a", "value": "1536:GVrNxG8giUnvzkgJaWdOFkRCfni290e7vmrAcWA+WdObWrzxe/T7vqfFzLRrl+3p:Gp68giUws+knSlGldL8/T7vqfvAzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791286496, "uuid": "a4d5b1c0-1352-463b-9659-a3b3182cdce7", "value": 114768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791286496, "uuid": "b4320bdf-9e79-4a33-bef9-36f871f5e4ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286496, "uuid": "ef4d42cb-daf1-4565-ac3b-71c11b208b6b", "value": "new.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f642be3f-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274043, "uuid": "a7b234d1-2f69-4e95-ad52-ba27b3837711", "comment": "Malware payload", "value": "0e091464993fdfa03ace15b344480181", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274043, "uuid": "2c9d12ac-3539-49f3-8a8d-60f88b6cb67a", "comment": "Malware payload", "value": "d391a9d63ac3798e5fe539967107ea35d57cd3e391b4acccdeec6c484716754c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274043, "uuid": "ac2330e1-b79f-4cdc-afdf-1d2446e65523", "comment": "Malware payload", "value": "003022004fc4c2c9ca8450e7fa3e4a08d5fea2ee", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274043, "uuid": "3cd50e84-e079-41f4-bc18-b0c316bc0934", "comment": "Malware payload", "value": "d366f14709526190f5bb5c29ce34a048b72bf090b157a934a1bead39ccef6150363d9916aa1fce39e8b9c5aa165bdefd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274043, "uuid": "5acb862a-7743-421f-8aee-fd94ee746e6a", "value": "T13FB42369227F71900C7543A94B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB195638E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274043, "uuid": "71d3e21b-fa13-4eed-8ca8-2fba7d2105e9", "value": "12288:47JZAaFpeLqO3g/ALyYG0ZaDajTCXMO8xzDOe3W8:ELpePA/f0Za6TCXKBxm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274043, "uuid": "ac9d67b8-68e7-412d-9fc7-f658eef26bde", "value": 542164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274043, "uuid": "170ae798-4bee-46f9-9627-9b0bc55c1e6f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274043, "uuid": "c764f231-62d9-482d-931e-03567c4c6580", "value": "d391a9d63ac3798e5fe539967107ea35d57cd3e391b4acccdeec6c484716754c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba0b78c-c152-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791269408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269408, "uuid": "7ac6aa6b-d604-4389-9861-70c981c3943b", "comment": "Malware payload (PureLogsStealer)", "value": "83f7f0a5a5475b33c66e39c8afe6c293", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269408, "uuid": "94de2236-a823-4def-9379-75d3020c863a", "comment": "Malware payload (PureLogsStealer)", "value": "d3ac1fa2c9bb8ef73f91f699b9896f45a65021c5b1e4bbff1b1ea0b701066f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269408, "uuid": "74ddc982-9187-4237-8a1b-a80486761edd", "comment": "Malware payload (PureLogsStealer)", "value": "294c1639e844494e96fe1e984d1a8e8f15d6a503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269408, "uuid": "f51d1a9a-d974-42a4-adb4-28d3da77255e", "comment": "Malware payload (PureLogsStealer)", "value": "f4a3b289a30be162c3ef982b568c47f8c6a7dd2598a779aa7c01935a0374ee1a98150303380296ffdff21da18a574e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269408, "uuid": "d7088d0f-b38b-4a8e-a3bd-e3c6be77afe7", "value": "T1F565CE04221BDA23C25526B5C9B3E1F41374DE84D933C32B49E6BDB77F36EB5A5402A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269408, "uuid": "eb129014-ebcf-48ab-863f-0d305d90ddf0", "value": "24576:Q+hbtQ3pjsLz4i5vQvPesio3uy3zCtA06mFgpw3uthpLQDegdI:NQ35Kz35vQ+Po+dtA06mFT3uRDg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269408, "uuid": "48561c52-3502-4774-aa39-9b02479b93e5", "value": 1452032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269408, "uuid": "88a8bc7d-b5ad-474e-9917-4c17c9f5a77d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269408, "uuid": "cf38352e-cc3d-4165-b735-7ea2597b104b", "value": "Mbbank_0786071844.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4b31a3-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1791273329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273329, "uuid": "135b0ccb-2d16-4187-8f71-dbadc42ffa6e", "comment": "Malware payload (VIPKeylogger)", "value": "a797b5d027c2df989d63071e95bc3c88", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273329, "uuid": "b96355bd-4765-4726-af61-ed38169f9ae5", "comment": "Malware payload (VIPKeylogger)", "value": "d3be2162de8036769e257d81fe5241e84572abfb49fa80d948a220fb3e901aed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273329, "uuid": "c838ae55-d9ff-4aa6-8d08-dc37ae883a5e", "comment": "Malware payload (VIPKeylogger)", "value": "0ee0c18e649aafe0f484ed3d5be9981284db4cee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273329, "uuid": "15fb4598-73cd-4184-aa3c-d15adb747543", "comment": "Malware payload (VIPKeylogger)", "value": "9673653d08882be62701137f8cffdc68052c6d972d7ddd2af933fe4180f292d67ad01eba62f9788a890efe8936fd9767", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273329, "uuid": "ec37f10e-d64a-439d-b770-23be0d6d504f", "value": "T11DC22F44099178845373ABBFAB1798E8FB77056B01948407B86CB850AFF2D1CDEE4DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273329, "uuid": "06e5f908-7877-438d-b8b2-dabdcff9258c", "value": "768:PQ6Z6RylvbRWXO1fl1HYwt3wwVeraTP7idghCPxm7Qtjf1MPjXvcUsarQCP0sqWg:IIVZuOjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273329, "uuid": "48f8c042-bc36-4233-8f89-b405f113d27e", "value": 25745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273329, "uuid": "c5ac820f-b8cd-4181-99ab-8c820f0016d1", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273329, "uuid": "42040d0a-cb57-493a-8275-71c5360ac004", "value": "\uacac\uc801 \uc694\uccad\uc790\ub8cc-0081 \uacac\uc801\uc608\uc0b0 rev.0 (O9.10.2026).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0196fe5e-c19b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791300691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300691, "uuid": "08366b11-5f59-4390-a130-3d7a076c5264", "comment": "Malware payload", "value": "fd05c0c1278a9efc57d93afad973bb51", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300691, "uuid": "d0e812be-20fd-4571-9c8a-0d722219ea35", "comment": "Malware payload", "value": "d4166ae1adf4aee42b7acc26a1465d24d584f9d7f7c08d1cef0cc1a4c3add1ba", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300691, "uuid": "539d4f92-cef9-4d8a-bb02-e9589919b846", "comment": "Malware payload", "value": "8fd19089faeabc3a7ed40e66b7483decef9d9000", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300691, "uuid": "11414d85-7f09-489b-9eac-4ccc0caa3e43", "comment": "Malware payload", "value": "eba690c7f2623bab461865e4bc19038a4efe9cd67380c24833d9fe1bcdca2c8b04bd2911fcc5ea2a809e336404a12751", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300691, "uuid": "5cc94569-f6e3-4cbe-8881-862029fed763", "value": "T199062329912C0439DD536678D0569E72393E12C4F04F38AA2FECC2EB1D7AA562F4E74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300691, "uuid": "fe267090-77b1-4a3a-bee3-2375e137fd99", "value": "98304:oUpQQeCUtCT7JUUHuH5vEqqrsGrjcfXsLGI8qFEqWpC:FeeOHJHOfcfXsLGK4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300691, "uuid": "1d6766c4-9dd8-4803-b80b-5facf46571e7", "value": 3853127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300691, "uuid": "6f3d9450-9c36-4fdb-9cb4-d543f639c2bf", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300691, "uuid": "34023759-8a88-4ca6-ae4b-8876b7afc5eb", "value": "LuneX-1.6.2-cracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0295d361-c119-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791244858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244858, "uuid": "daada1fc-d9e6-428a-bca3-d5521480eed0", "comment": "Malware payload (Mirai)", "value": "2d070397b570ed476c1b29224fea664c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244858, "uuid": "72314e5d-80d5-4a48-933d-9258ebdfe9e8", "comment": "Malware payload (Mirai)", "value": "d422f810e0cea8d953606cf254858e5b8dd6370f4f6cacb412d1782254805dcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244858, "uuid": "207328cb-52c7-49fc-95bc-ec6f5c126411", "comment": "Malware payload (Mirai)", "value": "1970b06c4ff909c180c413f78cb3a3320909c845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244858, "uuid": "e7c67c5e-60f6-4195-a111-eb3108dfd8f4", "comment": "Malware payload (Mirai)", "value": "33fbd8cd4350a4279ebed0913ec8721704e34f0c6d15a8f73c0b0f8b3e8f05bbd81becb8a0a362ea7e2d23537549aebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244858, "uuid": "7b192c5b-9b0b-47ce-90f8-039d26787f65", "value": "T1EED44B032B2D0B43E3974CF0777707F4879AA85620F9F589EA0AADC69771870625E5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244858, "uuid": "8049642a-810c-4c4c-9812-17a5f5f8d15e", "value": "6144:DqhVYcXArflOCpZv/vWt7D6YWwlo/AmmqPgo+n86jEo67GU75txCv1THp+kp49EW:DqhycXIflOWp3m7T8SQgpp+knUWyudBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791244858, "uuid": "f604b08f-dd0f-4fc9-aae0-cecdcafe2a3f", "value": 641616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791244858, "uuid": "fc3e09a7-4304-436e-8277-35bcbdb6b568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244858, "uuid": "047c5a12-998e-4bd0-8aef-12e53d0ea385", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30805cd4-c127-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250948, "uuid": "0ed4bcb9-b7f7-49cd-aa4d-5cb1e74a6668", "comment": "Malware payload (Mirai)", "value": "4fcf8d48bee2d34f5c8bf484bf1b83dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250948, "uuid": "700d7a72-6aae-4862-8440-20372026023c", "comment": "Malware payload (Mirai)", "value": "d4d90ef87ee3382858823ce4ab5d4d654561ed201608546fabfe27ff72cbc14e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250948, "uuid": "51dd7040-f804-46d8-adf3-e86cfe6c709b", "comment": "Malware payload (Mirai)", "value": "d2ace4202a33b25997e84c08ccfea881d0fafdcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250948, "uuid": "117d3212-c209-490f-9b6f-46ea113f023b", "comment": "Malware payload (Mirai)", "value": "75da2dd9d8aef75b875222ec33c9d1acffc39b68435234c60869d7cf612b06af76dfe8b4c9c7a58b6856ae4c61fdbb53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250948, "uuid": "b59b32b6-7d58-4655-a985-4d0923fd02d2", "value": "T12973A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250948, "uuid": "f5b56194-1ed6-4e95-83e5-0077be999a86", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESt0:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250948, "uuid": "c42d52d7-7513-4282-84d7-8c1a7ef1fbaf", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250948, "uuid": "a0676203-1f56-49b1-a6a3-d714465e7c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250948, "uuid": "cffc97a9-e701-4ea9-a710-f44ad6afa966", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4fb4ab-c141-11f1-927a-4201ac107004", "comment": "Malware payload (ValleyRAT)", "timestamp": 1791262402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262402, "uuid": "b5af3e67-e310-4845-b993-d933df49b9bb", "comment": "Malware payload (ValleyRAT)", "value": "3da3c77545498bcaf0d6fe67e86ab53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262402, "uuid": "d7da69f4-d5ad-43b8-a6db-24e62cd7d081", "comment": "Malware payload (ValleyRAT)", "value": "d519f610b614473e4440c2a5480c62cdf7273c16e907dc3a3779bdbbeffdd931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262402, "uuid": "9e6757dd-12ec-437c-bbaa-e772d72b9bf0", "comment": "Malware payload (ValleyRAT)", "value": "53f50d3189f78d50f902c64188052231d78f08e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791262402, "uuid": "25f7be87-26c7-477f-a079-1b6be5149632", "comment": "Malware payload (ValleyRAT)", "value": "507c64e8a7455c740d58bf42fee4738bcf7b10cac5c3992f6a7c8e7883bcdb6720313643f65078004524239f433d6b8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262402, "uuid": "e3577443-7b11-40be-8d4a-2206497c74ae", "value": "T19A972C02B6468CC6F54852F45897FAA423FDFCB48AD5C31732E4671EAF9E28C0E83595", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262402, "uuid": "822fa965-2495-4062-87c7-941aeb2998a7", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262402, "uuid": "aa7e59cb-64a4-4d57-a1f3-e61c0c8ddeeb", "value": "49152:+F335nW2J++1hhWugAx8z/TdqRD4a85Ejr9CbHd5nYeWgRF:45L3XLgAm9EHUvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791262402, "uuid": "64518a90-5b2d-405f-8669-fa958b97348d", "value": 40686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791262402, "uuid": "584d99e9-cd89-4614-8709-f4b178f02ae1", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791262402, "uuid": "eebd4905-c627-4fd1-9ec0-2fc3cb950676", "value": "instdoload.1.3.09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f91441c-c188-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791292554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292554, "uuid": "a8334980-985a-48fb-9639-203cca3e6e7d", "comment": "Malware payload (Formbook)", "value": "f9d47b1137ad67a5459e4a2b1dcb46b6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292554, "uuid": "dc7b734c-1d16-4653-9582-6928e9c8030a", "comment": "Malware payload (Formbook)", "value": "d59ff957804da52b1e3e15460567eeec61ac0278320656d599f773bbf0626ed9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292554, "uuid": "27a91ffe-793b-481f-958f-25853569cd88", "comment": "Malware payload (Formbook)", "value": "55449c176f6e035d0264ee59928f2a03267defda", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292554, "uuid": "59b4ccfc-1b09-46db-88e4-f15f0de0edd3", "comment": "Malware payload (Formbook)", "value": "f05c2d6604d04c4813300aa479ff1f2405434d7d745d1795e4830e62f7e18094f1b53535f736a0ceded817fdf61422b9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292554, "uuid": "9fb0c708-3a05-424e-9b52-e8235af1e499", "value": "T16473AC480BCDD54202A152AF2A1D5047FB852F360BE3D905FC2C7F6B7FE29499918DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292554, "uuid": "4d61f14e-00fa-4ff1-b0fe-64dbdb20d7d2", "value": "1536:VXGnjIy403vocB8TGHIdmHizMxh7vDeX8:4gmHsMTX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791292554, "uuid": "8ab36392-0b15-470d-a293-2538117fecbf", "value": 77806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791292554, "uuid": "1ca25ff5-1d06-4ff3-9e59-d40c9315fd9e", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292554, "uuid": "ec95fcc2-6f1e-4e02-af23-5f42ca35f37e", "value": "NEW_FLF7997_SHIPMENT_DETAILS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31405e08-c193-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791297335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297335, "uuid": "f58abba1-83ff-4135-b985-65f7293a25b2", "comment": "Malware payload", "value": "a1e5f837f22c4b5c4398151c1613b77b", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297335, "uuid": "a2374db2-36ff-4942-9d41-476b891eeeed", "comment": "Malware payload", "value": "d5a3e198f38695a46b8941ac22ad9d0e097e7d001bd62b0e173e1bb0ec100c4e", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297335, "uuid": "fbe73cdf-d0c3-4d93-990e-410e76ec95ec", "comment": "Malware payload", "value": "ad599bc85afcc6cd14e0960cf37f6f4ae94cb40e", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297335, "uuid": "785817b5-5d10-4b9b-9ffb-85ac946260ee", "comment": "Malware payload", "value": "7d22e4f82b89db556047d35aa7b0a1e1806d879283e0f5165c7722feb54aeef24d3b9049b0210468008421f7722d6345", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297335, "uuid": "bf9e86ae-509c-4534-81e8-3dd8d97b5742", "value": "T18B51DF51F739DC3066DA9478ADDA8D12A8DA3876CBB3E444E213DC84B90D65D6006B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297335, "uuid": "dc439dcb-72cc-4351-ad4a-068c68b462d2", "value": "48:YOa2EOWskce9NMaEE68XA+TRI97tixM4HqTTwPh1gWLjU4tAvXrHMOw+sgcU91BP:ab9NMat6FiIPiYTKFfRMrHMQss9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791297335, "uuid": "805bbd3a-6908-4904-8e93-a90efc82b10d", "value": 3092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791297335, "uuid": "3a7b5327-b796-4550-aca2-da7a55029381", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297335, "uuid": "0b8d2ebb-51dd-4ea5-8354-56dd2fb1fffd", "value": "d5a3e198f38695a46b8941ac22ad9d0e097e7d001bd62b0e173e1bb0ec100c4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b6a9d7-c18e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791295458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295458, "uuid": "6a196836-c162-4329-b63a-693aad77458f", "comment": "Malware payload (Mirai)", "value": "09ff4c5d70867def0efd37c96f72cdc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295458, "uuid": "b951dbe7-e790-4194-81fa-925ec56fe5ba", "comment": "Malware payload (Mirai)", "value": "d5a73f875de105c03a6a298196e9e316cc9175d179c309015d72680df7a20464", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295458, "uuid": "e2c3a5a1-7522-4921-8c52-6d644ecfb777", "comment": "Malware payload (Mirai)", "value": "ed8b098658d668d6587d66263727a97210a864e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295458, "uuid": "18bd2400-65e9-4049-aafc-bffb65906b19", "comment": "Malware payload (Mirai)", "value": "d71098b458bafd37910225230c589e70c64ae4e093211684443e5b41c0003f17e43715a47ee3312b8fce599fbc7cb000", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295458, "uuid": "e0263f37-7797-4f2d-bc39-e410210a8036", "value": "T109240A01A9104F53C5C72BB7B79F429537326B28D7EB7302EA19BFB42F4668D0E29251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295458, "uuid": "085ed7df-7c48-48b0-bd52-d1ba7e0b7aa8", "value": "6144:uy8+1bc7T04e7YoEGMJjuzueveknyrNbXjuWFStcXtoqV/3k:uyPm04NTSzueSNbXjuWFStcXtoqV/3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295458, "uuid": "77a1cae8-f7c0-433a-8380-b873b930056f", "value": 221877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295458, "uuid": "202a2a00-ed6f-45e4-80ae-5ff9f3bd1a13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295458, "uuid": "382a66de-89ec-46a1-a04e-0de4cd7950ab", "value": "qv3.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6e8849-c1b1-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791310289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791310289, "uuid": "9b122633-8d12-4e5b-98f0-fd8b1d2a518f", "comment": "Malware payload", "value": "6e07ff00b1b65fd05c398fa5f63f3004", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791310289, "uuid": "8890f480-ee1a-4c2f-8fb8-13970b70c50c", "comment": "Malware payload", "value": "d5b96f051559b216d0fdc3571e606105ceab4790e9e29bfd4ffd75b89a0af69b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791310289, "uuid": "59405b90-ee0c-4741-a389-cd2c46b18176", "comment": "Malware payload", "value": "d4fad7ce0e2babd690a5c16ea9bc00e2b9bbb866", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791310289, "uuid": "baecf5ae-60ab-4881-9ede-fbfc765a338b", "comment": "Malware payload", "value": "5b43b66a1da922039bc2a57250544f5316cf9cfa73a8d4c23740f5603a83329fcefa789713d20cec1cf20825938f074a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791310289, "uuid": "ba6ba731-1505-4e27-8da4-fc4d2629739b", "value": "T16D42195CAED062B0EA1707DE73AF24691228A0C7240DC484F94CDDE87F06BDC4A57B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791310289, "uuid": "02db0def-8e65-4fb9-92dd-9785ee7ae589", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzXbqFtC1S1WRUM:sXX+/DV7k/3OFthWRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791310289, "uuid": "61890411-64ac-42a8-93ed-b90abda7efe7", "value": 12034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791310289, "uuid": "04eb7827-86b7-42d9-9723-9bc45fe9396a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791310289, "uuid": "1ac2842c-7ffe-430e-af38-bd254c0a6fff", "value": "rooming.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494c9265-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250560, "uuid": "180883dd-de4b-4bf0-b74f-9efa37eeb367", "comment": "Malware payload (Mirai)", "value": "b2d64641e04e13ea52672529e99364ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250560, "uuid": "50594711-c2f5-46fc-a67b-05030acae02a", "comment": "Malware payload (Mirai)", "value": "d62b6a54ddc2ee744aa56e285b36dd6142a1ec8cc4305dce6786c22a1ddd2802", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250560, "uuid": "7ad132a1-5c07-4646-b979-d6826c6a4d02", "comment": "Malware payload (Mirai)", "value": "5b278b6d5a87c32c4c531c50bf8d7e10170498fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250560, "uuid": "85a98c15-e679-4616-8b38-bd9733beab62", "comment": "Malware payload (Mirai)", "value": "097e9a65adf379b07a6f3ba6c72c4f3666cef2ff0525d3d8c93e268a0487b5db14c19260e9eb1b98a12d459b5609cd0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250560, "uuid": "2bda71d4-83ef-459f-99fd-2933b41b9cec", "value": "T1CC336C36E029DED0C6560234A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250560, "uuid": "6cf7b1b6-c4bf-4177-8867-2be342c6ea65", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250560, "uuid": "10c79875-03e1-4657-8588-2cea4fb891fd", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250560, "uuid": "39386102-4c57-4bec-a190-dc7b33d574db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250560, "uuid": "d23e486e-028a-454b-aeb2-24fdc2617e77", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45582123-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275035, "uuid": "4f5260df-e3c9-4444-9d86-5ff92700433f", "comment": "Malware payload", "value": "026a4865869c12190b95c999cfab3e00", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275035, "uuid": "46a418d6-54dd-41d5-9dcf-adf66fcae8ae", "comment": "Malware payload", "value": "d668cb61e964e7f145e68572bda3204f25bf59313dac1e531636cf126d45cb15", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275035, "uuid": "2480ab64-7f91-4437-a79d-3510e9b041ec", "comment": "Malware payload", "value": "d850f618f538b37417e7e2f643b1d20939d283ce", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275035, "uuid": "b8706fa5-ff4b-4ef1-8fd8-0c59deaecc96", "comment": "Malware payload", "value": "85e8d51087f941ac9bbd3b3bc4a6493fbb440204740e85fef40063b25e11913ec34f48230550dce279c28c8059808367", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275035, "uuid": "78cd69c4-d4c8-4c60-882c-950d4293a0c1", "value": "T1E7C4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275035, "uuid": "52029445-1449-4e25-9225-4f507e8b7a0b", "value": "12288:hMU+0xq75aS9iYIp6cP/G2Bku8FtNvC28c5/VTUPkYyy:l+J71vI/GHYc5/pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275035, "uuid": "8c764913-a78b-4470-a48e-86b7ddd382e4", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275035, "uuid": "3e5cb4d5-12f0-4d53-8532-267b782600f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275035, "uuid": "7c5703a3-f5d7-4bc1-b50e-2af51d708992", "value": "d668cb61e964e7f145e68572bda3204f25bf59313dac1e531636cf126d45cb15.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b2a277-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274254, "uuid": "6b5c0b16-0786-4a14-8de5-7aa56a021e2d", "comment": "Malware payload", "value": "7da82ad7c801404e4fa47d36e2b5c4e5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274254, "uuid": "bf1a0eae-0da0-4585-bb8e-aa82d988f42c", "comment": "Malware payload", "value": "d68cafb8f26d76b5cd2d770d6708771fc5d58a67123d26b42dee1cde372e2605", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274254, "uuid": "ecc3675d-4411-4843-982c-fb915a16e2b2", "comment": "Malware payload", "value": "5c8c7b806ef09e62bac12d93c6ac7327c209af1f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274254, "uuid": "cd5c3c15-8cfa-42de-93c9-a9d3872b1db0", "comment": "Malware payload", "value": "dc710a56fc9e77a945d3ebc5f68a24b8f92eaaf6a62f8446d129eedbddc7057d70368af267b2a63cf6d24643bca41d44", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274254, "uuid": "2e9ca58a-465f-483d-9692-d7ff14b216f2", "value": "T1F8A4239CAC901E565C9637905E3EDF130BB0E81B32EDCE79970B36A0D8F9D8455D824E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274254, "uuid": "659c9ca1-3477-45c2-a070-ef0edd6dd5fd", "value": "12288:vzYfcEaN9B/Jm0LU0gM7aQAF/KBrh6OF8uRNiwowhj:MfclN9BhmSHKKD/qWnogj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274254, "uuid": "e406fcac-9171-496f-b6a3-be69a21e01c2", "value": 467813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274254, "uuid": "3227e4f3-a0ef-44a3-a874-ee6b62cd041a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274254, "uuid": "9aef3226-e402-475b-a718-fce5896b2825", "value": "d68cafb8f26d76b5cd2d770d6708771fc5d58a67123d26b42dee1cde372e2605.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6576688d-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791273371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273371, "uuid": "e4aea728-3c98-4a67-a1c4-5932321d1122", "comment": "Malware payload (LxBaseRAT)", "value": "45a016d4300be9f45dbf2ddbaa3a9be7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273371, "uuid": "788ef6dc-cb55-4278-9774-3729317c15f7", "comment": "Malware payload (LxBaseRAT)", "value": "d6d12deeb073f8fb45305f125cccad234b21b723920b6734b717f215ea04967e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273371, "uuid": "20f47f39-acca-47f1-a4e3-f992dc28774e", "comment": "Malware payload (LxBaseRAT)", "value": "0937adb060b01e0f5210a20c7aea2d5385b3194b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273371, "uuid": "b4e5457e-5b7f-4705-9872-22c04f3991e5", "comment": "Malware payload (LxBaseRAT)", "value": "73c18957da6c3a828426e9364ace5b51bd22266097841a1844120457e23ce616e64b56c2e8029e1e54caa8f837479358", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273371, "uuid": "2197058f-f3b1-4923-8f49-d1e00cec4280", "value": "T12BF49E31627C905D2D67945B237BB533BA1EFB2DD2062A0045FE43C271F61BA92374AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273371, "uuid": "994ac4d0-37ae-49f5-8ae0-4e070f3a43d5", "value": "12288:7u+rrV96g+IQ5JdvmrHzzw16CXely+YPyIhTJCSerWlKIjmWIMmdV2U1AdGu8is:7drzh+IyJdvmrTz/OelpgXCKgIGMmd8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273371, "uuid": "7cd18575-9e7c-4a63-acdd-d1cc5f6354c7", "value": 724524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273371, "uuid": "e6f3715a-9820-44ff-9afc-3ca887e4316f", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273371, "uuid": "3344da50-d469-4034-96d9-2d76c7a02585", "value": "BI\u00caN LAI GIAO H\u00c0NG.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef455480-c150-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791268878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268878, "uuid": "b3be332f-503d-448b-bd61-d4f0b40abe49", "comment": "Malware payload (Mirai)", "value": "dfa10494771f54af1802ef82cb89b474", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268878, "uuid": "096e240d-510d-4772-a6ee-520ad92990d3", "comment": "Malware payload (Mirai)", "value": "d6f225d1c58a1ea7b4ee54afe26607b8f5d93c5ee3092e5ea4271ac7cc606890", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268878, "uuid": "4f5b637e-7f32-46be-84d6-bc2def004973", "comment": "Malware payload (Mirai)", "value": "8c528e5d25be8bd47d3e48033dce3a55d233ca5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268878, "uuid": "61d384c6-218a-4ffd-a7a6-703a579906b6", "comment": "Malware payload (Mirai)", "value": "02f76bf315e4d5b63c8a6a984154381c7d1af1e89f4d0b0f5b1da5a6f8506d715996ae78f66167191178c6c952ee8a9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268878, "uuid": "ceb3ad9b-427e-462e-804f-f5ab820c096c", "value": "T117F308CCE865476FC6D323BAF649568F33321B78938BF32159A7EAB41BC17481938191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268878, "uuid": "7e42577c-87e1-4e65-8f3e-f4a58bf7b8d0", "value": "3072:h6IjgRsJGMPeuQ8oGM+AL1r9PDv1ZpYZsW1zmLmS44hzkj0ILngGMuFQPHjibosA:LSibosT/aK7Ouddm2Wm+WusQ6zy5s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791268878, "uuid": "436c86c5-ab40-468a-be7d-00b6b5496dbe", "value": 164155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791268878, "uuid": "d2ba3a43-a045-471e-a8ae-751153006874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268878, "uuid": "3811e9f9-e4fe-4f02-a8d6-38ed8c1afdcd", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e59eb50-c164-11f1-927a-4201ac107004", "comment": "Malware payload (PhantomStealer)", "timestamp": 1791277198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277198, "uuid": "b68f309f-76ec-49f4-ba3b-7f22354f6ef8", "comment": "Malware payload (PhantomStealer)", "value": "d8587f28f712c8bf08a7f5dbc6b9812e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277198, "uuid": "a5fbb2ae-6c7d-4a50-8124-8d9836ab278f", "comment": "Malware payload (PhantomStealer)", "value": "d704c8f0869ec2026e2361b8d7de62a47f0c3c2fcecd65a15d1aef5b500b2a1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277198, "uuid": "bf5ea212-87c6-4f06-84aa-2828eda2a723", "comment": "Malware payload (PhantomStealer)", "value": "3d353e8d8b9ac7ac7551434990a3915d2db0e208", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791277198, "uuid": "b870b148-4231-463a-b616-d5ed79f98151", "comment": "Malware payload (PhantomStealer)", "value": "f88c034e5ecc6ff84310872114c1f5a75ba0df671b5f0899754ea130c6e47f2f8185cbe33c7831a2f44d37f092870f1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277198, "uuid": "a7ed9ee4-d575-4b53-97c1-7a952d3290ac", "value": "T193A619AA135896327B259B8C923ACD31A58E715364D5CF38319DF2187B5CC0BB38D9E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277198, "uuid": "23bf7aab-e4d2-4957-9b06-a4cc9e2a6369", "value": "196608:LQGQLvvGIiGQ0hhp6/mIq9WHC9t1yA8wYphK6CFtmdBqTki6lvvd+gz+69C2UQa6:tIv+AQ0xbt9TIoYX6WvvEM+6VnrZMnL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791277198, "uuid": "e89fa984-d62f-4c06-b816-a065c8a5f8d0", "value": 9507530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791277198, "uuid": "536b6aad-daed-46b9-999a-127f6b554ec4", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791277198, "uuid": "78d30ece-6134-4a9d-9212-a4686b7ac359", "value": "Rechnung und Kostenvoranschlag.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc6a65f-c198-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299582, "uuid": "31c5b77a-df33-4ca0-b240-f3646e8aee9e", "comment": "Malware payload", "value": "29d68b8d36f49bc0a5649bea12a206fe", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299582, "uuid": "7ba3be42-036b-4e4b-98dc-9d8822c50c7d", "comment": "Malware payload", "value": "d707e48f44fb0580201b7878b0c3e707b6f0629b7d927cc9f03dd574c49556ef", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299582, "uuid": "c035307d-6bc7-4b4b-b536-b4e2fe168e41", "comment": "Malware payload", "value": "541332168b8b98e007c14802348b6a9f341cc41b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299582, "uuid": "2049e54d-3c54-4b20-b38b-1f32694c91e7", "comment": "Malware payload", "value": "30d0dd0c8fc6c8a3fc3841896c5774a6a9cd7980d960cabd44074aed9ad8b293cdb54ba86cd64c197c36588f351425d6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299582, "uuid": "75229a8c-c030-46eb-8ad3-07e6d665443f", "value": "T1AEC53364E729B22EDD27E634F0106E902F9F52C494573C2BF2B404EE5D9A3E093EC55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299582, "uuid": "e98734db-fba3-420e-a433-63f70023adec", "value": "49152:WqGiVtEBw5CBevxHtqvYb8NrucqfXelzPid8grdmSOM08KRvvY1rq4h1c:P2BK5H4gINra2lzPrg8sKFFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299582, "uuid": "1a3ccd3d-7597-4a1f-96d6-fd1a08095460", "value": 2642064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299582, "uuid": "b364e120-e222-48a9-87f1-cc19e36153c7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299582, "uuid": "67cf8936-0099-43e6-8f8d-59547c21a634", "value": "bagelCRACKED.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c14d809-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273811, "uuid": "2ff3ccfb-ca7d-4e8f-952b-113153cd9409", "comment": "Malware payload", "value": "a57a540878b70b31291555fe0ab20d98", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273811, "uuid": "3fadd6ca-5247-45de-bb38-621c696c5fc0", "comment": "Malware payload", "value": "d70c61d72727bd15c6327b3e173e6771a0f56a9c502668c28a95e8001b05f76e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273811, "uuid": "954e6aab-b853-4b44-a73d-0257e7051d69", "comment": "Malware payload", "value": "5845ea371dcded68847ce52126c0a18e3fdd7bdc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273811, "uuid": "e7abb4be-412e-40d4-bf0a-67256605c69c", "comment": "Malware payload", "value": "29c845277caf47c89f5daa3a5c94a6460104b3f81becf17230ad63aa1275b24f00aeda9f9d663f0b5744b4973e4602f8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273811, "uuid": "62050b24-826b-441e-8114-2519e3098e98", "value": "T10955338B817C19C44F7D0E52B6EF811C62284EFC1002197B6B6644AB753E3DBCAB599E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273811, "uuid": "b20eaacc-ae7d-457a-916c-50dc85974af1", "value": "24576:woZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaROIc:woZ9bq+MmMEL+hcjXHC/wnwdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273811, "uuid": "7446213c-eb5a-422b-aa0f-2d8e0e54f1af", "value": 1380594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273811, "uuid": "d8cad8af-eb84-49bc-8f16-9a2e6d1a835b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273811, "uuid": "7b5d66c0-0eb5-49a5-998b-2571d4794943", "value": "d70c61d72727bd15c6327b3e173e6771a0f56a9c502668c28a95e8001b05f76e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce86b7bd-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276124, "uuid": "00fd09f1-eb2f-46e5-8368-1b35352013b3", "comment": "Malware payload", "value": "52e5cf0d837934cdf7c7995b36c629a7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276124, "uuid": "3223d943-c79d-422f-b96d-58401ac87f91", "comment": "Malware payload", "value": "d714eef16e7caba3eb25efbfb2cd1790a93fc3c4a925cd7bc419566ee90c49fe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276124, "uuid": "9071ffaf-bf53-4093-a7b6-028132a883d5", "comment": "Malware payload", "value": "f11bbf6c7fcaee3a4c59927ca091fc045b251ff8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276124, "uuid": "e7fed6fd-1f2d-452a-a1cd-e58f291be80d", "comment": "Malware payload", "value": "90603c8d8ade55ba90f4f632a0f5effe1593b22d063e1af67e3ef0b064c578270775fbe185b7b47e19601046e3609da0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276124, "uuid": "f1e88714-870b-4aa2-b034-890cc7b973b4", "value": "T1F8C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276124, "uuid": "c9c125fe-8274-4736-9d75-df12c5858803", "value": "12288:L+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byeH9I1P0QKw6FEw:L+QqldA/TSO713u7xneH9IaQKHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276124, "uuid": "29c6ac2e-2f8f-4a9d-b0cf-c48a9afdcd21", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276124, "uuid": "032fc12f-9509-4dec-9626-a8ff561adddd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276124, "uuid": "a2db4ae4-be2d-4d0f-9283-d828361ea8c6", "value": "d714eef16e7caba3eb25efbfb2cd1790a93fc3c4a925cd7bc419566ee90c49fe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41c7eda-c151-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791269262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269262, "uuid": "3c467e44-71a6-4b8e-b24b-aee5d2cd8901", "comment": "Malware payload", "value": "155fe9876171f4d80052ecc39d23507f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269262, "uuid": "f43aa3b2-7515-4aa8-9270-2632e75e1838", "comment": "Malware payload", "value": "d75a88a95c7b6b8921348d5f7189ede666afa326af7a48c49b17a4e7586ac324", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269262, "uuid": "3eaddd44-b4b4-4708-9843-45fe403f1606", "comment": "Malware payload", "value": "3d8b4d1f40b20e391e83aa2f2d3418b8914b12f5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269262, "uuid": "19c59b52-8ae7-4dee-9f8a-c6adb458a0be", "comment": "Malware payload", "value": "0d88807030be196d2241d575b66d3466c5149fbab6c4f70b4f8727a4582dfde80a8a1d2b31967ad3f318c0d633597f53", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269262, "uuid": "d1ff2f11-ebcd-4cf1-96d3-e564db74d1ab", "value": "T1EDA523E2B3066837D6BB2233D9A7632222358F9046967B172484357C9EB37C80F59FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269262, "uuid": "4337b1e1-01e6-41b2-b6b9-2d416c3c7d73", "value": "49152:UoYkC/x51WgOOfdvtHpfM5jad8kZFTkLc/1GBIrkzgOSN8YN3uZhY:+kc5eOfdvNp05Wd8STkLkUyrkzgTnN3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269262, "uuid": "e99691cf-b494-4419-96b5-ce118aeffdbb", "value": 2229226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269262, "uuid": "c3b4be31-3152-4b55-9e4f-c35aaf7ad75e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269262, "uuid": "a50569ce-24f2-4eaa-ab17-67ce756f1391", "value": "2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98734c9-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271472, "uuid": "1ab96982-6f6c-45da-aa21-b2482c8f0c50", "comment": "Malware payload", "value": "f18caf18bc3b16ab2b41f2019e70c0a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271472, "uuid": "0ad0e52a-d904-4072-adad-b129a1a9cdff", "comment": "Malware payload", "value": "d77f47bc7d287fd0b3b1bc39b6acd261364a3f8152ce79b3c7ed2291eda32cc8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271472, "uuid": "8ba505ae-1aa7-4758-9a90-2469d71844db", "comment": "Malware payload", "value": "d470451060d72285b8c6149c6dfe8dad83b454f9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271472, "uuid": "a165e2b7-410f-4717-9fd1-5c0c30e66528", "comment": "Malware payload", "value": "6fbe57be368023c3ff36543fa7701f0eca6bad1f8e128d364beb4f2bc9ac63db69d7f802736e0c35e2e24a94812f16d7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271472, "uuid": "dc87097f-9c97-4c7d-a925-f6547705f23d", "value": "T1C3B4231EF4D078CFD68ACDA394292C785F6C96C9CD126B7246C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271472, "uuid": "f52056ca-2497-414b-8413-808b5d145bd1", "value": "12288:9TibgSMFBOBSlqrMKu7FxPbzJTVBU+8JM9hAC8Z3fVOBRkbKQDiUbpKC:kcSMFYaKkxpTKJM9mCw3fVOMWAPbpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271472, "uuid": "7f727399-5b66-403f-a5dc-1bc51fee6511", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271472, "uuid": "117efea9-d1b3-4ea3-8297-81599d774d00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271472, "uuid": "d92b5b6f-7e89-4421-af28-74eef1aeea12", "value": "d77f47bc7d287fd0b3b1bc39b6acd261364a3f8152ce79b3c7ed2291eda32cc8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be70d869-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246032, "uuid": "dd64047b-6be3-4fc4-8377-a165fe19691a", "comment": "Malware payload (Mirai)", "value": "46d26327a2bb4d4c029c6d82a23958ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246032, "uuid": "70203555-f3e1-42b2-82db-de5f96ea53ca", "comment": "Malware payload (Mirai)", "value": "d82939a1df24182bcbb6a2427ff6919e83f74472d6ca00b3c97d5f6561b4dcdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246032, "uuid": "244583ac-04f7-430c-b185-25e99f19f215", "comment": "Malware payload (Mirai)", "value": "7d9f5809e9655bf0bea64186f7048586dba06be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246032, "uuid": "7c3ac37a-a3cd-41e5-a3bf-c64f0473d792", "comment": "Malware payload (Mirai)", "value": "a5edd2b2caf5e7d93ecccbee66aa46674a2c5341f76a4850a066b812d554c21dc473c0fab12a96b0e96d4f713463a5b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246032, "uuid": "ce104592-e1c0-4de8-adc6-8c70d935ac56", "value": "T166C43B52F8419F93C6C12ABBFF5E834833175B78D2EE710299156F74A3DB8960E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246032, "uuid": "654ede55-5fa0-45af-ae19-53c1acda2670", "value": "12288:bwsf5OK3BFk6kvr1Bv3AgllWaMA9YF0Z5IrR8r2A7x451v0:txF4RB19Q0G8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246032, "uuid": "4fa66f0c-d312-4512-8e5c-9b6af81b4285", "value": 565136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246032, "uuid": "2d2ce43a-390a-4fc6-a8cc-6b0b07bb9891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246032, "uuid": "ca272686-3a22-4c06-8613-41c0a9ff4ce2", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b44ec4-c187-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791292101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292101, "uuid": "542a11b3-ca57-41ca-9c15-59a8d3cc3203", "comment": "Malware payload (Mirai)", "value": "af202a57f0d1395a2d41b6bfd83b6834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292101, "uuid": "f3713884-cd49-481c-b63f-30bfa9680dfe", "comment": "Malware payload (Mirai)", "value": "d82b009f6089172bc6ba364b039dbaf97887b52f80cc297eaa755b00be9c7d16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292101, "uuid": "4b751a43-5ef6-4d19-bb16-c2ee5a127f8f", "comment": "Malware payload (Mirai)", "value": "0337da30287a0ae27aa255f50c6c1a5cd5512026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791292101, "uuid": "f10e7c33-77da-496e-9410-abaf8af7765c", "comment": "Malware payload (Mirai)", "value": "8cf533fe2fcbde3e4f03ce24a0e8ab84e256502a2f68d73267ebd85f39fecc365c718d99649f449ae309689e8d06dca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292101, "uuid": "f16f5fdc-ea7e-4d07-8935-ede9030113dd", "value": "T135633BC9F983D4B6E857093010BBAF638DB3DABE3168DA43C3A855369D12503F416E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292101, "uuid": "892b71c3-8eab-4933-ad08-fd2adabf4f55", "value": "1536:ltWizyAPQQsTb6vF7lOvZOWsIyq3XkZSY5:ltFyAJsn6NJOvwfIyqs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791292101, "uuid": "e1c24120-6aa5-4e7c-bb2d-58e2098a3cfa", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791292101, "uuid": "ebe26433-1008-41f7-9623-6ef63ff24a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791292101, "uuid": "9701852c-bacf-40d4-a796-1da5724c911b", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca60861-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263666, "uuid": "e9bf6cbb-67ef-47c5-b10e-7b0c50a36f7b", "comment": "Malware payload (Mirai)", "value": "65134471b25da6826589abcfc9c42788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263666, "uuid": "62434d6f-fc2f-467f-a7d4-851a4d38bd2f", "comment": "Malware payload (Mirai)", "value": "d962b904fc789b59367cf25adbb3b25f0ec9573d6949a32a703bbd07cfa38785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263666, "uuid": "c84f1c41-34f6-40eb-b29f-0faf11d52258", "comment": "Malware payload (Mirai)", "value": "7e8c3de4a099eb3352079c496243cf37c89aa21b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263666, "uuid": "b02cd790-73a1-4c8b-9d93-6a8fb8cc52c6", "comment": "Malware payload (Mirai)", "value": "f27345f9954a869ef7cdcf6d495bb54871fa2af1b44873408ceb213f69f788d79118768cbe53ceb60a10862de9cf0cd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263666, "uuid": "396dfecc-84a2-455e-b202-7ff045d09a26", "value": "T116D33ADFDA1C0367C49B59B0EC6727F78798A9B01291D1C4A2CBEEC117726B42122FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263666, "uuid": "bfd82d14-efe9-4d65-84c7-5a9561d991c6", "value": "3072:m4ZoKTgdrpMqa42Nl36FFb5rZMY+11W0+DdkJoYWU7hL95:pZoKTgdd242Nl36FFbZZM/IDdkJoYWUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263666, "uuid": "d0fbd255-1770-4f13-8fd9-99d5a8825915", "value": 139029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263666, "uuid": "1ea0d654-9c3e-4999-a597-53cf4ee37a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263666, "uuid": "27c174cb-8e00-4da7-903d-b76ae06b13e8", "value": "ext4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0ffb52-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275345, "uuid": "72cda1f1-9c0b-4bf2-9cc5-6cb042da5c68", "comment": "Malware payload", "value": "f20139ea3940a9b6e08838668c6aba7e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275345, "uuid": "b5fa9ca0-ff99-4f26-ae91-d6a23fb93002", "comment": "Malware payload", "value": "d9ef9b4b3fe7e0e1533c7668a9e533c4619969885dce4564f643616901e2c1fb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275345, "uuid": "3c6ffd39-d27c-440f-9415-c8d1a5839d57", "comment": "Malware payload", "value": "d5118a33fd0c0b2839751547c9a2b91f3089cc9c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275345, "uuid": "6823e4d5-e989-40d7-89f6-f162b2ff90ff", "comment": "Malware payload", "value": "dd90fb4581990425287a1f7ad89bb35ba460f627f136678bb5d2467b37aa1459e727e902043af194e0a9f9c0f00da5f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275345, "uuid": "513d6d8b-f23e-48ad-ada3-9f18fb594936", "value": "T1DCA4236D922554376D67B9D0AD1D2B020A70D18932DDDBD5CE0F38A08EFAC9C1EC61AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275345, "uuid": "d9319082-1e1d-4c70-a4dc-f2c88d33d5e3", "value": "12288:CW+GusvMa+gzYfcEaN9B/Jm0LU0gM7aQ4:CWF/vMakfclN9BhmSHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275345, "uuid": "fb256149-ff6f-4a11-a47d-0a165ca9aafb", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275345, "uuid": "2f7a75e0-bfdc-42d5-9d24-41a1be3f5c82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275345, "uuid": "2750ecb9-876f-4374-b26c-c978c1fee2be", "value": "d9ef9b4b3fe7e0e1533c7668a9e533c4619969885dce4564f643616901e2c1fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52698e4f-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250576, "uuid": "11ed3922-1abf-4a9c-9493-876c57040d94", "comment": "Malware payload (Mirai)", "value": "5fcedf15502f229f9ebf4dd6a3cf89e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250576, "uuid": "196d3677-a636-4e28-8ecc-99a4d98cb2dd", "comment": "Malware payload (Mirai)", "value": "da16f44c35098b9570282548bebd196ca7ac9ae682c2f25498d88c320de164f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250576, "uuid": "1adc51e1-b03b-44d2-823b-1b41f66add6e", "comment": "Malware payload (Mirai)", "value": "699f3c9377dd89fc25d2a89ffdcd5c456fd963cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250576, "uuid": "8e65db43-4d41-4665-afdb-8e6acc51d48d", "comment": "Malware payload (Mirai)", "value": "764e6642612d652d779ec7f44e4dcc00d9ed13a9e36b15a35def54f8b8588ef9b00aba94b18d0722f57e07ea6e24c6b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250576, "uuid": "712ed4b7-9a58-422c-b6e3-ba7672b49ee3", "value": "T1EDA2E014BF18828BC832693455D9EAD61292FC62F2EDCD592A40C15FF0A33E92474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250576, "uuid": "66c240e3-3e21-4c3e-8ff6-41fa418100d2", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK4:M98o08kxofBE+ZkXaqGbp2F2TWul0c59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250576, "uuid": "95491ed5-c600-415b-bc20-37a0cbeaf77c", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250576, "uuid": "a5b81598-1d41-4f7c-a7a8-e80d199ec388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250576, "uuid": "69f78d5b-d296-45ae-b741-53a07e15b72b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fcc044-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275439, "uuid": "fb8ee159-52e6-4dc1-b153-34ae5199e28b", "comment": "Malware payload", "value": "da9f8af404a122b2fff59a5e25f6d57c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275439, "uuid": "9bd315dd-0829-409a-831a-e2bc58b6829e", "comment": "Malware payload", "value": "da19d8708e68b90c1524bf34c420ffd30cde537e536ccbde00492373b39be375", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275439, "uuid": "080da2fc-34b8-4b8a-b68e-64ca77f2dccd", "comment": "Malware payload", "value": "a027bee980fd53084b27f76139408faad43e048e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275439, "uuid": "f0a7babd-f3f9-4090-97f7-f282ceb1a92d", "comment": "Malware payload", "value": "c616a3b2bd4ea78f54d9cc0b3e72975668e4136349b9067edad6c5fba186854f56d69e8f315019ba0578fb71e06ffa71", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275439, "uuid": "0155f9ed-9e74-4f98-949f-1d4d7687d957", "value": "T1AEC423195942D2CE83D43F7E8EC0BBA03E7990EBEB0DFA0416DA35917C95251B3D492B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275439, "uuid": "3e47d663-ba60-45ff-b6ed-3db8a1caff29", "value": "12288:+devMEkFmHkO6wlOMWROC/FTeHo22Qm7NzofOrAHmM:yemu4MQOC/gHozN7NzomMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275439, "uuid": "075e9526-72cf-47f1-9593-8568eb6e2a47", "value": 585382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275439, "uuid": "bdcf2de4-52dc-497e-8c10-3145772f7a2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275439, "uuid": "6eaf718c-0f49-4e92-a456-b68cdeb49fe2", "value": "da19d8708e68b90c1524bf34c420ffd30cde537e536ccbde00492373b39be375.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbd0b1f-c1c6-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791319237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791319237, "uuid": "22656558-c899-4f90-a636-f5c397f1e3df", "comment": "Malware payload (Gafgyt)", "value": "6b8076a618c9f7a3e4cb54ba45408913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791319237, "uuid": "fce074f4-6f8c-4dd2-8dd9-f996ef2a4f75", "comment": "Malware payload (Gafgyt)", "value": "daeb4dddaefa21f1e952b3a3e606f91d7c95955db3458730d30a0a218d005246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791319237, "uuid": "e7f7954f-b08e-4d23-b40b-69651ead52db", "comment": "Malware payload (Gafgyt)", "value": "219b6d066cd83f2fec210bb52e5842e4362e13a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791319237, "uuid": "a21747d3-1110-4403-a90a-b0a70d95b453", "comment": "Malware payload (Gafgyt)", "value": "4f7402bee98ce2b2883461efbfab36cd639ab08bb911fe9e1e93e4674c8309691cb4cc9d73b31ede42cb9c7fb155c60c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791319237, "uuid": "7b71d945-985c-49b3-b0d2-7ee214518032", "value": "T1DDE3F4CCFD64476FC2C223BAF749428F37261A78979BF32159A7E9B02BC57481D28191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791319237, "uuid": "e88b46a8-7de6-4a6d-9ad1-d36e0d83080a", "value": "3072:kklR8BGM3+mgYwGMyaRgi8KGqiPc+k3WL7tX8h3GbF2lLothTpKkinzrVoyuz0DL:HzrV7S0YWBNcnExD6knQCquS5hA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791319237, "uuid": "cc333339-2ed3-4bc7-8d67-f835a8913ff3", "value": 147867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791319237, "uuid": "971a81fa-ee56-48c4-95c3-dd6ac38b7a13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791319237, "uuid": "758cba77-db80-4ec4-b168-e38e019bbba9", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a82a19-c11c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791246341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246341, "uuid": "156c9180-74e4-49ce-8203-8c81ed982e53", "comment": "Malware payload (Mirai)", "value": "0fa1c75ff9e5f777236840049faac998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246341, "uuid": "97f33d9a-5d1a-4a88-a0f7-9dfb262965ba", "comment": "Malware payload (Mirai)", "value": "db510804161fc79cbcfc4fc399d86eb865e93b2336ff8706b6765afbfb258d60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246341, "uuid": "f863f46c-d361-4b25-9f0c-327f3f53e11f", "comment": "Malware payload (Mirai)", "value": "b83e34510f1c7ad615c9aebdf2c4db555242e9c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246341, "uuid": "842edc27-a98a-449e-8ce1-f50838085245", "comment": "Malware payload (Mirai)", "value": "daebe38c341bb39e21cf83ac731533d4a20c7b24b6ba24a216175f35728e54e4e8b39fa669bfefe91a80a950cff2bca2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246341, "uuid": "3e75d3ef-c901-419e-87d3-de470ff2c4f6", "value": "T18FC41966B9419B41D5C12ABEFF5E834933131F78E2EE72019D146F34A7DB88A0F3A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246341, "uuid": "7416cb35-f04f-473c-a87b-43510a15d81f", "value": "12288:z5UYwgZH1rFGJ2RegfQYWknAhbM9AFagbIqKhMp3B6Kao8+BhJ3fWP:z5nZ6QJYvHbp/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246341, "uuid": "b4f87217-a6e4-40f2-9e3f-b0b6858cbe80", "value": 564764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246341, "uuid": "b267bb2d-6b7a-4d3b-b12f-0dd34b4a23be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246341, "uuid": "f4ccd2e5-a745-4ad8-8a3d-014ab2e24043", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f643b6c-c11b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245900, "uuid": "e2197a2a-d326-495a-be5d-fa469b01b679", "comment": "Malware payload (Mirai)", "value": "4ce0096d0f26dd8fb751f94d2bc845c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245900, "uuid": "cafc33ac-a933-489b-816d-dbd1fe82bc70", "comment": "Malware payload (Mirai)", "value": "db7496961aa39f63f66dc17ee66d45d3327ae718e55caf15384b70f63e762faf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245900, "uuid": "937991a8-e8fb-490e-a38d-5095135de5e0", "comment": "Malware payload (Mirai)", "value": "64cb00289e9d7544782b313855809b9e90bce703", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245900, "uuid": "cfbb65e5-8779-4f58-8318-8ada8c08d7ec", "comment": "Malware payload (Mirai)", "value": "1c6f1ef797e5743d73e7cdcf9cfd351da9740a336bec345228e1bbf6767f48cd10b3f03025d4da128cb474ebf5730270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245900, "uuid": "249b179c-7bdd-4892-97e7-4ba2800135c1", "value": "T1D0F45C5EFD1E3C41E3DBF278DB4E83E1A22FB190D32391A23982135CD5C69A9CAB0555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245900, "uuid": "8cb29254-8b66-4fc9-8245-38c6c2ea0b40", "value": "12288:rOTbvyo47krHwqjJ0BJKZ8e2KYr1/u3CPzKZt9Mw5Qo2wq:EoynCBJ+12prk3Rt9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245900, "uuid": "0e560464-12f2-4238-9b14-99c93b68e848", "value": 795064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245900, "uuid": "870cdd66-05ae-4d3d-af81-c89a5bdc3164", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245900, "uuid": "4660b853-aea1-4200-856a-d1cb9bfaaab4", "value": "mbupload-6h5uzubu.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f54b51-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "c1d27dd4-5b7f-4eb3-87a0-891bd013be6c", "comment": "Malware payload (Mirai)", "value": "c34cb4f60e26936f39cd106294004d84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "cfaf69d8-5982-4e95-9b75-fa167d8a6439", "comment": "Malware payload (Mirai)", "value": "db7c621508dc94d87dd16652572d353bb66065be6da254a428dbbf28d77e21df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "83de41cb-bfdd-445e-bd3e-9948879d3c2f", "comment": "Malware payload (Mirai)", "value": "5fd7879b6fdf1267ad414a59ee1b318ca61cdd58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "d2c81273-92a8-46df-abde-8facc05cbbf5", "comment": "Malware payload (Mirai)", "value": "4da7b634ecde63da5c815cc4841a39db4f45c8e8ef7a8821ffad04216aa23f6ec651ac27c5f8ef87f5d197ad28825dfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "445d192f-d451-4737-a3cb-f0d4561d431a", "value": "T19434B91A3E228FBEF268C77047F34A31976976D627E2D684E26CD5101F1438D681FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "899d0be3-e65e-484e-98d2-a13789ffae02", "value": "6144:p0n4F842iQbY1dplvtKMf1p1J8JG8WYkQsxNenndQ:VF84s+vf1p1J8JG8WYkQsxNenndQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263359, "uuid": "5e0f21b8-3ea0-47ab-8cb7-53393fef0507", "value": 246219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263359, "uuid": "1dadfb86-9c74-4489-9ffc-ebd16fc44dcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "572d05e7-3981-4a4c-942d-1a3cc88040bc", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d768090b-c19b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791301050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301050, "uuid": "1345bcea-c902-4588-9969-74817b79cb9e", "comment": "Malware payload", "value": "f217952c11f58832c8eb021ec0da0d61", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301050, "uuid": "bcde2d49-820b-4851-8cfa-3e3158adf7eb", "comment": "Malware payload", "value": "db8bd3b9d22f810aa8db3913f197ddde598e6d6e68a149115042919044c65117", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301050, "uuid": "6afca133-9169-4cc3-83f6-c1ca4734acd0", "comment": "Malware payload", "value": "cf9d3d00bcfb077970d597ed3b7acdb828a56807", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301050, "uuid": "586d64fd-3991-47da-8a57-61425ecdd1e4", "comment": "Malware payload", "value": "5b4a130587617b9e062909216f5e1c0d0d29b32b32e3feb16e5091812ca3098481a8dbe4e7b58ec3e45cb611e69dd3e4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301050, "uuid": "247dfcfd-5462-4c85-9682-c099b5a8fcfb", "value": "T183D51256D40C44DAE103E6BF416B4AA16ED413B0F00EA1DE9BA54E0713EB5FD6A1FA3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301050, "uuid": "70c3c151-efcf-43af-a2df-9de931966099", "value": "49152:sLbpuR95/QC8VFEeIjaBq9VaPPVQNroE+qjZhLHFkixmEG+mGo4xf9f:2gR92TVj4aHQroo/51mEGxP4xfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301050, "uuid": "4082659c-a966-40f1-afdb-5e3075bf396f", "value": 2913530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301050, "uuid": "0d5e3308-b04f-47f9-b43a-1d7e423f7924", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301050, "uuid": "dda99b5e-f2b4-401f-8c0a-c39a57cf6847", "value": "r3muclient-crackedd.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa9bdb-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250615, "uuid": "2b3e22fb-feb1-48c3-859f-324507d41e7f", "comment": "Malware payload (Mirai)", "value": "0409cda461623da942bb0902b1b5f18d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250615, "uuid": "b529e727-e0fb-4d7f-8326-50af2e19666d", "comment": "Malware payload (Mirai)", "value": "dc03bb18ec66d91417ba3780191671c31890cfc07b85c4a1b69ac2a16ef9a629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250615, "uuid": "3eb081a2-17fc-4e18-a95f-4625880b7f6f", "comment": "Malware payload (Mirai)", "value": "a2a1a7a2489a5ce48ae05abfbea66c90516a2c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250615, "uuid": "0ae748bb-548f-4132-a9e5-3330fd6cb56e", "comment": "Malware payload (Mirai)", "value": "df97294d350e954ef62fa5a1fbd826135cdc5f8d9e33e8c5a8e5262df9ea836fe33280a68e7577852432c8e3f23d9de0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250615, "uuid": "9b8b0546-77b6-4d04-a2cd-c27f3a0ed228", "value": "T12F2309C8F443D9F9DC5A09742036FB27DBB2F6BA2329DE43D7A49523AC51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250615, "uuid": "375639d8-636e-45c6-9f49-6faf46387367", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2iUe:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250615, "uuid": "c3465628-f7ea-41a4-8218-99779e08c55a", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250615, "uuid": "2547bee9-4de3-4089-abc6-f7e310142030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250615, "uuid": "63633f6a-ac9c-4808-be3b-9fc23f0d2ee5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cd20b6-c11d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791246640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246640, "uuid": "3a9b5e0b-986a-4027-a9ea-cd7699c6828a", "comment": "Malware payload", "value": "5d05bcb41f14246294dccd2cd4287815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246640, "uuid": "966715e6-8c67-4b52-aed3-875fd4e096c1", "comment": "Malware payload", "value": "dc06f94c29b05d6d68f4194ba81bca4c0cf9eac463738559a799c31492b58b04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246640, "uuid": "5d7275b9-34ae-4aa7-8c42-151446b4832d", "comment": "Malware payload", "value": "1175500d2797eac737899bf224385e3356565757", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246640, "uuid": "87886db2-cd9f-4bab-b104-488a2fccfd7c", "comment": "Malware payload", "value": "8a0fbe0c6e9c376289f3f068b26b3d234dd6025afe6dfcef24cdf1e0c605411473e4befb9048d16c962e93a28844db58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246640, "uuid": "d0f00d22-4cf8-419a-a2a7-9f3f2b2ffb14", "value": "T147564A02FA092F96C9A0493389B74EA127A26D986B315753D704F67F7DB33060F16F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246640, "uuid": "886a7f78-4a94-438e-8d9c-f584b1b0f6b2", "value": "49152:goyYCrEbKBadKIW/53q2SudJAt5v3CPAQCIxM5EP:1yYCrE2qvW/VcCj/oEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246640, "uuid": "b052bb75-3ea4-4052-bf44-661eb3731e97", "value": 6095010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246640, "uuid": "be4c906a-3b0d-41a1-adae-50415ccdf4d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246640, "uuid": "3c12fdb4-efe2-4d52-b77c-f847e4ead44f", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6198c933-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276371, "uuid": "12522fc0-f196-4407-816d-15886ea67336", "comment": "Malware payload", "value": "ecefb2198bdbfde5d1bb3ca5cf833d4a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276371, "uuid": "12ca0184-c132-48fa-a1b1-7fd9c7594933", "comment": "Malware payload", "value": "dc4cfcb31728514d762a981e4bccc82cdb3fe9eb4a299a2e69a274c1feaa8f0d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276371, "uuid": "343f05ef-8af3-4035-9d9c-57f2c5fd2217", "comment": "Malware payload", "value": "e7b16dcb8bfc29339fa2271d8d176d10636a238e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276371, "uuid": "49e6a66a-57bb-406b-9f4b-b9c28b66bda5", "comment": "Malware payload", "value": "cb3c624cc524e7819dbaeb2fc29bd35fe6eaa5aa5da8d4bccfbecaf99ea18a6ba6d0d106dd74a152e8025fce4fbcf1c5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276371, "uuid": "4b3bc547-0193-4de0-a47b-624c733a7a2a", "value": "T1FEC423B7179AB4897503E3E4814C6D9489AF20D957C3436ECA1E2693F5BE247FB200DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276371, "uuid": "d2a68875-5137-49c3-957b-059f276a28cf", "value": "12288:geElNtIBB2gX3U5FA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9N3ez8:geSIBBfHLm6Jj6ESfUxZ91kmY/9Hew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276371, "uuid": "fb66ec79-5894-4810-b0f5-5908e9c2da81", "value": 584435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276371, "uuid": "0bd464fb-e274-4825-8b06-dbb9686b87db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276371, "uuid": "5e11db87-0d87-4657-bbcf-8855a1e97363", "value": "dc4cfcb31728514d762a981e4bccc82cdb3fe9eb4a299a2e69a274c1feaa8f0d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d598464-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274995, "uuid": "2082b7e4-0b1d-470d-9a2f-65bc77d310d5", "comment": "Malware payload", "value": "a5288d91c1d0b4809ae2e604b55b6691", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274995, "uuid": "7804986a-d83c-4600-9c7c-4b09bff64eb0", "comment": "Malware payload", "value": "dc9ea450d6dc036994ac7cb5f08baadb0005c7f30a4dac1a9006b310c6369187", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274995, "uuid": "edf5d022-065c-4d57-ba7d-4dac4e8eb3d5", "comment": "Malware payload", "value": "3e027e5128f3a924bc8564404f5c3ec9aadcffbe", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274995, "uuid": "e6db8a44-68e5-4969-902e-3a2b0444bbc7", "comment": "Malware payload", "value": "ad3457b60e550de8f03dacb7b1b523d5dfc9ace5f68c5486ea83892fc3a78fd2e5942da563af6dc424252e5ae58be70b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274995, "uuid": "59c4fff7-af28-4f36-972d-a836f68d8f64", "value": "T124A423B899A00A35EDA776640A6C9F050BA8D08376B84EF64B1F3ED04DFEC941D44ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274995, "uuid": "0ef65372-0b31-4881-bd50-803df11e6c44", "value": "12288:omC6Z9RoERxqzYfcEaN9B/Jm0LU0gM7aQs:omC6Z9RdbpfclN9BhmSHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274995, "uuid": "6169139e-f6b5-40bc-b478-512b12a1f8b2", "value": 467927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274995, "uuid": "80342410-6dc7-426a-8781-8c4b0ff1fc84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274995, "uuid": "73d631e3-afc5-46d5-b5af-53a298fde107", "value": "dc9ea450d6dc036994ac7cb5f08baadb0005c7f30a4dac1a9006b310c6369187.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac89c03-c151-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791269165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269165, "uuid": "65c0191f-cc79-4564-aeb6-d8f15e8ee301", "comment": "Malware payload (PureLogsStealer)", "value": "3ed20b281bd4d4d5d7422ae75418fea7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269165, "uuid": "de902d3c-46b0-4f5c-9586-576aee6f5073", "comment": "Malware payload (PureLogsStealer)", "value": "dcbdcf64241099bc63d353d1493596bbc4bedbe84ee80e58440ef0bf2db66191", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269165, "uuid": "d9cf3f73-de6f-4fbc-bd2c-6d28ab9d10f5", "comment": "Malware payload (PureLogsStealer)", "value": "e72e52ddcd796d7a94012b489905154f968c84ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269165, "uuid": "3e177990-22b9-44d9-b797-33f49f7c0d45", "comment": "Malware payload (PureLogsStealer)", "value": "984c95b5847ae07c62964afe2ad3f27da94af2c3944fc9e483c9d0c42d1521246590307365f177346a3497cf50d9e779", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269165, "uuid": "3ef8b297-ebb2-46f7-8122-323626d8747d", "value": "T1DD6512C888F77D7584B9C3A81A5B1601B7E0B9D0E2D8E19CE578E7D1336B591F1E2C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269165, "uuid": "e85ba39a-12c5-416a-a30f-52f89cb48fe0", "value": "24576:jCyu0oaPBf1ls4yz8WqedBUO7suoXSVxjOOcWj4QVRu3unzUbQKhVZF/Fnysstq:jyerfyAsdMCgWj4NezaQK9FJsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269165, "uuid": "ae59f2ea-2fab-44fc-95de-6b437d0074ec", "value": 1509301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269165, "uuid": "1912abf8-6357-4bc1-a0ac-1dabfd0dc1c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269165, "uuid": "7c8baff9-e7fa-40f4-b838-db33680a77f3", "value": "PaymentXUpdateXXProformaXInvoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b0daff-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274571, "uuid": "368e67c9-e93e-4d9a-9f3d-a7035c203d33", "comment": "Malware payload", "value": "ce5c316417bb6e817f4e3acf3843f00b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274571, "uuid": "7f903fc0-85be-4d38-9bc2-4230e9162ad7", "comment": "Malware payload", "value": "dceb4ae5996914feec4ad2c835cd152271a698207feaff4fbf3601ba55863d18", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274571, "uuid": "86e075c4-805c-422a-a476-cf510d766428", "comment": "Malware payload", "value": "9b95db3db9ba91d222c50a4b5d1a56d62cb777b0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274571, "uuid": "6fd4f479-52eb-4baf-bc53-a97a181dd8dc", "comment": "Malware payload", "value": "3e435805e119a765001d9471710657e3d9535d4a860309c11e6263c62ac45f777ba78b9cf62997d1439735e988d6f026", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274571, "uuid": "4480e65d-a74c-4185-9ac4-ea1bdebfcbeb", "value": "T1FBA4239CA4D00A329E9373545D1C2F124764D61B33F9DBABD61F3AC0CEBAC501AB42AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274571, "uuid": "90e6a534-ea15-4c20-866a-f26caa0d8cd1", "value": "12288:tBM1eMQPioXzYfcEaN9B/Jm0LU0gM7aQ3:ty1eMQaoUfclN9BhmSHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274571, "uuid": "950b2880-7010-48fd-8b22-192d5e168855", "value": 467268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274571, "uuid": "fcd6023f-46d0-48c7-a754-cb81404d223d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274571, "uuid": "8e273ac3-fc63-43ce-934b-bb9cc662c65f", "value": "dceb4ae5996914feec4ad2c835cd152271a698207feaff4fbf3601ba55863d18.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dd63b6-c146-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791264327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264327, "uuid": "6d97b9a8-1f5c-4220-aa42-56009bd24a1c", "comment": "Malware payload", "value": "519edaeffc346a951e31a37e26a1130a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264327, "uuid": "6178916b-abd4-476b-851d-f8265ddb6b7f", "comment": "Malware payload", "value": "dcf0bd5b2f0f94822db58b5878b9b951e59917136a51158c1c83c633a6dc6dc3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264327, "uuid": "79364930-9db4-4cbe-89fd-726459b16e67", "comment": "Malware payload", "value": "bdb05259900805b1bc6aff2c84bcf296fd5b7fe7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264327, "uuid": "400ab2f0-893d-4764-a669-a91ce1935a0e", "comment": "Malware payload", "value": "28b46774febcfe47560126c304ac121b06b87afa0880c0f53f6e148773ab24a8d751fc0e4c9c5055a42bb0012ad23102", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264327, "uuid": "4f2a85f5-e9a9-44ce-b09a-e0d99571dd45", "value": "T190753307A56CE813FCA34274865D73EA96C9F0560C898A7B4E7993208D5FFD80E3C976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264327, "uuid": "ce49df66-6c8f-4200-b6e8-817b6ab47a60", "value": "49152:y+eYs6OSlmctZoBBPR0S0WqJZdeC953HWt+:rs6IctZoBBPR0SDqleQxq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264327, "uuid": "3773091e-be07-4585-9595-cbe89e3708a7", "value": 1584679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264327, "uuid": "dae1371e-35ad-4c3a-9c3e-f0872cb4a21a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264327, "uuid": "4ba8a8db-f096-4d2e-8146-2a41ba762cdb", "value": "dcf0bd5b2f0f9482.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecc99e8-c156-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271105, "uuid": "f7390c65-a564-4d0a-b840-d208cbd5c379", "comment": "Malware payload", "value": "29fcea395afe49c1d550305ae3ca7ee1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271105, "uuid": "d38d52da-563b-4df2-93f4-8c83c367d152", "comment": "Malware payload", "value": "dd0931199db7c22fd7d8f9c4ffe05560152864b7e5a3b62890110a90eb7ca5ae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271105, "uuid": "45f64f33-d545-40bb-bed7-1ba3cc4aed19", "comment": "Malware payload", "value": "bcaafe38f62145ab570f6afe91342135c6f5de4d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271105, "uuid": "d4579201-699a-4f55-b129-f06cfb20489e", "comment": "Malware payload", "value": "7f2705c9befc7a6fef0578e5beecd6868538a7d22a8c19fcf144b28d61e5cc91c12aba22aae45062c416a3cca4111e94", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271105, "uuid": "3c5f572d-9004-4679-b2f7-487497eb08ae", "value": "T1C05533CA813C25844F3D0FD67AFF956C61248FF810411C676F1A98AB253E35F8275A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271105, "uuid": "89b06298-d795-449a-8779-5f0d7d6ae514", "value": "24576:joZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRPBc64g:joZ9bq+MmMEL+hcjXHC/wnwdPK61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271105, "uuid": "8c96a312-2f0e-4b8b-950b-a619b8e3c3b8", "value": 1380032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271105, "uuid": "061632ea-8755-43c1-a718-62eb1b3d1a81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271105, "uuid": "962b9d1e-44cd-4e62-b635-a939738a4edb", "value": "dd0931199db7c22fd7d8f9c4ffe05560152864b7e5a3b62890110a90eb7ca5ae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae70a148-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271775, "uuid": "32fcca55-fafc-41e3-83fa-e7b223752d5e", "comment": "Malware payload", "value": "9dcdb28feed10064b2bca89138824b19", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271775, "uuid": "5c2b31ad-e3f9-48a6-8145-0de068ac86a9", "comment": "Malware payload", "value": "dd582347a748cb2a60f3bdb0eff40cf53ebc2d44ceb24a028ebcdca51e80e365", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271775, "uuid": "93baef7f-97ef-4bb6-a569-2f133e2286a6", "comment": "Malware payload", "value": "5781b007d39b5f998fdb5746fcab30c807b06f65", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271775, "uuid": "fee75eff-277e-4bca-a8d2-e17782f9bcb1", "comment": "Malware payload", "value": "537e8c638b7d0f4da12e71af165f7f06bcb6d7cc767b2c6afc9ebf699887ecb221fda0a3518d1334f557915be9bc7f51", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271775, "uuid": "2e9b857b-f407-4eb8-a566-044e2ad0bef8", "value": "T1FAB423CE5A286CAC5BE85E838F5DBFDA2CF8413F862411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271775, "uuid": "2a834a10-ab1f-498c-b6ce-d949239f2f24", "value": "12288:BGRl4nbDDGIabs/7iiEVwYg2l3/2NHNy+wK8/:tTabs/7iiWw0KQx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271775, "uuid": "83355d46-517e-4775-becf-86f6eae8f1cb", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271775, "uuid": "c3d607f1-b2bc-49be-8329-85748e73039c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271775, "uuid": "3995443a-ad56-4173-ae66-0b8c43a64b3b", "value": "dd582347a748cb2a60f3bdb0eff40cf53ebc2d44ceb24a028ebcdca51e80e365.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fa3a33-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272478, "uuid": "7928827f-7a1b-453d-ab1c-a0f28276b662", "comment": "Malware payload", "value": "ec7401a8c87766509d08bc42104f1374", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272478, "uuid": "89d71d5e-a9e3-4494-96ec-781cbecc2734", "comment": "Malware payload", "value": "ddbd6c3bc6c6ac0266ec73052bc0c6ff66a60976f56257f7af3379a99900b0d1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272478, "uuid": "ef439a33-f20a-451d-80d7-86fc4449c492", "comment": "Malware payload", "value": "668543832df4034c3f1c746650f64bafe0911953", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272478, "uuid": "87aaa291-0650-4142-b099-85ec1eca2e1a", "comment": "Malware payload", "value": "20431452133dc0b836dcf7e3bab833dda79121cff48808f28bd425ae40cb9e995bd3bb8b33c809967cfb5bf56ae9c22e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272478, "uuid": "26cef4d8-d8ac-468a-bade-9d52babb5241", "value": "T1F9553397813C24845F3E0B66A7FF856CB2248EFC10030C579F2A49A7293E69FC675997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272478, "uuid": "f124c720-a379-4f61-98ee-fbc4e24fc7fa", "value": "24576:HoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRjbA+KCmzW8:HoZ9bq+MmMEL+hcjXHC/wnwdjbA9CmzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272478, "uuid": "d225546b-1bbd-47b4-98c7-01bda5a0872f", "value": 1395268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272478, "uuid": "91e9dbed-0565-42cb-acdb-b70db3e90e67", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272478, "uuid": "28c9f3c7-5eab-42b0-ac7c-bb0ba5bad437", "value": "ddbd6c3bc6c6ac0266ec73052bc0c6ff66a60976f56257f7af3379a99900b0d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb0419b-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271722, "uuid": "578cfbba-e8fe-48e0-8260-8b1dbd9f065d", "comment": "Malware payload", "value": "42b7dba23f9ebc204c4dde1784d077d8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271722, "uuid": "b12cf5bb-a8c5-4153-b3f1-fcca7829fdba", "comment": "Malware payload", "value": "dde66f018417787e97fa8393b6cfe2dd319aee0e19105c684e89fc3887966d8e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271722, "uuid": "7dfe5512-e33b-466e-9712-b6214041c7a2", "comment": "Malware payload", "value": "c3af2aaf00bcded2f405f9d9ffe9ea39b2889ecc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271722, "uuid": "cbdbf671-793a-40f2-9e3d-a793ded7518e", "comment": "Malware payload", "value": "25555332fa9fbeb53539f6836739fca4419cf3a84fadab675745f95b196b9e6c0b4c850d168ec9e257977a9c5d2a454c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271722, "uuid": "b0b9305c-b121-463b-baea-d3bec1004d67", "value": "T12FA4232CADE106503D67BF443D8C5F024A34A05BB6F9EAA6251F3F888CEFC6C156964D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271722, "uuid": "2f85cd79-4ff6-417f-8fad-87e3fe1019a3", "value": "12288:rzYfcEaN9B/Jm0LU0gM7aQEYyvZJHJmWP:QfclN9BhmSHu5vZJHgWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271722, "uuid": "fb875b18-9736-46b1-a2b8-dd8fa9f11cff", "value": 462603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271722, "uuid": "563956b5-c5f9-4d34-802b-62a02e9c499e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271722, "uuid": "c602a701-a31a-4569-b5c0-e8759fa04478", "value": "dde66f018417787e97fa8393b6cfe2dd319aee0e19105c684e89fc3887966d8e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d0872c-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274492, "uuid": "08fc6072-4326-4b20-9b02-e1ff37a46290", "comment": "Malware payload", "value": "78ed73fef8b95dc8788c7ff330898324", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274492, "uuid": "a9bceee4-ae98-496b-90ce-5cc71e569538", "comment": "Malware payload", "value": "de175524bce35cfb91a4f5aa5381802e85bffd1e4f9789fa38c64c50bd4151e3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274492, "uuid": "246e804b-f6d4-4ced-ac54-9f492c57c1de", "comment": "Malware payload", "value": "ab87fc66a26c94b763e1d56cad856ca9fda7047c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274492, "uuid": "67e872d4-6cc1-4fbf-8966-8344ce6f3ad0", "comment": "Malware payload", "value": "bcec8145ab300d64a500860bec982a3022e92c5108cd7b7c26a5d643a85a3973f25f18a3617e91c531524a01904ba4a9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274492, "uuid": "05428ae6-9978-4a36-bc05-4639336a374d", "value": "T171A423A8A5C06FB6DE773A104D241F164628A50F29EBADAF9E033640CD6DCD056971CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274492, "uuid": "64377853-8191-4d51-9d4a-6bb4892c372a", "value": "12288:9zYfcEaN9B/Jm0LU0gM7aQv4HphuCmCJ91YqEZy:yfclN9BhmSH9SuCmIzqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274492, "uuid": "afdfbdd0-60fc-4c7e-83f0-c0d7b337202f", "value": 467850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274492, "uuid": "d52b6280-65aa-4220-8bf1-c434e9c581bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274492, "uuid": "4eb34dc3-6900-4143-900d-fa589ca51aa0", "value": "de175524bce35cfb91a4f5aa5381802e85bffd1e4f9789fa38c64c50bd4151e3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ffaf4b-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274873, "uuid": "17cd8125-6a0a-46fc-9659-c7b4afc10413", "comment": "Malware payload", "value": "fbd6062548a7ca4af03e9679f03acdf6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274873, "uuid": "a999565f-894b-4e36-b133-3e36e6a53227", "comment": "Malware payload", "value": "deee105fe839f7400634708111e91ab23ef1dc982b6a6f219ce585dc612ecd5d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274873, "uuid": "49f54712-f5dc-4660-ba16-81d9da2a2289", "comment": "Malware payload", "value": "812db587de868d83fbb94e11d6dfa06417f67501", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274873, "uuid": "d9ba5fda-fd3f-4cab-99f2-f8f5d3daa9da", "comment": "Malware payload", "value": "ee1bba74b9de9fd99a0258432ab64479c519f2fd0c6781eca422ea4c97e8f9f6ea402b065b204f8970c2eb77335c6c95", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274873, "uuid": "139675f4-8fca-490b-affc-b8183b3bb7da", "value": "T12DC423195942D2CE83D43F7E8EC0BBA03E7990EBEB0DFA0416DA35917C95251B3D492B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274873, "uuid": "fccca436-98f1-4996-b2db-2b509353728d", "value": "12288:mdevMEkFmHky6wlOMWROC/FTeHo22Qm7NzofOrAHms:Kemy4MQOC/gHozN7NzomMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274873, "uuid": "f676bb06-1eb4-4472-8354-5977f022e1bc", "value": 585382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274873, "uuid": "58c40289-ee30-42af-b1e9-fba3cc4fe368", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274873, "uuid": "0cd29498-8478-460e-95ee-7d29dc14a41c", "value": "deee105fe839f7400634708111e91ab23ef1dc982b6a6f219ce585dc612ecd5d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035fb7eb-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273636, "uuid": "1086c6ac-4c8d-4750-a504-c7680fd3abc5", "comment": "Malware payload", "value": "97f9d1772778e34794a3663772ede302", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273636, "uuid": "4de1206a-1f51-43e0-8598-d44dd379257e", "comment": "Malware payload", "value": "df3ba294429297d1c7734af6d40f9a79c8c61059469f0075c7c36c76dc3221a6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273636, "uuid": "e3d9cbf5-0a5d-499d-ae64-0d510fdcf8e4", "comment": "Malware payload", "value": "f5ca0a71befeca3992c2a4a3b88941d3c18a64da", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273636, "uuid": "e77b6098-709d-4cdd-87a7-1bc97eee5ded", "comment": "Malware payload", "value": "19149fa59e98edf8a69b7d34b5db53a1229a87fd170329df2249780b40f3a04521e45bd531372730f99503fa10e5a9f4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273636, "uuid": "fd929301-0b97-4b06-9f6e-c5eccfaaba46", "value": "T194C4331604CD4AE1C0D382FA176746F5049A4E38EF929A7EC43C34C9E340D79FB296AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273636, "uuid": "caf0ef14-aa4f-4b55-947e-4b641b6ccc56", "value": "12288:x56zQTBL8mLp2mA4C+9NgOZTUqnMmzDF+nuwsQab/YpUiyCs6ZHfipRwSb1eBm:SMTBL8Sp48NQqMm3FSuvdiyCJiMSb1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273636, "uuid": "6d22c473-dc8b-460c-8f2a-bf082b93016c", "value": 579945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273636, "uuid": "5c937dd6-a69a-480b-b490-cfa379c67b5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273636, "uuid": "cb18d699-ea43-4128-b681-9eb034276419", "value": "df3ba294429297d1c7734af6d40f9a79c8c61059469f0075c7c36c76dc3221a6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007ec964-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273631, "uuid": "cf0ae16b-34c6-43b8-8d1d-51911306c42d", "comment": "Malware payload", "value": "79159a3579e608567cd3019aded3c8c4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273631, "uuid": "ff22af95-5297-43c1-9a8a-2b81b0159a98", "comment": "Malware payload", "value": "e0126384106d8f3f786fd6c7c0735d0b17eb4420dd011596e19fa554d495a65b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273631, "uuid": "f6fcd962-9a1b-47d6-a4fc-51ef2f4845a4", "comment": "Malware payload", "value": "be077429c05e4221b0491711c8250bfc7148be7d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273631, "uuid": "292d0ca8-f98b-4962-803a-b7d6dc4d35dc", "comment": "Malware payload", "value": "7773cb28b43bd066b7e02fdf67f53536da865df625e98f7caed9c856380fdeb34861d2445c790a1078953a829aead572", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273631, "uuid": "6eae35d7-a0a3-4966-a15d-378942a6bc7b", "value": "T1ABB423F5AB606BCC9D20122F2F4A27CE19274B41B403C54A1AD2875A421F6FF4E7AD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273631, "uuid": "af344259-8075-4d73-bb3e-e3e0c4779c7c", "value": "12288:oBRdpQ73iBVYWBCwvEXgbvM0a4OTHiQIIFzuK9Gd9IUy:oHUw2WM9XgbM0azTHiQIouDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273631, "uuid": "e3ff029b-d446-4b19-b993-99957fe80b74", "value": 542317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273631, "uuid": "ce610e18-69ee-44c2-b27c-1fc95512b6d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273631, "uuid": "b6c4cba4-a5de-4c41-9b09-f1dc30546ecf", "value": "e0126384106d8f3f786fd6c7c0735d0b17eb4420dd011596e19fa554d495a65b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162a755e-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "db953fd3-7165-419e-905f-35b9df2b62a9", "comment": "Malware payload (Mirai)", "value": "1b7b383a457eb3c0f8811ed4d52a0bf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "69ca18eb-e11c-4540-aafa-32c304856a62", "comment": "Malware payload (Mirai)", "value": "e09fe1bcfefb15f916979a7bb04a1a570ed999e2e751f7d80266502727e2b6b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "d0dea71f-bd4b-4ed0-b4fd-304d46418d20", "comment": "Malware payload (Mirai)", "value": "0db3ade910d8a8d7ddd157e7f06f64bebc395e56", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263359, "uuid": "0a8ac881-bbb5-4370-934f-f1799130e2f2", "comment": "Malware payload (Mirai)", "value": "793d650c19f008d1b56503cbd858edde8397a7cf87f103efcfdc36df48d57f99f47399a31896fa1a648b0e3da3a28297", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "55ce0010-c06d-4e13-bb38-04a9cb086a91", "value": "T15AA34C86FB93E0F0D94605B1111FF77D9634EE625024DE5AEBD4BEB2AD32602921B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "cb0817f2-752d-40b3-960a-f88d97849b56", "value": "1536:rw1BTbdc0hDtZx6O/0c3Ra/oLDQ9VPJU3310vntiZvnwl7/4qKU7ysY7r:qq09tZxac3A/oLDYiClSCBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263359, "uuid": "0add11b0-e1cb-4f06-a384-84206667ad20", "value": 100420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263359, "uuid": "ed2ac884-4ec0-4271-85e3-45d7aece77ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263359, "uuid": "7ea0abed-a35c-4432-b7f0-3ef7fc4f1b0f", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2269307-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288586, "uuid": "640bef02-9edc-4cb8-8509-449d4f5cf679", "comment": "Malware payload (Mirai)", "value": "05ed133a35ac47581362796df88473a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288586, "uuid": "e931463c-7fb4-4c05-89fc-fd25e785b0e0", "comment": "Malware payload (Mirai)", "value": "e0d6ae80e7d5ef18a33c5ee0bd3ac80c5d79698e8154bb952f754f5e5c907e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288586, "uuid": "2f65da50-40f1-4e78-9e49-b09cb40b7a9b", "comment": "Malware payload (Mirai)", "value": "3d59bb2cc99ebd2296406f3e04b6d70565753d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288586, "uuid": "d031f8fe-0743-40d7-81a0-798949a08917", "comment": "Malware payload (Mirai)", "value": "3409eed34a03401f5586606c0f1bab6aeddaeac89c7c85a42f5f5205a541852fe10427e6f69586d670b5dcbef5e28d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288586, "uuid": "9ce7100d-4122-4445-a79d-4f8b940f2936", "value": "T1F8A3F606BB650FF7DC6FCD3706A9170125CC661A22A83B767A74C828F50B65B1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288586, "uuid": "28d72587-849c-4bc8-9511-3f0e82ae2188", "value": "1536:xFrKErirwfrrWIRvv3G0ZarwRLyAIZrzZjLVoqRBktWes/h5VL:xFeErirwfjXRL/In9SWHVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288586, "uuid": "5dc28fea-1005-4844-8199-4a35cdfc9834", "value": 101840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288586, "uuid": "9c1d6d7a-9fa1-417c-a0f6-45814986c020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288586, "uuid": "341f82a9-7674-4f4c-9c38-00215d371a0c", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c121c5e-c146-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791264336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264336, "uuid": "d0046f58-f3c1-48aa-a0ff-e9f8c08900a6", "comment": "Malware payload", "value": "b5d0d3a13da4c88f2687f4a4e81f7fd4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264336, "uuid": "4ad12d6f-5fa5-480f-8462-e738b4cdad7a", "comment": "Malware payload", "value": "e1aa09169b09da391dd69c0c9fc221a84049b82852bac82870203551bc50ddc2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264336, "uuid": "aed7b291-bc8d-48d2-ab9e-1d2f1adc4c8f", "comment": "Malware payload", "value": "3fd71b0eda84e3cdc5b1f81765749f13c3e5f432", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264336, "uuid": "df4dfb9f-5d4a-4ec5-9ee7-fde477c4c040", "comment": "Malware payload", "value": "7cbdf2d178eceb8a784aa6901a9a9295f6acec8a46e4d2cc929d6e1ad1c722bddb8a028cd67886e22a70882451e0b416", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264336, "uuid": "0fee09a5-0c39-40ce-8d5b-33b9127d3f93", "value": "T132753303592C6813FCB342B4879DB3EACAC9702A4D45DA6B9D7553218D5FEC80E3CAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264336, "uuid": "ec6c1da3-5f1a-45c2-b048-5043aa5f4879", "value": "49152:Lx1l+mUwq7eeHbgZJp/0ccmgxrdKS7P30/:LxqmUweHbgZJp/0cbg/KaM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264336, "uuid": "7662ae53-5e54-4b55-ae83-e6d397a90936", "value": 1584684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264336, "uuid": "d49a8aa6-cf79-4e15-b20b-ff3b03e4f677", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264336, "uuid": "a4818785-b9dd-4e5a-9c8c-cbaa3e8ff1a2", "value": "e1aa09169b09da39.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8616731f-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303061, "uuid": "a3d90128-68bf-428f-abad-d22029702d51", "comment": "Malware payload (Mirai)", "value": "1bd4bf868259f1f428b063817470aa3b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303061, "uuid": "43ab9881-1e1e-4045-89e9-23c1aa337fc8", "comment": "Malware payload (Mirai)", "value": "e1ea7501f5cefd4f89009d6ffcfc331c06b45fc5228e1e348c065af0372781fe", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303061, "uuid": "621866bf-c37d-44eb-a7f6-282fb7700337", "comment": "Malware payload (Mirai)", "value": "bf511b42e58741a4e7ce854d1b3dc2e4dcf1fdd0", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303061, "uuid": "ce4843b8-1cc7-40dd-a87c-70bccba8dd28", "comment": "Malware payload (Mirai)", "value": "5a0b8c6c6337a646bd52f19c36fc183c57b2bce171d6ea299702dee80cfce6b240681d7e6f60b799c2411a67f153b4fa", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303061, "uuid": "5885db57-6027-4884-8d50-5cb203619ecd", "value": "T1209312AD35AD2578F13B3CB4F16A2CB25A0EA4AE3F16A6173155E4251D9C21C4A33FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303061, "uuid": "2adb554b-f7fc-44e2-a40d-a580822a9990", "value": "1536:i9+KM7mTa2DQeip3w9WuipY+numQEtqCtf+pi9lkUnPqG6up0OPY+9fjErk2RwL:a+ga2DfZolnbTFd+MpSG70OPY3rHwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303061, "uuid": "26404f80-4c61-4901-bf5d-cd59ffb9bbb8", "value": 96024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303061, "uuid": "777012cd-5e4a-4695-9c87-962ae54e5361", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303061, "uuid": "b88433cb-fcb9-48a0-baaa-0cf4058b0aa6", "value": "flutter.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d69514-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791273311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273311, "uuid": "eed799fe-ec96-4972-aa71-79cacb842602", "comment": "Malware payload (RemcosRAT)", "value": "a34f40f10c55df256f127bd20839839a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273311, "uuid": "11455d4f-01a9-4477-a369-9644145a031e", "comment": "Malware payload (RemcosRAT)", "value": "e2aa498ea12515bda490178f708405ffd4a50100c90291f544477b02ff299aaa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273311, "uuid": "af069b84-d052-4f89-8f1d-3481f68cf824", "comment": "Malware payload (RemcosRAT)", "value": "df0957030ff63cad26e451eceaab65c6ce04a7d5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273311, "uuid": "4223b2f6-10d0-49c8-9f5c-c0beeb25639c", "comment": "Malware payload (RemcosRAT)", "value": "47063ea4d41b18447d92d776a74c6a522060314e7fe1ed07e0f6928ac061c5c81b3f738704138b38998e6b26ac631111", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273311, "uuid": "e9ee9fb7-3965-4fa8-90fe-ffe5fa905d3b", "value": "T100464E5B1F0C3E4EC4C65F6AA115D59FC088B6EA2910781E76CFECAACC74EA0FE19154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273311, "uuid": "21e8a069-1db8-45d0-9164-049cfae34443", "value": "1536:Cbm5Un6b6XUWnLIY86DYFp68hlmjO+PtgpEbEcmvsHP2GJ0iXR4Cgze/KNTMWWma:FIvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273311, "uuid": "100bf844-c963-4e58-9a87-f04ee1e5053e", "value": 5488592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273311, "uuid": "651af9de-453b-4aae-b54c-6275a7391a5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273311, "uuid": "b6d394cd-b087-48f2-a6df-cc75616653ec", "value": "Multiple Card Charges.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34639364-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274148, "uuid": "2ce729e8-9a91-473e-8797-99509c90c666", "comment": "Malware payload", "value": "a1933a30f245e62aa0116ffa75e69b2f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274148, "uuid": "dafa8943-3a8d-4bdd-bf23-f08c04af55e5", "comment": "Malware payload", "value": "e3094f070f4b248efbd1c21f8026eefe11217b20f776b6bf72fb71601ca8d87a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274148, "uuid": "f692b51f-bdca-4537-82b9-1f5649e4ca40", "comment": "Malware payload", "value": "389d3ddfa4718e84258d1fd6352dca71ceb0f63f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274148, "uuid": "5f059423-1369-404c-84d5-84eadd83e1f0", "comment": "Malware payload", "value": "3b05ddd1e1f1c2f335d85b0cc69d577f306dfb53b764e60f183baa3f8e92ccdacfa538de88b4e0b64037ac14b2b2e394", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274148, "uuid": "7a8a1b17-bfcb-409f-addd-8120b80a9cf3", "value": "T1A0B423CE5A286CAC5BE85E834F5DBFDA2CF8413F862411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274148, "uuid": "13110a07-0811-4c22-8e79-75c51752da8c", "value": "12288:VGRl4nbDDGIabs/7iiEVwYg2l3/2NHXy+wK8t:JTabs/7iiWw0Kixt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274148, "uuid": "3c31fbba-94c4-477d-b1b5-5a099a2a53ca", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274148, "uuid": "271e9dd2-6a05-470a-beee-5d9adb6fb252", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274148, "uuid": "2d6ee272-a350-4e30-ab08-acd703874f0a", "value": "e3094f070f4b248efbd1c21f8026eefe11217b20f776b6bf72fb71601ca8d87a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b94137-c1a5-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791305105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305105, "uuid": "5bc829c8-b8fd-406b-b465-d0ba28a00edb", "comment": "Malware payload", "value": "0bf47ff47c3425b95c34f13c38b5d73e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305105, "uuid": "05dfbb66-b180-434b-be4e-a82b7884adf4", "comment": "Malware payload", "value": "e39f45a39ddfb0d494a6b09dd08c279380c7140583610faca57b732b5e03edab", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305105, "uuid": "b296351e-2995-4d55-9239-8da4a3d9783a", "comment": "Malware payload", "value": "5d239dd111bbe28ab0d0f4438674bdf45a38535d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305105, "uuid": "9903ad49-b173-4684-a591-51a6933b5efb", "comment": "Malware payload", "value": "91e4b4f5cdc206b9acde4eb4fc78e70accded4772740f6e8772d9d694aad51c8789c9920440503fa6dc48e5790f6ba71", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305105, "uuid": "a9fab40e-728c-451f-97b2-e1a82de4ee6b", "value": "T18F670223D948F63DE936433AE0420592B95F17ECD80F90A564F029FAAD05D4D3FA1BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305105, "uuid": "777d34c8-2591-40bb-acbd-805dd4a0e018", "value": "786432:0vVcL2fo7eeRxslW2RR6WRIOJaHMZQOON:IVaUqsB8W6fswN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791305105, "uuid": "bb8250b9-05ae-4f51-8561-721cef9bd4f0", "value": 30756819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791305105, "uuid": "de195d5e-597d-4e97-b08f-f9fe82c31712", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305105, "uuid": "7be623d1-b0b4-451a-a19d-81ee39caf5c0", "value": "client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1653d0-c194-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791297949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297949, "uuid": "73778c8c-aee8-4bd3-8a73-4ab2a057994c", "comment": "Malware payload (Mirai)", "value": "584dca531b88c8a7c793b98a031bd8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297949, "uuid": "4442b30e-87f7-461a-8e43-549ee8b9ba55", "comment": "Malware payload (Mirai)", "value": "e4663ba17ae77497dd76505d77e5aa8ffa807021d82a0140f8c983f784904b88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297949, "uuid": "19991627-8d22-40de-be3c-97658f1eae91", "comment": "Malware payload (Mirai)", "value": "eb5635d28fe6e3b183b54199e49d12ce5e602905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297949, "uuid": "d47b274c-ef8d-426f-a45f-cf1a189038fc", "comment": "Malware payload (Mirai)", "value": "c161178625b0abf1dfb958ed9607de012b2616af8d5ce92dd6ddd0e182c9b6983aa7588c7c412a63293ff8a286781acf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297949, "uuid": "bb3e09e9-fbda-4a7a-b6bd-1b6d9321d640", "value": "T11BD43A03272D0F83E3A75DF0777717F483EA989621F5E588EA0B69C69271870624D6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297949, "uuid": "35cce77e-6692-4ed3-bc44-fee82cb274ba", "value": "6144:o3cKb1mJI2F8M8+B6xGpng1pAh2ASIlo/edXen3iRwwdOyFHOLXyx1IoSehKS8UK:JKbwJI2Fg+4qjTMX73yKcGTure", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791297949, "uuid": "82b52f28-7014-469e-8eed-8ce81b6eba12", "value": 642224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791297949, "uuid": "634e156e-492c-49ad-a3a6-e5f13d5830e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297949, "uuid": "ca9fd1b5-58e1-4164-bfae-73c14a8d1ad7", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e48a7e-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273690, "uuid": "826d172a-74c7-42e2-a610-00765b0e4316", "comment": "Malware payload", "value": "412fd60e1489b056477d4e385dee87cc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273690, "uuid": "8b732ce3-97f2-4f57-ade6-88c0ecd7986a", "comment": "Malware payload", "value": "e49d4b7d020ecc1e9e34c6d57ed03cac5919fb50a31cfbf07ccab92bcc56b682", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273690, "uuid": "579203f5-bae3-42b6-8347-a3d7681da9ed", "comment": "Malware payload", "value": "41cb17c8ae15a4530df1a2e01a12e10732727aa7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273690, "uuid": "3f4fb4ab-dda8-476c-b835-7dbe75fcbbb3", "comment": "Malware payload", "value": "8ca0410519243490a95576ad0576ac41ee13e7a8ffef96b34c9c9490526ca152b6e79d95c411ab928ba28c022424778e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273690, "uuid": "18bfd84c-8aaa-4884-aecd-bdfaba1988bb", "value": "T18755334A827C19C88F7D06A7ABEF905C71158EFC200218376B6684DB393E75F877495B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273690, "uuid": "34201a13-7e84-4a86-9de8-0b1aa8f9abd6", "value": "24576:tLS1UGQoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR4:tLLboZ9bq+MmMEL+hcjXHC/wnwd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273690, "uuid": "d94176b6-6d48-46d1-9a14-2f29ea99d479", "value": 1397338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273690, "uuid": "1f034bfc-8fa6-40c2-ae27-2d8da22b5a0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273690, "uuid": "aff64444-e487-4c91-ba2a-8cd215a29989", "value": "e49d4b7d020ecc1e9e34c6d57ed03cac5919fb50a31cfbf07ccab92bcc56b682.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ff9e4e-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275120, "uuid": "d78b6b02-da56-4936-b976-495cd63cae93", "comment": "Malware payload", "value": "7890fd7a49917a318cf7d69fe4706279", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275120, "uuid": "28a7e183-5f8f-443e-9c96-f2fd398acb2c", "comment": "Malware payload", "value": "e500c4e84b1cac96cf2438fd389a2c9f9cf13aa3c276cef74b83124066fb39b9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275120, "uuid": "e4653a83-f179-4691-bda7-4488bfd9cb63", "comment": "Malware payload", "value": "d0783983b26870246a7e6cd095d188a37e3090e0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275120, "uuid": "3404784a-94b4-4c71-b458-3acb487e256d", "comment": "Malware payload", "value": "0449ad18c96d5897675e5b4b1e42571b06ea2325dbbb9376fcd8ea5d47c35107135e6971c10630a41ac29e6138a9b654", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275120, "uuid": "a61f382d-4ade-4ad9-89f6-7ff287c11fbe", "value": "T1C8C423792755F0C46206F2FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275120, "uuid": "4ab430c5-489b-4c53-b7c7-f3c5c989ebbe", "value": "12288:QA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWVSFyorOIic/7MPo:7m6Jj6ESfUxZ91kmY/99z8kFXicTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275120, "uuid": "c6675134-f661-48ec-a6c9-08f0b6ad8653", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275120, "uuid": "c89bda16-057b-49a9-bd5e-3baed15cb82f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275120, "uuid": "8222f4be-76c1-41e1-8393-db3c7bd6352f", "value": "e500c4e84b1cac96cf2438fd389a2c9f9cf13aa3c276cef74b83124066fb39b9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6531741e-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276377, "uuid": "6f46bacd-048b-476b-afdb-27de5980c4be", "comment": "Malware payload", "value": "44cbb40d6959480204fe46da2b9ea138", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276377, "uuid": "98a7f13c-5e68-4fd4-954d-36323daee835", "comment": "Malware payload", "value": "e50b244d8f9151ab160b20ddcf8de5ec90fb782a80dae54773fb618f67946b8f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276377, "uuid": "977ace67-a2bf-4036-ba1e-1e7961e6fbf2", "comment": "Malware payload", "value": "0e96ce9cef53c89e41440000a9b0a95553705e98", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276377, "uuid": "281ab9a6-82e5-4167-83da-8096793d0685", "comment": "Malware payload", "value": "6ea54ee0a5750fa9c04b874e1a353e4bf87f1478bcdcf3712e2cd6e51580dd8f2bc98607552253b214896584566dcafd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276377, "uuid": "adf278bb-d8f6-4440-8923-53231243c562", "value": "T101553387C17C18C84F3E06D7AFAF995C72288EFC100204766A6658AB253E75F87395DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276377, "uuid": "97659a1e-3895-4bd8-ba78-a297bcdece13", "value": "24576:LMZuoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRT:LMZuoZ9bq+MmMEL+hcjXHC/wnwdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276377, "uuid": "efa7753c-cbb8-490c-9cc6-0604a72a028c", "value": 1394468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276377, "uuid": "7930857d-7c64-43cc-a544-8b3f576a5486", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276377, "uuid": "0ae77bde-0ab0-4c71-9e24-c8aabddb6789", "value": "e50b244d8f9151ab160b20ddcf8de5ec90fb782a80dae54773fb618f67946b8f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e2b76e-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303061, "uuid": "08fb83dc-9fa6-4464-89df-93d4a7239540", "comment": "Malware payload (Mirai)", "value": "f12cad44b1c1698cab6501770ae5cf94", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303061, "uuid": "0a668faf-df4c-4efc-bace-060e8b106df4", "comment": "Malware payload (Mirai)", "value": "e56731aea12923b5b23c806909c9aad41c7e2e3cd8dbd2a557e7042d00c18d41", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303061, "uuid": "d0fe659c-38f6-4543-99fc-b63d8ade1b98", "comment": "Malware payload (Mirai)", "value": "89ea14170d192c221bf1db0ffc394653c90734df", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303061, "uuid": "f8d2d531-4807-4816-96e9-5cc28f775bd4", "comment": "Malware payload (Mirai)", "value": "f98c39678c739dd10c73f8109b7ec8dc7bfdd28ec780af652af5508e1c573630d25f2f4a644502f2c7516339d3fbcc5d", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303061, "uuid": "2a44c1da-8c39-4f31-bf37-558e321dd155", "value": "T102930212F682C6A4C38C0A719C1B6A15C2521C27707DAB2ABFF92F146FA75FC1B05766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303061, "uuid": "8c3830d0-3839-4bd3-8b97-4979b1378c32", "value": "1536:xRScR49Z+qJ+ovySN5RYbsd5pQa9Sn30GwTC7kHQmmsTd4tAGRQ+DxnEV4+tpj:3unq25Wbc5pQa0EGwTi0QN0dPGRdDm/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303061, "uuid": "95aab1e2-ddaf-46b1-9900-fdd80d2ec8fb", "value": 91356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303061, "uuid": "daf28e64-934d-4bce-a6e8-6f320ea39174", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303061, "uuid": "409c043d-c2be-455c-8a94-be7a4b4cfc57", "value": "flutter.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb200cd8-c124-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791249919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791249919, "uuid": "3813f4f2-7731-4574-a429-334a961b292a", "comment": "Malware payload", "value": "6b0f26b326493524dc8aceb9f92a5b11", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791249919, "uuid": "648ac76f-a6ab-446e-91b7-4b5dbf6ab644", "comment": "Malware payload", "value": "e58393389aed9e90d20f292d5e79c55be0f87a271028cd3145a7fb9834f97e43", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791249919, "uuid": "62f34a2e-b96a-4969-a8da-de0fa33edd0c", "comment": "Malware payload", "value": "e21ba781ef683b1861c8665a567f8b0f781fbcc7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791249919, "uuid": "12453bcc-115f-458d-9d8d-47c62f7d341c", "comment": "Malware payload", "value": "97756e06d68d5d2621c28c71993b327edc3550dd11712092a854f45ea81406fbf88b343c2aa0b00284e7b6f88e464e1e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791249919, "uuid": "fdc5a196-2514-49fd-b172-2e6125c071be", "value": "T16DC633608D7C5DFFDA4FB23691EDC096E91E8B023143B65F3E195282DC8B1C1672AB19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791249919, "uuid": "5bf12b2d-60a0-47f9-b8b3-724d1106cda9", "value": "196608:ELeCclszLtXbG6E+DMlJ1H+Fg0eMldZUsqoZVtPszcge3GuNsAXX:ELenlMLG6TDabHCSsRXDtPszcge2ADX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791249919, "uuid": "57a6916d-3525-4525-8f06-9efab6d55178", "value": 11721737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791249919, "uuid": "8b0f1aad-f018-403c-9727-2d953396ce59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791249919, "uuid": "6264a1ad-c926-4f9f-98a2-c90f8760ec85", "value": "e58393389aed9e90.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95883fa1-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303087, "uuid": "b32ca29b-3476-4e90-b75d-5bef92cc30d0", "comment": "Malware payload (Mirai)", "value": "d42bc7829ade3c86c3d9e544cd48cf30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303087, "uuid": "20f3cd7b-33bb-45f8-aa7c-117bd5fc6ff7", "comment": "Malware payload (Mirai)", "value": "e58ff94b9a26238f683278c3a3d48fba18dd26ff85c706d5972192bd7168d0a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303087, "uuid": "b7490e6e-6b3a-4840-9277-05e8e0384ecc", "comment": "Malware payload (Mirai)", "value": "6c1bad62c6e8cf1fdd3d4ef131f3ff11b42ef171", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303087, "uuid": "99038e29-b431-4cd1-ad1f-75c149dd6092", "comment": "Malware payload (Mirai)", "value": "3cc71e4a8beb67d8f48682760a7b4e35a95ac1b202672db63685db7eb5a78ba3896472cc33e8c90e114f4513754df46f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303087, "uuid": "b96799fc-ab53-48b5-a124-2d05a2b17d4f", "value": "T1E5F31955F8809F66D6D5277AFA9D028C33130778C3DA7102DE20AF2537EF95E0A3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303087, "uuid": "ffb38c7b-2358-4066-a1de-07531506403e", "value": "3072:XOYdL/xBtfduC2+7xbfcQbehOaXLoaRCNaHFvm/OYXUZPOEyUwG1XE2b83hgGcIf:XOWlNfcQbeoaMaRwaHFvCAOEyUwG1XEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303087, "uuid": "8081f2b5-4f95-4ba0-b068-ae81bc118279", "value": 169296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303087, "uuid": "4f131900-5028-4af5-b58b-d56304305c36", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303087, "uuid": "719d5f5a-973e-4b2f-90dc-8b11fe814f80", "value": "flutter.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4694c0e-c199-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791300105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300105, "uuid": "f1109b00-7be9-458e-929f-fef2b2c13e1d", "comment": "Malware payload", "value": "d0a3a40b389e653ef225f949927bc227", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300105, "uuid": "43ce37a3-f274-4501-8bf2-4350930087f9", "comment": "Malware payload", "value": "e592537f0619f2052ce24527edf81d05776c2333a43a78d4aeeacf2b8723fbe6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300105, "uuid": "8dd6c1cb-463d-4fcc-9faf-d371b166bc3d", "comment": "Malware payload", "value": "b6dc0e2c3da12b88912472b7c9be4b64630be1c2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791300105, "uuid": "d1c9b743-d1d1-4c42-a609-366ca96ce25c", "comment": "Malware payload", "value": "517a70c74aa534132335a12c5bf460476dd1a30dca416e122ce5ace34801c597d60ad1dad59696ea2d146511af8c865f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300105, "uuid": "26037c49-34f0-41a6-89c9-bf608808c5bf", "value": "T1124633A2CFFC41BEF497AA761174C9A2A5FC69CC910DB03B01BA49FA244FD994F40D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300105, "uuid": "3bc77873-0078-4921-ac3a-54e6f4a1dafe", "value": "98304:P+uwejS5HJUww7h+/zvdhwGpzu+PGnWIYnYsJyY8Ci+nD53v9OAVQLkeU7+Ek/oR:P+JejSMww7h2dhwybtb7wYy4v9OCeU/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791300105, "uuid": "3e3196f0-a283-4ed0-a4a8-ae6e853aefe5", "value": 5618236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791300105, "uuid": "6d83f970-5708-40ff-a12a-d01d7de2884a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791300105, "uuid": "bf39848d-beca-4602-841a-1a1bb6802194", "value": "frost-client--patched.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1df37b9-c151-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791269204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269204, "uuid": "890658a6-850b-45b2-a473-3746992b97ef", "comment": "Malware payload (PureLogsStealer)", "value": "0b2b990be7518d6cab438473e16f5e6c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269204, "uuid": "c3d1c63b-52c7-4f0e-8f5a-4a07c0d1fbe5", "comment": "Malware payload (PureLogsStealer)", "value": "e5c35e102f973224b590539caa2984638615eaa7eaac327d98f3c185801aac34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269204, "uuid": "24d83fa9-c606-4299-9351-897ecd679a2a", "comment": "Malware payload (PureLogsStealer)", "value": "af0b6141a9a8ba89dec4a17b0aabd6d4ff921c18", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791269204, "uuid": "23bd0dba-ccfe-4431-b08d-0ba15f083d50", "comment": "Malware payload (PureLogsStealer)", "value": "78d0e6d28b22ac0ec507e7011b3ece52f24a747925ae614cdf4ff029d4ad97ce4ff1e1f3e8279f56eb815d89f5d1d91d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269204, "uuid": "e4aa1092-381c-45a6-9b8b-34ab724c51a1", "value": "T11765221657085B6504AC036B3B7BDF1B92F48A92B62CE1CCD3B583F5625AAC1E1F3C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269204, "uuid": "04dccbbb-86ea-4d60-94a7-3fb1544ca67e", "value": "24576:Lxb9cAzpVn1+XKWZVW2T19F2u4GyMUlbR8+qoRIfrEY+faprdcGAOfzb9TAVQ:UYVk62W2bUGyRY+qVvpRiyzbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791269204, "uuid": "42324bb1-2f45-45d5-91b1-1f904bd3598a", "value": 1508808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791269204, "uuid": "d60eebc1-49b0-420b-bdca-986f03da0bb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791269204, "uuid": "7ebcf044-b7f3-4227-b6ea-86f067327361", "value": "SUPPLY OF YOUR PRODUCTS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645f4c5a-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250606, "uuid": "b1246573-f35c-4b55-885d-41747207c632", "comment": "Malware payload (Mirai)", "value": "2232e8574ccf186416fadde3e03b01f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250606, "uuid": "fd944910-47bf-4cbf-864a-7a996cdd9768", "comment": "Malware payload (Mirai)", "value": "e5c4c05997fe324f9e2f033631f324b9a8f25e050484e3466cdfa240420b1c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250606, "uuid": "47a5e66f-58ae-443e-bc9f-7c73f05e736e", "comment": "Malware payload (Mirai)", "value": "69cfd54f9319b95ff9b111529cd373bf7c72b930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250606, "uuid": "bd7a2d76-b1be-4585-830f-64930f47bf66", "comment": "Malware payload (Mirai)", "value": "5965d9350bb0a9a8de1666b393cd2596c5529c623cd3b323b1f6f6fafc49447f10414d49e7ad234d6363d342dd9c2015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250606, "uuid": "2fc9a259-68d8-4c55-aeaa-715cb994a136", "value": "T1AF431981F44F81F2C44B497050A6F63FDF31D9AE42B1D62EEF99AF32DA675429101A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250606, "uuid": "63fecf61-387f-4eb7-9b1c-1ebb3015ec09", "value": "768:SfYcj17BglTIJ/sITKUEPgK+4CaS7HA691CO1zBAx3/9S2BxdlhcTqmq16US0sp:6DgIJ/sITaoECaCzubhYqmG6R5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250606, "uuid": "cc969494-b367-43db-8226-eaa08ef047ca", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250606, "uuid": "a48f40da-c26e-4aa0-90d9-30cb54438a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250606, "uuid": "8796f93a-cd85-47ba-92a8-15e56cfe701f", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed6628b-c144-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791263616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263616, "uuid": "4387fd88-4678-4914-a0a8-d7972897339b", "comment": "Malware payload (ConnectWise)", "value": "c0c6f6e0731a319cc92f90ca789dcc3d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263616, "uuid": "0e6ba2ab-e6e0-42d7-bd59-6f1ecebc33af", "comment": "Malware payload (ConnectWise)", "value": "e5c9ed91eb09773e30971c76bdff83f08be5ca5ae251ccb6addc72192a0b1529", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263616, "uuid": "f436e1df-2a83-49ab-be9d-db95444c193a", "comment": "Malware payload (ConnectWise)", "value": "6dcdc64f2485722a41c40695daaf6892c2c9f7e8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263616, "uuid": "6458c26f-f292-4da6-9960-de8267f9a93c", "comment": "Malware payload (ConnectWise)", "value": "d05b3fa979708519bff2abfd16c8eeb2fdcb6f6c462888919db2fbdadebe57cb9ac3e776ca134d4e915d0a955a86f017", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263616, "uuid": "cc79d5c7-d22f-46ea-b17d-446a63ff14f5", "value": "T13E647D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263616, "uuid": "899ae916-c2d9-4e3a-993a-a986a97f7723", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263616, "uuid": "9f550f7b-c30d-4cc0-8bc8-74f0f5bac3f4", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263616, "uuid": "2eca2f39-5b50-49d0-bbf3-0d421920831d", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263616, "uuid": "534929d0-8f6f-409e-8702-47c06248868e", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263616, "uuid": "1e838a29-9a73-421c-92df-840c67195a6d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cfdbe2-c1bf-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791316564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791316564, "uuid": "8e9ae95e-d8e2-4613-964d-4fce611da78e", "comment": "Malware payload (Mirai)", "value": "96bfa984a8c2fb769ea1a0a6a03939d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791316564, "uuid": "48b0df7a-1610-4811-b615-25f3a96f26bd", "comment": "Malware payload (Mirai)", "value": "e634abc411327b6c0f341f88838a443a227419ef1d75244fe3ce5c1596e7a0b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791316564, "uuid": "1d33bc69-b3f8-4058-ac6f-ee42afabe711", "comment": "Malware payload (Mirai)", "value": "21ade769bebc37c45d99eacbd66d37ec3757d4ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791316564, "uuid": "e83d4b94-b8e3-46ce-aae3-85eb8277f9a2", "comment": "Malware payload (Mirai)", "value": "389290830b58fc590a4926a4859af34b72b0617c8e98b884ceca301a4a771ef5e3b07c29649e27e97ab42cbcaf89ad1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791316564, "uuid": "3d741217-3eb7-43e4-90ff-9ab47377ed5f", "value": "T14D0463BEFA11BB6EE168873187F25F72C39521B22291D341E2EED6185E7528C085F7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791316564, "uuid": "488b680b-c62c-432d-84c8-b2a3b514fcd0", "value": "3072:gIZrG2Zf/xL4ytxzLiBKUHqeWluPDbpSIeZ8tjTl5:LZa6rGjr3PDbpSIeZ8tjTl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791316564, "uuid": "fe0b905a-a76b-4e61-8e44-40a0ac1f292b", "value": 181799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791316564, "uuid": "1631a7aa-2047-41c0-a2a1-a61ee3cb28b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791316564, "uuid": "0076b59d-4393-4b2a-b963-3fe87b34edd1", "value": "gnome", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6bea10-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273971, "uuid": "6fc6fde5-7053-4b9e-8216-391eea3448be", "comment": "Malware payload", "value": "484cd6f5cd140070990417dcdac56942", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273971, "uuid": "9ac3bb93-813a-454e-ad6b-333519359cd5", "comment": "Malware payload", "value": "e662bd298f29293e2561778f802813ae3241d9d5efeb32841b3669dd1fd7797f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273971, "uuid": "635eb1c9-67f6-4012-9fe0-c1c5e21499d4", "comment": "Malware payload", "value": "8694a842a4dbe2eccd97f992c419cf7ceb054f3a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273971, "uuid": "f7a623b2-b5af-4544-8a49-53c501237659", "comment": "Malware payload", "value": "aac0fbafd0cc990171ac4a3b243d3f9a223f24bd52f63e44206a827c5d84b0f056d673ed65505981df0cf5158f0ccaea", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273971, "uuid": "22e45c00-7c3e-4354-b04b-2d6494264d48", "value": "T15955339BC13D15C48F6D0A57ABEF958C7214CAFC204205732F124AE7393DAAFC2656DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273971, "uuid": "4388352b-24ae-4585-a087-051eb039743a", "value": "24576:WzlCwQoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRB:WzdQoZ9bq+MmMEL+hcjXHC/wnwdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273971, "uuid": "3403b34c-1077-47ac-9bc2-0e30aa97ec46", "value": 1394781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273971, "uuid": "68611f7a-3797-4602-9e4e-dc021fd61aa1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273971, "uuid": "958b676f-021d-431d-a078-10d930e135ad", "value": "e662bd298f29293e2561778f802813ae3241d9d5efeb32841b3669dd1fd7797f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87efd823-c197-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791299199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299199, "uuid": "198f8036-9e06-4c30-affd-05507fc0684d", "comment": "Malware payload", "value": "52607fcf92455c18a149949c7c51d7a2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299199, "uuid": "0ad2d1f1-4a2d-48ed-917f-b9a5711e1914", "comment": "Malware payload", "value": "e6c442bbdef48acb3f72214496eb9cb81dcddd290b5cfa1b88341aae3a839e38", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299199, "uuid": "6f5dc1c3-b0f0-40c5-b917-6a51f4dcd6bb", "comment": "Malware payload", "value": "0d06768b54dd884c421db2990259d53b273fcf8d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299199, "uuid": "a2946453-64b0-4b57-bcea-a8b27c9b4564", "comment": "Malware payload", "value": "8b3412b0db193796fad934afcc923ddeae0000a969fbece76f264b4723e2c6f92986a49dd4196e160f708fd65d44f83d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299199, "uuid": "dfbe7c96-ee3c-40d8-9278-d17ea7417552", "value": "T1DD251212956D4D22E2FB673EF0146D137CAA03DA920AF43F45B94CF7088B5DD2EA531A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299199, "uuid": "82634854-1820-4397-9a89-a336c77e6633", "value": "24576:wn7ZRy6PDgaCUVsTmKyUnVYj6swoo94iDPJzpr:mtN7gdkUnWj6r94i9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299199, "uuid": "4934b584-a199-47bb-a3b0-553ea7afa651", "value": 985982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299199, "uuid": "f9d4c6de-a237-4251-b83a-58f988aec299", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299199, "uuid": "8fb42131-adc6-4170-a495-a2516bc37078", "value": "4E.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4eec6d7-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273961, "uuid": "8b3c7c54-cbd0-4170-88b5-b80685f77f84", "comment": "Malware payload", "value": "cae76c7fb5907955448e4085b5ddf326", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273961, "uuid": "f7ac0e3c-d416-40fd-9b71-9d55d8b62cc7", "comment": "Malware payload", "value": "e6dbb611bd7bfad35c9048e591d31855ad587dfe72312a584fa03ee014fb0a06", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273961, "uuid": "aef6d63f-787e-4afa-94fb-ec6e82db206c", "comment": "Malware payload", "value": "27bfd0fe4205cc019a6da22419e75cf004c88c6b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273961, "uuid": "96ace32d-140a-4ae3-9196-43f9e8913f6e", "comment": "Malware payload", "value": "743428e4fec4875d78559868c55bde858d0ee31894154d960c3a9effd07c8e0454959eac4f46f75b4140a18f57a203f2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273961, "uuid": "2c0c4112-a140-45fd-9669-9081713e778f", "value": "T1A15533C7813C2CC44F780A97ABEF855C61248EFC100218776F2685EB653F79F86B995A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273961, "uuid": "db3175a2-e928-474b-8159-cf7b5bdb6f64", "value": "24576:FpjJAtsoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRo:F9GsoZ9bq+MmMEL+hcjXHC/wnwdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273961, "uuid": "6ef4a969-01f8-4f5a-b21c-42bd9f1b3968", "value": 1381514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273961, "uuid": "660d190d-fb02-4c4c-928f-da593788ef8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273961, "uuid": "524f5ec5-9ec6-4c24-b8f2-a8a9c3c6dd7f", "value": "e6dbb611bd7bfad35c9048e591d31855ad587dfe72312a584fa03ee014fb0a06.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424f6e82-c146-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791264292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264292, "uuid": "22ed5c8a-4276-437f-bad1-10b259b2abbd", "comment": "Malware payload", "value": "3442d8ff804f0443e4e5aecb987acf46", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264292, "uuid": "d92694a8-3b80-41bd-98dc-a26f60d0971d", "comment": "Malware payload", "value": "e6e05636505b476ecb3159344274897ca52597441a63ee051e8223e9edb837e4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264292, "uuid": "67bfafae-29c9-422b-a8e7-500d808aecc7", "comment": "Malware payload", "value": "abd584181354874768071efd7706d71dcebdfd16", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264292, "uuid": "1877ea93-2ca7-4a61-a7cd-4fb8c28c4d76", "comment": "Malware payload", "value": "54644bc80e7f95a59beb38325d8d6ec90b27c2736ce50794f7ae3ba38d5ee9e17c1db6212ea2cc47216d3e1cd5b9ba48", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264292, "uuid": "d398aba6-e962-4928-90ef-b148af081fc8", "value": "T188753306696CE413FCB34275878DA2EA8AC9701B0D849F6B8D7587218D5FEC50E3C9B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264292, "uuid": "cbc84d2e-768c-4a78-af48-aac0a1641d38", "value": "24576:nW2Vlo4DkkKLWkFRgEOKx0AMvrtdZAqn0cBJD6olejVsUd72zO9zfPdT3bNi+WB6:n24IkKLWyRvYzZxn0wOo0jndayBF3nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264292, "uuid": "32b0b8cd-cd04-4147-aa06-de1bcf1351b2", "value": 1584463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264292, "uuid": "869408a7-6fe2-4990-a6f5-c22dbb3fb973", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264292, "uuid": "ecd60f5f-99bd-440d-852b-5811ce66b158", "value": "e6e05636505b476e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02576af-c119-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791245149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245149, "uuid": "87db9192-301d-4def-b75d-ded36363027b", "comment": "Malware payload (Mirai)", "value": "d0803a299231db2420b28a13971584c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245149, "uuid": "cc30e769-30b5-4285-8178-270b1a9c4ae3", "comment": "Malware payload (Mirai)", "value": "e6ee9d07e6bc739e3b819edf355ab74aa79ea5be0141b1198b80760db3d05734", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245149, "uuid": "b2cfcc75-3693-4515-8635-1b497d578e3b", "comment": "Malware payload (Mirai)", "value": "d438ae7887ee2adfddec53accce3c571217b4494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791245149, "uuid": "d38180e2-71f9-4db4-9746-e8fc875fc0de", "comment": "Malware payload (Mirai)", "value": "19b88506f6d7ad592ae4eaba690b9b9bdbf5ebcb192f5e58080f00f33b667ab1a69e9ebef1cb10a76427b104a36694c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245149, "uuid": "7d259a79-868a-4276-8b8d-53f4ce0cfe49", "value": "T15ED47E07A9F084BDC8D6C0744BCB833A9D72F48A2179F68FABC66E817E15E90671D741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245149, "uuid": "d820f41e-92a5-4963-8777-cb0dfb269b01", "value": "6144:hfRMjoUKBfEXXoMkOh8AnUnOfveV9WIlcRPi+4Oi29ttpxtPBSKiR/0794aH9e/L:hWKJRMXnsy829Ppx579g0pUEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791245149, "uuid": "d4e14f97-3a57-4884-bc09-3ad0011f4309", "value": 625224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791245149, "uuid": "c2264181-75a7-4a61-a162-8e94704c1c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791245149, "uuid": "d8d3eab4-4a07-4695-85a4-988ac1c86e0c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacf272f-c1d0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791323792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791323792, "uuid": "e8c01f4a-325c-45c8-b6f0-757baba75db7", "comment": "Malware payload (Mirai)", "value": "cc71d311b38ee76b7c75a46eb831a93e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791323792, "uuid": "e29b97c1-6c90-4b60-bf72-de27d6914544", "comment": "Malware payload (Mirai)", "value": "e74072e835179517a8591dab94f3e9375289318fe680840e61503b9c04336666", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791323792, "uuid": "86011ad5-0f8c-4b56-b58e-b62d8326dc39", "comment": "Malware payload (Mirai)", "value": "3b7bf4ed75d355e17a35dbbbaa37ab0057bb09df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791323792, "uuid": "762673d1-0a34-43aa-bbc0-b9d22e2c391b", "comment": "Malware payload (Mirai)", "value": "27f8213d61d420d922e5c8af773341932691403ed351ba50a5de2e2b00c2ec79358644a93637abcdb953fe3bede3a705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791323792, "uuid": "87be5a52-054b-460b-bba4-0b55aa669960", "value": "T186D318DFF2D0CAFAC446A1B1DADB8553E412FA380622E20733D3FD652A2D5C85D592C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791323792, "uuid": "27729963-cadb-4faf-afe0-5cfd7ea9e45a", "value": "3072:9nQpvQDG9HBykwzITRXsCrdrA8Ej8Njq6MlDbcZ4crd7yh+:xQpvQDG9/wzmxrdMLrzlDbcZ4crd7yh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791323792, "uuid": "d81d3895-9301-42fe-ac6e-ab7e156e645f", "value": 131803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791323792, "uuid": "c9fcf881-8dc9-4dce-8b7e-df8cfb387f51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791323792, "uuid": "c5e97b43-92eb-44c1-902c-91ca2de77529", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fb60f3-c135-11f1-927a-4201ac107004", "comment": "Malware payload (CoinMiner)", "timestamp": 1791257053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791257053, "uuid": "c59fbcd6-22e1-4fbb-816c-f36f3b133ca8", "comment": "Malware payload (CoinMiner)", "value": "cfcc97cb95e356ac0cd2e295c025dd25", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791257053, "uuid": "9889c7dc-9f0a-452d-a6d9-39fcb05833d6", "comment": "Malware payload (CoinMiner)", "value": "e740b087ea540c1fabcb0623399c7142aa6dd68fd9b4a4cadd7521170c332935", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791257053, "uuid": "141f0d91-8361-41a9-82b2-cefdd8922256", "comment": "Malware payload (CoinMiner)", "value": "48ff4494c64d8a4480ff4b22ea71d3e79a6e799f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791257053, "uuid": "4247c4ee-646f-4626-a630-9ea05772a6c1", "comment": "Malware payload (CoinMiner)", "value": "4ec35d982de76a6374e05bf0efd9bd3d1415c00a5fc90a8d8a809c797f2063ed60a002d048cd11a6501835251e2190b4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791257053, "uuid": "da5398e5-08c9-4ab4-982b-24fa6f54bbb7", "value": "T1FB7733ED0E70DEFAC9A2E6FCB40AE34C12FCDA16930345D7889835E59F647D0399524A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791257053, "uuid": "680b9722-eb05-4b22-af74-5ee2ebdce7f7", "value": "1465e7eab8316965aaa8e0b0ce1d221d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791257053, "uuid": "5ee54696-a49a-42f1-99de-a3b52db44a99", "value": "786432:zvimNuGxgKjw7Y7z6PsRx9sQB7hyEDVrQA+Z/:zvNufyw7MCW7/DP+Z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791257053, "uuid": "38e21ced-b52e-4e91-8adf-47116087825e", "value": 32903760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791257053, "uuid": "55e7ea0d-bec3-4e2b-a383-c1c2cca6abc9", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791257053, "uuid": "12342a1d-f9a6-4489-bdb1-f08b530b4f20", "value": "e740b087ea540c1f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd6e42a-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791273439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273439, "uuid": "e545cd71-e222-426c-909a-9e421b20222b", "comment": "Malware payload (RemcosRAT)", "value": "7940a80b0f28681403cd0f1df6e4e6f6", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273439, "uuid": "9de010ea-3a1a-49f7-9624-db16957ad78e", "comment": "Malware payload (RemcosRAT)", "value": "e7bb8fec278930f81241f1b75656e1722f3924cf5a569d24feffb64bd8ddb591", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273439, "uuid": "a833e787-636d-499c-ab90-e410caf4842b", "comment": "Malware payload (RemcosRAT)", "value": "7c803a5a40547a2fc3b98f42bd2ff53cfdd144f8", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273439, "uuid": "2b1f08f5-802a-4dcf-8de8-a21e0f2e4a85", "comment": "Malware payload (RemcosRAT)", "value": "6848bc1864b5695b54e87baa0e1b850882246b5d717ab361657e5a2c4f1133fc8faca3f401231a30cab134fdd16404cf", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273439, "uuid": "54e87c91-019b-4253-afae-db506d075659", "value": "T13B4512F9F066F4925167C67AE3147C1CE2B502F39F9695A8039F2AC7CE0FEA85D44850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273439, "uuid": "815c0c5d-8b4f-4517-8373-7ede752edd14", "value": "24576:D5LSjpTSfOMFy4QcMsZLXG+iCZbVx+TJxzk:l2c3Fy4QsZaNC5ALzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273439, "uuid": "22f1d68a-e4b1-4a3c-921c-6407c92b7a83", "value": 1223361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273439, "uuid": "11c8f7e2-89b9-4408-95ba-9ef242f0fe14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273439, "uuid": "9b276a4d-98ad-4e7a-9d0a-6a1d363a6255", "value": "Orden de compra_9937940.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18c60b8-c19c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791301469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301469, "uuid": "55b58fc6-0961-4404-a69d-24729dbc61de", "comment": "Malware payload (Mirai)", "value": "52b4825f551dfe55b6d1a590f6fed279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301469, "uuid": "21ca2eee-2eaf-4ccc-b510-5d0dc9d236a7", "comment": "Malware payload (Mirai)", "value": "e7d4a2beff85800e1029b2a748d3863eb41a8e89b10297ef3b1aa5e89658dde5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301469, "uuid": "a1fb48a3-83ff-4632-932e-4465abb37f63", "comment": "Malware payload (Mirai)", "value": "0fb87141667d8d9f98258990ffac0092cf1ae7e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791301469, "uuid": "d629b689-8d6e-4a0a-b06d-e5cc3dece44d", "comment": "Malware payload (Mirai)", "value": "4e29c3e5b069ce86975c8b679e49a0386d89c4ca63b5db6eb126c392f8a755e77e2b46841aee9ccf2f9d9c315d4d6abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301469, "uuid": "ad9aafc1-9fa1-4b98-b2a4-abde043e8717", "value": "T1FAC418B6FD419991C0D42ABEFB5EC2C833070378C3EA70429D16D72569DF69A0E3EA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301469, "uuid": "988bb129-7fc7-4c82-91d1-ee2cc9368a7a", "value": "12288:lSTMs/aPh3j8yts7mp3txeeKazSsKr16l5O+OmMBm1n:M017K+l5IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791301469, "uuid": "79b9da85-15f0-4bc1-b513-3f133b94b65c", "value": 583380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791301469, "uuid": "54bfd192-6bab-406a-89c3-be479dae6ad0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791301469, "uuid": "fd05844a-e6a4-4381-b895-033f1a2c22c9", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e870fd0b-c183-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791290770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290770, "uuid": "6ea72ec7-d824-4be5-b1f4-bb4339b99a19", "comment": "Malware payload", "value": "93315a630baee9fb6a36fb03e4a8fd96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290770, "uuid": "3e939761-eed3-4155-aebc-0638d6017feb", "comment": "Malware payload", "value": "e82e01208398c565893fef6c542bce22fd00cca913a65cdeb5b9b4f7466fec42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290770, "uuid": "80b1958f-01c0-4cc6-9b10-0392ad7379e9", "comment": "Malware payload", "value": "9eb7cdfb0fc68d16703400b64bd9dafbf960d113", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290770, "uuid": "a4977f22-35f2-4ca1-90d0-51633bbdb4d8", "comment": "Malware payload", "value": "2d1270ca2fd15e2d6d88e2e67afbdd5afc6dd858158c6fc4e6c3430977576a25d2c68ce516caa49745b134993fbeeb6f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290770, "uuid": "bf09a5fc-f2a9-40dd-b6e1-17820bd76976", "value": "T149A1B28A2070A63CACAEDD6C39E5464058AD47E3B5B13F395FB00B532D8A970B349F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290770, "uuid": "d869fdd7-b502-4245-91ad-d95f15ac53f7", "value": "96:rld8Rv5iNLxj6QAD3HoHPuj1yI6fn34UQBdPSNBMLKTm/1iVXJIvFd4Hx0fzcDZT:rld8Rv5iNLxj6QAD3HoHPuj1yI6fn34A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290770, "uuid": "aaf0b40f-2ce0-448e-98cd-3be4925f5adb", "value": 4730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290770, "uuid": "2c290bbb-c139-4d7d-acc4-7e7b2786d76d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290770, "uuid": "83f5dcea-426c-4619-a8be-5fdf3bae679f", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ef79f4-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303064, "uuid": "7a23d515-974f-4719-b752-026c8b54592f", "comment": "Malware payload (Mirai)", "value": "8728e241ce2bebb61d9bf57c607cd08a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303064, "uuid": "20d39a91-f1d2-4dfa-853b-b54f73d8860d", "comment": "Malware payload (Mirai)", "value": "e84bca94ab5d607695a5868c771831616f02c297eae4adf30ea67f7a37d1f244", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303064, "uuid": "4628f2c0-a691-49b2-b3f2-3a85058b440b", "comment": "Malware payload (Mirai)", "value": "9727912234160d2751b45253077e723fbddc069b", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303064, "uuid": "be1df160-8f6f-4e97-8ed7-83b394ac88a0", "comment": "Malware payload (Mirai)", "value": "7ba23523b876d913d5c28fc732b7fcfbaeb4f2d200a2075398de27d796a52c1daf019f8abecf859dbcb2db64013e0d72", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303064, "uuid": "1361ead3-f401-4563-95b0-37bcf26644d2", "value": "T1BBC3127EDC84F529D01FF539C3E14FEBE8714C598AAED96FC2666201C75A2F27122821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303064, "uuid": "70590147-7806-4855-9710-b5022e089476", "value": "3072:DuPV6tqnt7VLhHqbo6s/Z+F57mFdyV2OU2UWpLJC:6N6tqnh3KiZm4dyVxb9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303064, "uuid": "9932c09c-d227-4653-90fe-4905402c4391", "value": 126248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303064, "uuid": "6251843b-6c90-4fc4-8596-2f2455978404", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303064, "uuid": "48dfac99-279d-4af1-8934-a28b2f89256f", "value": "flutter.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7787b49-c17c-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791287709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287709, "uuid": "d642c43f-1864-4fd7-a17e-73f46f81de4c", "comment": "Malware payload (Gafgyt)", "value": "c50adcbdc0f3c32c56f9baf880793fc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287709, "uuid": "35dd2c33-f5aa-4656-a9ff-bde109e7ed86", "comment": "Malware payload (Gafgyt)", "value": "e85b3954b3afcdf0d3ac0083a141eca8e2327a869c5ea1302e4e4e627de9b6c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287709, "uuid": "730a4360-db28-438e-a1c8-7501cf236bf7", "comment": "Malware payload (Gafgyt)", "value": "7b8e8033e31136630fd54fbb353db67ef65b26f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791287709, "uuid": "0dcf7fb6-1bdc-472e-83dd-7e8033028725", "comment": "Malware payload (Gafgyt)", "value": "520e47af0e70a0d3f71b21dc883d6f553bf7542df2612f4766e3a12737024f228d7ce67efecc4497e9938ee48ce2aa3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287709, "uuid": "5f265bdd-c612-496a-98d3-ce5ec9831250", "value": "T1BE145B13A9A55F97C5866FB662A38B710753E8214B430F7AF62AE9F44603DCCF809374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287709, "uuid": "21d9e91f-fe0a-48e1-a584-0035b7cac876", "value": "3072:N1x78TXRz5o+GfnCPlIQWOFrS7pclKcaF4h4tlUtk/3PXPnlr41HY:57+J5o+wf5OFmp6Kh4h4tlUtk/3PXPnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791287709, "uuid": "247cb244-d800-4857-9352-ee3c50370d54", "value": 191619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791287709, "uuid": "dc94c6bb-2103-4345-b74a-e9aba0754ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791287709, "uuid": "506037c0-b023-4a3c-b754-1f4ded866dbb", "value": "qv3.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bff209-c1a6-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791305661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305661, "uuid": "4336bbe9-b83f-4fce-8c60-7ef129a63e51", "comment": "Malware payload (Mirai)", "value": "66d54b562680a4a7471a79ae3c423116", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305661, "uuid": "bf0b7aee-0ed4-4654-8ad2-b8b80265a698", "comment": "Malware payload (Mirai)", "value": "e85c05fb2f529fa7d8c02cd8b28a58b375e61c288c568fe531b5bd21d48df4c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305661, "uuid": "6d816726-9aaa-4cc6-b962-1f5cbd34fbde", "comment": "Malware payload (Mirai)", "value": "3f8c154416db3abc0ce8bb2ec3d42f4407e3891b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305661, "uuid": "7bfafa54-a192-42e6-a7a9-2bbc6da7a457", "comment": "Malware payload (Mirai)", "value": "7c36fa34dab7d6c4493545050b9f75c44c95eac4abe9bec9b9aa1fd61aade65637f21d998a464dfe1b585d587de0480d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305661, "uuid": "33d02a45-0a08-4873-a4bf-9bf3201eaa65", "value": "T1E193D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305661, "uuid": "addb9c4a-738b-4ea5-a267-184f0f1cdc25", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqNKK:NFjXYyCEx04KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791305661, "uuid": "3183ccdd-a553-41ca-9cb2-50059338ef79", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791305661, "uuid": "64cfc25d-41a7-4ab6-aa85-2eaf640a0ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305661, "uuid": "b678afe5-66c9-4069-8e24-32fc7cd1fb83", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a74fe2-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275970, "uuid": "844ef2a4-c6b3-412c-89ff-18cf347fb511", "comment": "Malware payload", "value": "203412d9bd10263bad0d1135d6bdd80b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275970, "uuid": "65dba209-21bf-4b37-9f06-a4cb3f1a154c", "comment": "Malware payload", "value": "e88a7234b46e7ebedd9460912ea876759d581c02b74a3cd1a3f0f1452710a1c8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275970, "uuid": "9f5761b9-14f2-4465-8f11-f73c260107ac", "comment": "Malware payload", "value": "f9ef5dbe190fccf2eb7b61003150c3348640de6f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275970, "uuid": "d8f6f9f8-9be2-4100-adda-aee6e1a0c3f7", "comment": "Malware payload", "value": "525d9685c5bea2d0e42cd00ea7f6e9ca6cea148813239ddc64bd059c7025f52fc232166c04a6f8a9b55b86b6c7070b57", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275970, "uuid": "a2f17125-962d-4b33-99b3-411f99d55329", "value": "T14BC42367226F72500DFE92ED4E4156146D3D8E322A00A6FE55D8C9CE8719F0ECE35E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275970, "uuid": "0fee50e2-9997-4052-a9fc-50ca84e0207b", "value": "12288:AeCEhtk9qO3g/ALyYG0ZaDajTCXMO8xzDOeQakM:HtOA/f0Za6TCXKBxlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275970, "uuid": "b86ef338-99e1-4a16-947c-255bc058afd3", "value": 546286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275970, "uuid": "73b002bb-91e1-449b-a275-6e29c98d01c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275970, "uuid": "8414f4c8-c158-4c1f-a77a-9761706e1121", "value": "e88a7234b46e7ebedd9460912ea876759d581c02b74a3cd1a3f0f1452710a1c8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce8cc2c-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274511, "uuid": "ffb62daa-a263-4995-a6bf-fd20e47934e6", "comment": "Malware payload", "value": "137f2864c5fd1fa0f2d81601348fdfdb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274511, "uuid": "76b0ade9-ea63-4613-b3a0-24543171887f", "comment": "Malware payload", "value": "e8edbaed357e61c10cecf911bfc25a6f54a3adb1a006562bf5f409f0ce5d5e2e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274511, "uuid": "9ce03ff5-08e8-45ac-bb09-965ac4be65c2", "comment": "Malware payload", "value": "ecd772b6c597108d589ef6863682570b6a43821a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274511, "uuid": "bdf6e600-ca70-4004-814c-9bc5d75d8ef9", "comment": "Malware payload", "value": "7a1ee48eee1b7b9798a0714e9990f38de7b0510c62ce5c339944a7d598c2e0feba68f823e87cb7e612c5e24df9b4fdf7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274511, "uuid": "70c062ae-db15-4b87-9fee-c334c9a51649", "value": "T1E5A423A8A5C06FF6DE773A104D241F164628A50F29EBADAF9F033640CD6DCD056971CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274511, "uuid": "0ee9283b-f27d-4052-83a6-31b98e190b28", "value": "12288:+zYfcEaN9B/Jm0LU0gM7aQe4HphuCmCJ91YqEZG:lfclN9BhmSHUSuCmIzqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274511, "uuid": "14fa8bb8-b48c-47dc-9c69-2d3be12b1609", "value": 467850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274511, "uuid": "6bc64534-677d-42e6-9f03-8a59a4daf641", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274511, "uuid": "d3780181-0697-4f07-aaab-47baea30c52d", "value": "e8edbaed357e61c10cecf911bfc25a6f54a3adb1a006562bf5f409f0ce5d5e2e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4790fd-c11d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791246648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246648, "uuid": "80282403-4ff9-430e-a7e9-ad6c02aeeed4", "comment": "Malware payload", "value": "98e8396a08c5e9facbfaec1b8e0cd232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246648, "uuid": "933a2d0b-f3dc-4482-80c8-0008c76354e1", "comment": "Malware payload", "value": "e8f49751e434cb0ae4555ba6a8570d46a8eaed44e99bf5c650d8cfa598193f44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246648, "uuid": "b714f5b0-14ee-4d00-af7b-0e82778fa80e", "comment": "Malware payload", "value": "3e69b7e434eb89b64c72cfea8e40661ab83d10db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791246648, "uuid": "da9cfa7f-b691-433b-b631-aa379d728675", "comment": "Malware payload", "value": "c1313c8dcc333e03671fa596271ea140d396cdb8574986ce849123d3c74b78ae0e95766d8be8ebb95bbe73bc54a1652d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246648, "uuid": "a08644f4-f475-4f9f-b4c1-51a7d4def062", "value": "T1A8565B81FB48A125E94B0B324C630F74B3605D85C1E4996B4706F76F0AB36FA6A4FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246648, "uuid": "1248bbbd-319d-45b8-9439-b056d49350c2", "value": "98304:ALaffAr2J+S8fQL9VibIV5xrHoQJPn4jEq:eFnK51tJnjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791246648, "uuid": "0feb34f5-a1e5-4e0d-9484-2ab1b43e8fc9", "value": 6095010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791246648, "uuid": "be49954f-9394-43ba-a351-ba0b8a6e8b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791246648, "uuid": "25bac572-6bb6-4111-920c-d79dbb8361c8", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da3c9be-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274566, "uuid": "194904f7-b74d-4d28-81a3-ab7069fa0bd9", "comment": "Malware payload", "value": "a99530c5d9e6e6af1a8b47dee2705fdf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274566, "uuid": "b4601305-1381-4edb-8348-13ea4ad595f0", "comment": "Malware payload", "value": "e9f9089a19ee00f0922f72cbc3da719b3f68aec19d0d8560c83cca3ff3957fce", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274566, "uuid": "dae1d9cc-eab8-48d9-8530-70d0c405cdd8", "comment": "Malware payload", "value": "ee48f3ea0ec1b6e6660b3f6ba3bd0a9f3a1a9bdd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274566, "uuid": "90e9438e-588b-4696-bee1-8839894337c0", "comment": "Malware payload", "value": "eae368cb7a1694a8112e6207f53c88f16587edfc3213a4c07a87faf73806fe370c01d74ccaabdf1e120fb0f94d7ce5ec", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274566, "uuid": "7b90c8db-c798-434a-b341-29a796e41e4c", "value": "T1B9A4236D921554376D67B9D0AD1D2B020A70D18932DDDBD5CE0F38A08EFACAC1EC61AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274566, "uuid": "d30c3705-ee32-47b4-94d8-4bdf55a3bcbc", "value": "12288:mW+GusvMa+4zYfcEaN9B/Jm0LU0gM7aQI:mWF/vMa0fclN9BhmSHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274566, "uuid": "ac1ceeff-29b1-4d2a-bed1-3164a5242af8", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274566, "uuid": "817bb0f7-5e28-49f2-9422-3e34b963c625", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274566, "uuid": "aa6f6a35-d9ac-4537-8c0c-d3a97d1fa304", "value": "e9f9089a19ee00f0922f72cbc3da719b3f68aec19d0d8560c83cca3ff3957fce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb42a3b6-c144-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263663, "uuid": "9bde77e9-3efa-4e60-a180-4371e006fbba", "comment": "Malware payload (Mirai)", "value": "27592d1116e36c5d4c6d2534bce370ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263663, "uuid": "40e2dc45-198f-4780-8002-493c919f45c2", "comment": "Malware payload (Mirai)", "value": "ea717c55101838b52a3938721bb65c3fb155d92a8084eb0246d773a1b1abf5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263663, "uuid": "7f6a6cb9-7f21-4842-96e0-e8c58abb4ae8", "comment": "Malware payload (Mirai)", "value": "bf92c787deb8306bfdcb8e62ac8c7100044b79a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263663, "uuid": "b13f2032-a155-4df1-89dd-4b60102dcb42", "comment": "Malware payload (Mirai)", "value": "485e2b1f594852719a2f20bc8452625634b2ab517101ff861baabb4c66f00da1e39ed272781e9505638243aa2813c156", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263663, "uuid": "6ec74af4-8b10-4a60-8102-90b5a673c84c", "value": "T1D6D308CFD8914EB6C145B975E9A62533071AF4344B0FDA8660FBEAB0424F4DE700E6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263663, "uuid": "12ff7e79-02aa-4a09-bcf2-1924bf82d0f9", "value": "3072:Wu/gHjqeUV3hdrJod9+ubjf1ZIsV/7UcKkDQJoYVfThLo5:OjqB3hVK+o/I+XKkDQJoYVfThLo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263663, "uuid": "035e5fb2-8ba9-4cf3-812c-bf5d84711083", "value": 134939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263663, "uuid": "9b213b92-4940-4ace-8d79-da3999bffc6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263663, "uuid": "005b3225-e0d1-4bf3-a9cd-d50a2350b88f", "value": "watchdogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5726698c-c15f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275065, "uuid": "7abbbfd7-6099-4c77-bd6c-395dd9398a83", "comment": "Malware payload", "value": "2f423790cdd928a128852a671f77d63f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275065, "uuid": "3fd500e9-dfa2-4801-9656-2fdaa8b56045", "comment": "Malware payload", "value": "eb324673f2903544250a1c8effe393b7603eb5891f7c58b60e0efaf3a70130f5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275065, "uuid": "e69743e9-be9b-4be6-bf0a-ffedd104eab7", "comment": "Malware payload", "value": "dab6ab4baa5f4f634e2f59b3759326f7ca918392", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275065, "uuid": "c71d7440-fbc6-46ec-b774-0cafb3c01517", "comment": "Malware payload", "value": "1283168062fb12d0c78c49932b8fd9bd57bca52a7281019ee33d9a9a3f77c8c4fa863f3461b9fa78d095127b34ef6a38", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275065, "uuid": "38cbd599-d7b7-461a-8534-dc7aed590ebe", "value": "T10CC4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275065, "uuid": "4d3b0c9b-23ea-4976-b09a-4eecbb394d1e", "value": "12288:lMU+0xq75aS9iYIp6cP/G2Bku8OtNvC28c5/VTUPkYyX:x+J71vI/GUYc5/p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275065, "uuid": "28e38e46-30bb-44f1-bde1-72605c00cb86", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275065, "uuid": "d41e11fb-ed48-4118-aac7-6eb70e7266b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275065, "uuid": "bbb62373-fd6b-42a0-9e23-ac42c13b10d8", "value": "eb324673f2903544250a1c8effe393b7603eb5891f7c58b60e0efaf3a70130f5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f75ff0-c13f-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791261181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261181, "uuid": "f442c47b-cea4-4cb0-9c9e-d18d09cea3ad", "comment": "Malware payload (ConnectWise)", "value": "960d0238a337c963c5eba8ac6010b5d8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261181, "uuid": "d21cfcff-3a67-432f-9d30-a7f752ceedf8", "comment": "Malware payload (ConnectWise)", "value": "eb33be2e48afd244b070e8738c1f46fbc3ed12fe8459b92ed80536d9fa7bc9db", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261181, "uuid": "a94dc38c-5604-47bd-89ad-dd396f315dc8", "comment": "Malware payload (ConnectWise)", "value": "51cd978219d56fe1846ebfb428f40c819daa08c9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791261181, "uuid": "3a558114-113f-4efd-bda9-cadaf1cf57e3", "comment": "Malware payload (ConnectWise)", "value": "d43fcc77cb7c369c18d8e9d3a88d2799d592d5f7b24de623382e021dc20fed9dad7deb779895357209035894a0953d83", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261181, "uuid": "f4d705d0-264e-4cdc-9be5-dfcaa921bf37", "value": "T1C446E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261181, "uuid": "0f2b98c4-4d3b-4332-88c5-2a310c081225", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261181, "uuid": "1a0e5baf-e525-493e-8085-20cda446fd8d", "value": "98304:szIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:shfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791261181, "uuid": "9c4f1797-c58f-4b32-acd9-45e4d4a35993", "value": 5658528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791261181, "uuid": "187314ce-5d1d-40c4-a70f-df613aaf6809", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791261181, "uuid": "dfaa2df4-a121-46a4-8b98-9314ff0ecf58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cefb34-c196-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791298918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298918, "uuid": "35d39f72-cf04-49f4-9606-2a51bb47031a", "comment": "Malware payload", "value": "3c19ef23dc3dec572cd6f2222dd07300", "object_relation": "md5", "Tag": [ { "name": "AntigravityAdvancedStealer", "colour": "#BE63BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298918, "uuid": "ee3a2e86-e075-407d-a845-bec041e04993", "comment": "Malware payload", "value": "eb4ec97f2b54bac88140eb4639a1674d2a1fa81f05b01b36cae58c4d46a7c158", "object_relation": "sha256", "Tag": [ { "name": "AntigravityAdvancedStealer", "colour": "#BE63BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298918, "uuid": "f524e26b-1e15-409b-94b8-a96be21a46e6", "comment": "Malware payload", "value": "458c31cc744b92b8ff154d59c77c98b85ef536e5", "object_relation": "sha1", "Tag": [ { "name": "AntigravityAdvancedStealer", "colour": "#BE63BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298918, "uuid": "c1e6b7f7-0996-421a-99aa-4225613244d9", "comment": "Malware payload", "value": "9fb7fdb2798ca333850a7b0052edf15ef1c685276b4702354df3564634dcd343462209837fdaaf2a2389ed7037fe860e", "object_relation": "sha3-384", "Tag": [ { "name": "AntigravityAdvancedStealer", "colour": "#BE63BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298918, "uuid": "2b24d442-dd56-4d73-aace-470d3f5ee5b0", "value": "T13475F146F5E442BCF03BE03AD5A7A667F67234401B3096CF27940E296FB27E0567A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298918, "uuid": "8cdedfe7-0a92-4696-84c1-3785f074a725", "value": "fd63e36e8e8d6704cb8b019a753ae9e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298918, "uuid": "0041e20e-d96c-4704-9e3c-a78ae6ab4ab2", "value": "24576:/eyFmmSVXJy3VUuh8mV0+t/x1RsSPDwcHlOdqtUSXxKQ3Yq+ojbY5KPRvj0e:/FmmSVXJy7h8mhcSPtkqttxzoHoli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298918, "uuid": "0dd6f0c6-749d-4ef9-93a0-2f86a40dff14", "value": 1590784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298918, "uuid": "7a98ef13-542f-4b51-afc9-598f8fe27bcd", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298918, "uuid": "3c880092-7d95-4092-9f27-e9ac22eceaa2", "value": "eb4ec97f2b54bac88140eb4639a1674d2a1fa81f05b01b36cae58c4d46a7c158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec668eab-c192-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791297220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297220, "uuid": "134bb8f5-e80d-4d78-8d4a-2403b8ae7a90", "comment": "Malware payload (Mirai)", "value": "c1b2843d2570b2dfd36c2d905fc06626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297220, "uuid": "60f4b560-28ad-4ce0-920c-9c2fc071338d", "comment": "Malware payload (Mirai)", "value": "ec66d0f9cf9cba5255602da1adf6dc6af35f19ee250feada07f9946f23dea998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297220, "uuid": "0307431e-d3bb-4440-ad07-18402e91f826", "comment": "Malware payload (Mirai)", "value": "223f217961163f6ec6bf1aa591afee693d09d084", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791297220, "uuid": "ef5ff537-7dbb-4a38-86f6-671aad5157ad", "comment": "Malware payload (Mirai)", "value": "7d2bde43d5029bde13c8daac0f0a60e4b2af61be9e9aedd80586c8ebdc9245b5d549ff4553cbe8236e1c9fd220b8cc28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297220, "uuid": "45d2ef5f-47f5-4068-80c2-bcaf838c7ef6", "value": "T176D46D0779F084BEC8D6C0744B9B933A9962F48B2139F58FE7CA6E817E19E90671D341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297220, "uuid": "0ef6ef54-dbc7-46d8-8ea6-0dd7b957e63a", "value": "6144:STjYqJEz0FBFHbC4Rs9TOptF9z429uI4YQ2A+6O+69J2gFM+tGBP7KSHUIyOdHqG:SwzmW7OoIs69UgFM+yHUsHqKys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791297220, "uuid": "6eb91d85-df5a-4d93-8fab-cd475fe0bb84", "value": 625384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791297220, "uuid": "bc4fc0c5-f50e-46fd-a59f-83cc23a660b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791297220, "uuid": "1aeeefbd-1f6a-4d58-be4d-7d29f312cbd6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b475c7-c162-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791276425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276425, "uuid": "bccf6cde-8823-4819-9b1b-e0865cf22070", "comment": "Malware payload", "value": "fffff288d78591c7e659961d4b2b440a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276425, "uuid": "41d20c16-2f1d-425a-b6cd-f068458abc35", "comment": "Malware payload", "value": "ecc74d9192bc71212a17498ae91e8413af4c75044e50b57d6d43dfffa8b44a22", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276425, "uuid": "9fd8fcff-0946-4600-baf5-26203704d321", "comment": "Malware payload", "value": "ac7bc876f882384daa8614ed5fcdee5bd0025647", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276425, "uuid": "1d16c63c-f0be-414b-a2a2-8d5ecae7eae2", "comment": "Malware payload", "value": "e1e391f9633580b375a9da243ae8e6a32570c4ab35b7e0b926818eeea7590a366f6cad4ce9bf58930dc6569a961af8ac", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276425, "uuid": "513c4872-badb-46cf-8557-a36360ba04fb", "value": "T1BEA4236D925554376D6779C0AD2D2B020A70D18932DDDBD5CE0F38A08EFACAC1FC616E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276425, "uuid": "1fe7cce4-fef0-4b85-97c7-8aef905969c9", "value": "12288:UW+GusvMa+0zYfcEaN9B/Jm0LU0gM7aQu:UWF/vMaAfclN9BhmSHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276425, "uuid": "3d5a1bdd-8c06-4863-a1c0-64db10569aa1", "value": 476614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276425, "uuid": "6d5fcbbf-ed90-4723-9962-ec9d3a83290e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276425, "uuid": "26974f27-263f-4ff6-9fd4-071cca67ab2f", "value": "ecc74d9192bc71212a17498ae91e8413af4c75044e50b57d6d43dfffa8b44a22.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f3d3ff-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273565, "uuid": "3425e8bb-08d7-4eea-a00b-d69468c9cc15", "comment": "Malware payload", "value": "d97932293e1592e30b707acdfe0260a6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273565, "uuid": "e1998c93-f710-4970-93a2-31615c7a98c6", "comment": "Malware payload", "value": "ecde9a93e9207518dc9ff2f54e23bcdc84b6dd96efa6477ee4a310e8c839772e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273565, "uuid": "afbcd53d-3d58-4982-94aa-38a0f60fa203", "comment": "Malware payload", "value": "6e5b51542ceaa011066818bea3eb67f38570e049", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273565, "uuid": "60aeed90-c0c3-4937-a260-99c963c49793", "comment": "Malware payload", "value": "87d76bd8d1aae3dd63942fe13cb49f138d012e6bb264cafeaf14ede916ba7e19ad42140b7ebeb51f651aae537d87ec8b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273565, "uuid": "8b4f7dca-3f43-4798-a4ac-6c351f05b711", "value": "T14AA4239581B983533484E3B5497B1AEA5F301CF28D3D674F88DAC5F81B74E8887EA252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273565, "uuid": "b0f30946-7d15-40f9-8785-8d659eaaf53a", "value": "12288:XcwSCDe0U+m1V6ECbniSPfS3e2R3feeintFckj:HDe0wUTiSWzeeij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273565, "uuid": "b16f56b7-f8a2-4566-9159-34070f9ba522", "value": 486704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273565, "uuid": "6876bbdc-a40a-474a-aa8f-31d5eea27964", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273565, "uuid": "4f659df3-ae50-4790-84a3-438d90349784", "value": "ecde9a93e9207518dc9ff2f54e23bcdc84b6dd96efa6477ee4a310e8c839772e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eac5c95-c15c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791273762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273762, "uuid": "ca7cec53-bd60-48ba-8e45-44393eccd5b0", "comment": "Malware payload (Mirai)", "value": "f8ade3e558794f87ef6ef0923b0357c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273762, "uuid": "4df935f1-9a4d-475c-a7a2-b66c0ac0ab2c", "comment": "Malware payload (Mirai)", "value": "ece6f4df5671938681d7c4c417cea50868317ca77b61a4f171cbe635a9b454cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273762, "uuid": "019d9070-a5cf-4e15-801c-9190c848a835", "comment": "Malware payload (Mirai)", "value": "7a6adfb6650797633ac203e34e752e1bf450c9cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273762, "uuid": "16ee7646-aee2-4c02-87c8-2b7aada74d6b", "comment": "Malware payload (Mirai)", "value": "9fb81cc0ed53c07e20b651804259a73e443f122baa540ef66aed6e960e732b52ae794f81a9dd09b044d4a108d7d52d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273762, "uuid": "48f9647d-965a-4aab-a9c5-d53a689f0676", "value": "T1DFA2E01472A32D66F3EC1C3CC9BE8357F9670BFC80F6327669455660C94D24A3E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273762, "uuid": "2e8958f7-0950-4f83-83c4-538dd87d7666", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjPgBwhymdGUop5hf:TvQn4j+ZO5fKAlx0ws3Uoz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273762, "uuid": "15bdf9bf-203b-46e1-bd48-d23afff6c539", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273762, "uuid": "cc5cf04f-05fd-465e-a211-c78ffe459b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273762, "uuid": "f37ed734-461c-4cc5-9fc6-d1236f3c9725", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286801d2-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288301, "uuid": "b559bd86-60f7-48fa-9061-54308febe2a8", "comment": "Malware payload (Mirai)", "value": "67e9579fbd97aac511568df372c1ee14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288301, "uuid": "82b92a84-2d74-46f7-a956-7569eb5c76e3", "comment": "Malware payload (Mirai)", "value": "eceb1fd1c817080cd299f2dc8c80cc87206d3ea4a9a615b4e47c75576ffdb392", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288301, "uuid": "afef9727-56e4-4ce2-87d0-9f5e862fc152", "comment": "Malware payload (Mirai)", "value": "8b208a59802a0e69a6bfb7c2c6f05d23b0102da8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288301, "uuid": "eb907d26-894a-47fd-bc31-2d939a9e7a45", "comment": "Malware payload (Mirai)", "value": "841a39d8acaa1a50f0fff78baeed9ab336a92c01b93dfe08b0c701f2ae9d45d4b7f6b77fb006acf58dd543b62da6e19a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288301, "uuid": "ba4f4c82-e3d9-47fb-b64c-7db3a8d32350", "value": "T1B3D46C56BD919B91C6D24ABBFBAE4368731757B9D2FF7007CA005FA037DA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288301, "uuid": "f5b91b08-ccfb-4aed-8152-186a7febe689", "value": "12288:Ql2RliEDC9vB2oNIlSWMOJkvSEDlxwhbvbggAW1ZrCcrDe:vRliTEoNIlSWMOJkvtmvbHCcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288301, "uuid": "0486f659-6f78-4c84-85a2-85d7464c2d08", "value": 629640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288301, "uuid": "79e5a631-a066-40bf-b82e-e7482c33d1a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288301, "uuid": "5f7a9ff5-5f1e-4b42-bfea-58addcaf7ce8", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc6f464-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250598, "uuid": "a4a3ba39-019c-487c-83f2-845a4710ce92", "comment": "Malware payload (Mirai)", "value": "6c6f6e17e1e84ab41abac321b7dcf4d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250598, "uuid": "35111a1a-7d81-4368-82a2-ad096d4eb676", "comment": "Malware payload (Mirai)", "value": "ecefb778f27ccf7e937ff5b6566891e55b71294d94acec9e97cd2c81e2a3172a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250598, "uuid": "5001c6e8-a479-47c3-ab49-8ebda2617597", "comment": "Malware payload (Mirai)", "value": "64520191e454495abbaf4a78868deaae499c856b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250598, "uuid": "72505aa8-3c35-45b0-8bcb-22600ca64b98", "comment": "Malware payload (Mirai)", "value": "64eea9008459f306f9d971aad61c550ae9e1338c8f9845896338077d38c2d54d88ba983b71c77d496ed26214195ce2d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250598, "uuid": "773e8a55-cbe5-4b98-940e-88f981b301c0", "value": "T18D630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250598, "uuid": "206bedbf-b72d-40de-a8a9-791facddaa3e", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250598, "uuid": "c4045c60-52ac-4004-a71b-c15fc6bb318c", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250598, "uuid": "b8464114-8544-4e2b-bb1f-2cf7e2ba87a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250598, "uuid": "019ef3d8-c74f-470d-966f-962177b90507", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2853a009-c177-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791285294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285294, "uuid": "f87ff1e9-a810-4b45-a14f-5f623892d7ee", "comment": "Malware payload", "value": "19a7cf32627e4817cbbd4e4e62cf31dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285294, "uuid": "fa53c844-11f8-4b37-aa49-b41d02e55864", "comment": "Malware payload", "value": "ecf7626bb18d0e2ec01af3dc0014c5659fa822ac02c14ffd3979b62f16ab21b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285294, "uuid": "58757a9d-7130-4282-8b10-b05519cf9854", "comment": "Malware payload", "value": "05191df1339c8c3770c0aaa9895a0c3b0708365d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285294, "uuid": "a4a7929e-4a10-4f5f-92bf-b42902634b69", "comment": "Malware payload", "value": "2962fcb171dfc115d79e577ba9e06b66f9efd308b35480b18ed28ee8775ac714349249ecbe8c150f0eefe01f942d38ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285294, "uuid": "7546354a-1b5b-4670-bbff-66d72090581d", "value": "T162664907ECA518E9C1AED1718AA69253BF31BC494B3063D31B50F6247F73BE0A9B9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285294, "uuid": "c23cabe2-52d2-4c91-8958-f346e5b418e4", "value": "49152:iy4zsiR9yuze3B+3xlpT1RxIkKzhx8HQ0lwO6KfP7G2bgGtsg5ZX0KHK5K2AtMPe:Rhq9p311ST0lo+XtsnAAE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791285294, "uuid": "6c69c082-4510-4221-8153-24a7948608db", "value": 6770848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791285294, "uuid": "3d503295-125a-4d58-a4f0-c4c778f45163", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285294, "uuid": "edd08f28-dcef-4d00-a55f-96f2d16debcf", "value": "agent_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96668b48-c16e-11f1-927a-4201ac107004", "comment": "Malware payload (CoinMiner)", "timestamp": 1791281613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281613, "uuid": "1129241e-0767-4937-ba2f-4b5a05ba306f", "comment": "Malware payload (CoinMiner)", "value": "2feb859f5ad6cbb84746b2be2bac7c99", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281613, "uuid": "b38a5eac-0da6-4892-b22b-10382da73a55", "comment": "Malware payload (CoinMiner)", "value": "ed554c51f7f69c2ca0e80c18d4b0e1240a33d74ba999ec9006cf5440b1f7bdb4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281613, "uuid": "6b2b8c00-e456-4c1e-b127-1dc6f51dd897", "comment": "Malware payload (CoinMiner)", "value": "e9c5434e128e8b8134ea3c80b6a54d6416d50bce", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281613, "uuid": "0f0da5cf-c9d1-4af1-8cf3-82b0400499c0", "comment": "Malware payload (CoinMiner)", "value": "4f2b1d904241e58c129a5ef9785d0b500dcd3d0d58eadbe6d97bcdbab83c720338d352cd264b7e4a36492424c92a0515", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281613, "uuid": "2e18e5ed-93df-4407-be05-af1dfe2d9cb5", "value": "T1F9223A0A6E8A4031E3904DB016B98B4E9A7D857327C5B6EBF773C5990EA5380C4126EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281613, "uuid": "c32424e2-086f-4d0f-8d77-1256661738b1", "value": "378437289ef187542ecf7e5e2c2e7cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281613, "uuid": "f8e85cf1-fc45-4397-b776-a38f2e81f3f5", "value": "96:u47u2dNoqYz/J4hz90tB2dlmDL1x+1QY/iTrJTYPFJxGE9mZ2FFhxC7tCE637l:VusoRc6tB7x+iYNPFJxTEZmFhS65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791281613, "uuid": "6409b03a-96a1-485e-998f-832ba5166dac", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791281613, "uuid": "f788eaa8-8c6b-4745-8446-0272e1dd3c9e", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281613, "uuid": "d8420e23-804a-47d8-9553-2fa2084be32e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6751b9d-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273077, "uuid": "5be179dc-a991-4a49-8214-78d71c0ffd0e", "comment": "Malware payload", "value": "d76fed66a9c63aa86adb6be3ea9405d2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273077, "uuid": "a1569aa4-869b-4d21-977c-46efeb96411a", "comment": "Malware payload", "value": "ed64da4c781f5cc39f1e8e775ea1333067a6fdfe74f0a1dea2031b13cc9462c7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273077, "uuid": "bd1b2a2f-44a6-489e-8415-3346589dd9c1", "comment": "Malware payload", "value": "18fe0a54ddcfda11ce523d757d9b9cf63b6530b9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273077, "uuid": "bf8c8106-08a9-47fd-a017-bc5cc9830c33", "comment": "Malware payload", "value": "e33ab5c1dcf86a70dc87e204a18cf4c641f77f9da4eba913687d127a6446ccf4aec281f219f65f77677d988430ded5c2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273077, "uuid": "b26b361b-245c-4b8b-8180-eb4dcf61e994", "value": "T1F0C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273077, "uuid": "0bd3313c-fe19-4e1a-9f5b-e57c156132ed", "value": "12288:z+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2bymH9I1P0QKw6FEc:z+QqldA/TSO713u7xnmH9IaQKH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273077, "uuid": "fa521d97-db38-4fce-ba5a-79192ddc1dda", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273077, "uuid": "aa225a78-8b04-4382-ac16-39e6081c6695", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273077, "uuid": "e5c79cab-45bb-4c47-aafc-2e48dece16e5", "value": "ed64da4c781f5cc39f1e8e775ea1333067a6fdfe74f0a1dea2031b13cc9462c7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c02f52-c18f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791295781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295781, "uuid": "ea99efe8-259a-4994-a0f2-4569b1d95a56", "comment": "Malware payload (Mirai)", "value": "2b87aab5acbc9690d3e8600c138b64a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295781, "uuid": "f97fc679-552c-4d1b-9c2c-d322f8beefc1", "comment": "Malware payload (Mirai)", "value": "eddcbfaf46fb99a933048d017b75a91ebc2d7f885741cc908ef1cf8874ff2dab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295781, "uuid": "5effd079-51dd-4e7c-b4aa-e647275ef7d6", "comment": "Malware payload (Mirai)", "value": "908720b7f8a13cb9b3d2f1012436db2c7f96673b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295781, "uuid": "14572143-4dc7-4891-bbb7-49fa852ff0ca", "comment": "Malware payload (Mirai)", "value": "f6371fe06b9588a509907bb5eba3274cebf4d67cbf45baf1b572f41cb8ef19070d33150986715835efdf4b24a3f43e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295781, "uuid": "e42667de-5d61-41bf-bd5a-ba63921cd16d", "value": "T1B5D44B032B2D0B83E3974CF0777707F0879A995620F9F589EA0AADC69771870625E5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295781, "uuid": "caa0e95c-64e9-4a9a-9dc5-140492bcf85e", "value": "6144:3YIxFDUmZCNxa8jZdLttz758Wwlo/vzmLx7ske8xm3lKGU5mUxiobxfv8x3JJDf/:oITU4OxayLm5s894Mfv8ZfTQuT+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295781, "uuid": "6fb160dd-071f-4169-83b3-4c7c8186f375", "value": 642384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295781, "uuid": "74d838f5-e4f0-48e9-911d-9d2cded56259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295781, "uuid": "5efb58f2-6706-46c5-ab23-55896f338053", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0506baff-c157-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271491, "uuid": "71759ec6-556c-496a-9cb7-15913fcacf61", "comment": "Malware payload", "value": "a9f5d403f5283c416d65743e265dbcdc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271491, "uuid": "0a00e90d-15b8-4f80-9a53-cf310d6d8ccc", "comment": "Malware payload", "value": "edfc6e0202e56478e18107580b29571a0480ad9a20b608472b6846ebc0fcbe10", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271491, "uuid": "ce300720-4731-401d-afbf-66bf81662a7f", "comment": "Malware payload", "value": "e402aa960d6121798fea615b1308a79b6510ec11", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271491, "uuid": "ac33eb72-1e39-4ccb-8ead-51e37b8dd589", "comment": "Malware payload", "value": "c08350ee81c6bd18e013ddd5e5b181985a383fa7f7ef66ef98b431eb8b91307121c7c1e30a543b4fcd5b5314d0225aba", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271491, "uuid": "91972ab2-365b-44b2-a7c8-4549f79f1b59", "value": "T158B4230A85D01FFF899ECB9946D4A4672FF427952F93565BC0CD20700AEA203D6EFC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271491, "uuid": "fcf52d0c-c2db-4a35-8f84-02ea8c2d8817", "value": "12288:bvOi3UDYXndLQ/jJOjB89RitlR0XjuIkVp69d3iY829uhB/bY7vPpCkI3:bWiEGnlQ/jwyil0X7kWv3icY/b9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271491, "uuid": "5b17e99b-d8d4-485b-937e-04cf48561f81", "value": 540419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271491, "uuid": "cdd6f91b-e58e-452b-9fcf-0dbb806a0593", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271491, "uuid": "c2df8940-a0a7-47a6-9fa7-479acd7d1743", "value": "edfc6e0202e56478e18107580b29571a0480ad9a20b608472b6846ebc0fcbe10.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a576bf-c1a5-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791305295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305295, "uuid": "0792f406-1a83-4272-b240-8462d1dc7ed3", "comment": "Malware payload (Mirai)", "value": "3f9b9c22951147722d98974d29786fd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305295, "uuid": "5487f415-f25e-4b1f-893f-6f82c7d73fc4", "comment": "Malware payload (Mirai)", "value": "ee297df78ae4628db0394cd190f3d3c8cc159a184f77b3d976bc1bd4931e0828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305295, "uuid": "0fbe6b95-54a8-45d5-ba8f-a9d40ad31624", "comment": "Malware payload (Mirai)", "value": "71d786a9bd7740c8dd2bb122277606fcacb234f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791305295, "uuid": "73373b96-0ab8-41c6-8c66-c28f0e378b72", "comment": "Malware payload (Mirai)", "value": "167e86eefba83f085202f65c11572a855ff05dbf0ccd7578024f54ab2858b5f15de77589f5482f32a01951dfa4b4b008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305295, "uuid": "4edb9b6f-29c2-4e6e-9817-a5e80ca0fd7f", "value": "T174C2D0336AEF38B1C2B460B6FC7886C7624F0AB965F56520724057A1DEE200356B68F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305295, "uuid": "4687e6d2-f33f-4633-8245-b906dce1c8f2", "value": "768:pjKX9vt6GqA3Q0jzV7EUyUq9bX3Bs3Uozb:pjqtBqoB7EUBSX3szb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791305295, "uuid": "d96eace9-7168-47de-b38d-9d8f9df0b043", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791305295, "uuid": "e92d4557-fb20-417b-9f85-c8b454bab253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791305295, "uuid": "92f8aa98-1685-41a6-900a-b8dafc60deb7", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc0e704-c126-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791250571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250571, "uuid": "9517003c-ef7d-4631-b2f8-d46f4f11f4ee", "comment": "Malware payload (Mirai)", "value": "8938e9967e6d20aa4057670b0cc15064", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250571, "uuid": "30b1e2e9-e319-4739-bf27-dbd78696c223", "comment": "Malware payload (Mirai)", "value": "ee6b4056fecf90a03406416ad165dec6ddbc91571962d2a6232d72a7fa85b4a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250571, "uuid": "f7ff0b3d-f9ad-4ca0-94de-b663b0f92ca4", "comment": "Malware payload (Mirai)", "value": "15c8ecce2e78539468d07b5e29ed7b081a9f686c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791250571, "uuid": "debaf4bc-54a6-4e2b-8bce-2e7f1a96864c", "comment": "Malware payload (Mirai)", "value": "43dbe66e22dd0555dac23e808b0c3009cba799c4fe019f3f9669cfd39f79e5d6d969bf50b1a9fa15d7c1d217ccd01a8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250571, "uuid": "40e54136-de65-467f-81d4-a6897802581e", "value": "T1F8330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250571, "uuid": "14806a6d-bcc5-474a-abf2-102dd75372a6", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oG4:r/hqaJMcjeqK806MHdMfQXoHuC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791250571, "uuid": "b057c4ef-e7b0-443e-a461-834f869a6ed2", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791250571, "uuid": "a6f7e498-4ec6-4c8c-84c7-945f5895afc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791250571, "uuid": "e16c41ed-bc88-44ce-8df1-5561469dce3c", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b0d9d0-c147-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791264993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264993, "uuid": "c41e0930-aee7-4856-a187-fe049066a52e", "comment": "Malware payload (Mirai)", "value": "5234a7ad6e8d22304397fdca1582ab8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264993, "uuid": "b4e7444f-dd7c-46aa-a939-3e84062af9b0", "comment": "Malware payload (Mirai)", "value": "ee8808ee50e5e7828b168daa2c7063906132e36080fa7198e4baa77353ed372e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264993, "uuid": "2f723b53-8e7a-4ab8-8d6b-8f4ba54ad7ed", "comment": "Malware payload (Mirai)", "value": "f7111d0feca89ed0a7ec6156dd880d4e0150db47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264993, "uuid": "07bc07df-08b8-4eb0-9766-ede9af6731dc", "comment": "Malware payload (Mirai)", "value": "4f0219ef8a2589eb8891a96676054070b058f2392f7f7ed2edf2d8ad75b6bf1c44ef310ac60c81d7bc93abfd63a966fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264993, "uuid": "ab6fca4a-e129-40b9-b986-64ff8f7c7ad5", "value": "T108E3C4BFE7271E23C0C51071D2E30233A5B9D67438A9D797A9D3EC692F1A98034157EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264993, "uuid": "e9a188da-01be-4743-9648-fd81af0d7870", "value": "3072:Q7BJ7+1c5NoN9CrMVt6YCDahJIY4BAhRE5:ur0Ou3bGDahJIY4BAhRE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264993, "uuid": "e9a34d78-1631-4d18-860f-b81f13f3ce1a", "value": 153328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264993, "uuid": "a5e38146-b785-40e5-87c1-0ea9b6c28f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264993, "uuid": "e97ac159-edd1-4cd9-ad27-32f7f992e980", "value": "systemd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7821b1-c155-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791270858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270858, "uuid": "501ed60a-6fc1-4aad-a504-f8e259a0a0c4", "comment": "Malware payload", "value": "c0c03074a1892d9f6cfb63756d668652", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270858, "uuid": "3e834d5c-9b66-4b27-acb1-02b2562b384e", "comment": "Malware payload", "value": "ef1cac04e9447265cd8188a2a599c697cd72ad9c66046ac8c900924bd0453c1e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270858, "uuid": "97e587a8-b44f-4eaa-bea0-ba0b73500fcd", "comment": "Malware payload", "value": "0f7ed91caf4347ceb45177f5b0eb75aabebd4966", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270858, "uuid": "13a4796a-1e38-40c3-a0db-ea909da012ff", "comment": "Malware payload", "value": "c460d46d0968a37e3f2749c2ae0d9562776f31fc4dd7fcefa29cfd9baff605aeea90f3e79937c9d14e5ba7ed68a66cdc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270858, "uuid": "b6c89c20-8e0f-4b23-8985-c12eab4fe84f", "value": "T1245533C7813C2CC44F780A976BEF855C61248EFC100218776F2685EB653F79F86B9A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270858, "uuid": "324ae62c-ae00-4033-b63c-8f3db053f1e7", "value": "24576:5pjJAtkoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRU:59GkoZ9bq+MmMEL+hcjXHC/wnwdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270858, "uuid": "bff7d3a9-de34-4d88-bc57-997bcc9b3507", "value": 1381514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270858, "uuid": "b070b829-f118-49d5-993e-39b765236306", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270858, "uuid": "fbdd98b0-f213-4971-892a-84d1798ee213", "value": "ef1cac04e9447265cd8188a2a599c697cd72ad9c66046ac8c900924bd0453c1e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe12776-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275563, "uuid": "411eda41-2ab6-431b-8205-7096ae48a50d", "comment": "Malware payload", "value": "614bb6278c61b1f4a274df28e17fcd0d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275563, "uuid": "fd43e9dc-4b45-464c-9a24-f7a189ef6586", "comment": "Malware payload", "value": "ef61ca2acd0c923c200320407268c28fbd895112c1c766b3b0ec5aea5b2dcb77", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275563, "uuid": "a9ec2088-d793-497f-a081-dc110c9fb2bb", "comment": "Malware payload", "value": "cf5f8d72a29f8a08ca1f3f98cf0516e5274636a6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275563, "uuid": "90e01363-6625-41bf-a44b-a539dcdb5150", "comment": "Malware payload", "value": "d88b1ef795a0c27b5ec40bfd6c488313140607e3163af7ca8572a034572a7fab8e665e5f6a20109399fa884124670032", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275563, "uuid": "acde3c85-ada9-40a6-a24c-0753a5e681cf", "value": "T152B433F5AC68721A176F9D13E762EBD03B7DC3AC265313C42527A2CC804B96B116E3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275563, "uuid": "f3efe21a-df8b-44de-abb1-7338c8095a62", "value": "12288:HrLZ+vPYN9Vr64fQ/IPI2si0NdqIr04rxkF56zm5vz:LLZ+vwN9Z6qQQAHi0RgUmNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275563, "uuid": "e1d8a442-336f-4ebf-8a69-301611ae13b0", "value": 538362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275563, "uuid": "dd56d9da-c9e6-47d3-8355-6127b5b28649", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275563, "uuid": "c7d2dc9f-d144-4b7b-9946-62bc34d07f6f", "value": "ef61ca2acd0c923c200320407268c28fbd895112c1c766b3b0ec5aea5b2dcb77.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f3ef2b-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275846, "uuid": "4d918cd2-35ea-483a-a03e-9520f663053e", "comment": "Malware payload", "value": "064b163ece5a131f9f3eda563b280dce", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275846, "uuid": "5d8d688f-73b5-4e7a-8a5c-80e7b4034714", "comment": "Malware payload", "value": "ef713549e052bdfe9d73ac9edc6b5dfff1b646168d4dd833ae12db82f6acb5e8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275846, "uuid": "c0501433-1cd9-4fe6-9ba2-0e800d46478d", "comment": "Malware payload", "value": "f42dc9b478f67a4ed88d59b8fbc0f906b1ca0a84", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275846, "uuid": "3d4b887c-91bf-4599-a261-3720a894c41f", "comment": "Malware payload", "value": "7e8d27e691f44a840fd80f00f078497bf6128a3350c91eab0a422607a9da041698ca7c0cd2c749c22217f7d5fd5af5b2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275846, "uuid": "ddba0e0a-16a0-4288-a3d3-c72966914a92", "value": "T17555338B817C29C44F7D0E52B6EF411C62284EFC1002097B6B6644AB753E3DBCAB599E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275846, "uuid": "acdf3ca9-2c3c-45c3-af32-495f12343ca1", "value": "24576:IoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRiI4:IoZ9bq+MmMEL+hcjXHC/wnwdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275846, "uuid": "51cb2d1c-2481-4af7-a5ad-d2db550037a8", "value": 1380594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275846, "uuid": "c0d3fce8-879c-4f0d-9d0f-3346609ad6f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275846, "uuid": "2b16133c-bc4b-4621-9c87-08d755be7921", "value": "ef713549e052bdfe9d73ac9edc6b5dfff1b646168d4dd833ae12db82f6acb5e8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71ce97f-c1ba-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791314417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791314417, "uuid": "f7bd8b55-df3e-4a34-b2bd-4c90bd38aa0a", "comment": "Malware payload (Gafgyt)", "value": "789a0450127a47c2ac1038b067ce1ff2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791314417, "uuid": "fef70a85-401d-4356-8c40-bdc81b28853c", "comment": "Malware payload (Gafgyt)", "value": "eff4cbad70d1a0cbf9c296ebb2ea16e25cf52cb961b278501081bd6a376f1652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791314417, "uuid": "8b1f6ca0-9619-46eb-96e8-ef78bc037feb", "comment": "Malware payload (Gafgyt)", "value": "67f625f223c1e66d1e4ab7f6dfb1e9c3e6ae5ea2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791314417, "uuid": "1dfd989c-7ffc-4355-94cf-42df5d698b78", "comment": "Malware payload (Gafgyt)", "value": "90fc5cbc6dbdc7f419eb0540ed82db031452d11ded1cf4b11915627cc59d4f9c1f8f09d1fe3f8b7edcb3119636342078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791314417, "uuid": "e3bc9dce-e2c2-422c-ad71-7ac23edaa666", "value": "T162E3E5CCFD54476FC2D223BAF75A42CF37261A789797B32159A7E9B02BC17481D281A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791314417, "uuid": "0f67ae4a-1f96-4397-9382-c0a0c41c480c", "value": "3072:PklRIBGM3+mgYwGMyMRgi8KGqiPc+k3WL7tX8h3GbF2lLothTpKkUiHbEBy84cdf:4i7EIxcDI935bInx0DhT0Qs8RT57g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791314417, "uuid": "a2d18f69-0fa7-4fe2-bd04-96794586e847", "value": 155410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791314417, "uuid": "938e8473-889c-440d-a65c-3113182dec0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791314417, "uuid": "f991edbb-4d1f-42cc-bded-a67578f1e877", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160c3941-c19e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791302014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302014, "uuid": "717f34b2-6a84-47bd-bb42-a217378b6cf4", "comment": "Malware payload", "value": "f3b3f9d0a0f2ecdc0c0431a385b7686c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302014, "uuid": "b04b83a6-bbdb-4d11-aaa4-db047fddb30e", "comment": "Malware payload", "value": "eff698ca129ed39bcd9de237ea9965ed674569107e7f172dade6bf4625cfbc36", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302014, "uuid": "553dbcc1-cc27-48b0-aa6c-7fd361c0b2f3", "comment": "Malware payload", "value": "2934c8ae46837193bc81675516106c0ecc2d67aa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302014, "uuid": "d75929d5-3359-41fc-a73d-1aa3da986db0", "comment": "Malware payload", "value": "264a7fe4be010a4389dfb547da85fd45e6f2f40ecd000b2c0eca5c52a636e3b062c86d0e8d348de965ba36c410d2b75e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302014, "uuid": "b94e6c17-8788-4fef-a2ec-e8a4cf0f39e8", "value": "T1D617331B887288B2FD13E3B2E2E17DD56FE981D228C7213404FF7E5625A65F85A1DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302014, "uuid": "9a3f28c0-f468-4e10-b273-d465c1c19d72", "value": "393216:ih/bJItZHu8FAFX2L9qQGH19SJUEP4z55LnnOi7o9qaGu0LKOaXt7eYkVWWk:A/V63FA2LDGHqsN57G9qu0LKpAnEWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791302014, "uuid": "3311f425-ed8b-49e3-9f97-ddaebfc148f4", "value": 18792109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791302014, "uuid": "4f12fff5-cf08-4490-88c1-82961805d2dc", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302014, "uuid": "fef4d129-efd2-4a71-b1bb-14b22934fe69", "value": "ZyronClientCRACK.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f41aa5-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274521, "uuid": "f13a3777-46d2-48c0-bfec-d339f25f7a5e", "comment": "Malware payload", "value": "d62dc664e4c10b232408bb56324640ef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274521, "uuid": "510f8ea0-aa0a-44c2-9bb6-24a9f7a7b379", "comment": "Malware payload", "value": "f01c789737aa6a0a17a0817ae23769a0df8ceb28d37b7f5f29a732830146f2e1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274521, "uuid": "4229fc2d-60ba-4aa2-abc3-0ad214af07ff", "comment": "Malware payload", "value": "cdf38fff1e79941f09aab5796d3429ca29291a9a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274521, "uuid": "82a53ef3-f674-4fe7-8a62-e661105e7f0b", "comment": "Malware payload", "value": "0b16fb87fd07d9877c41ca952b09a73982316c8f5b9490629b7c533ca581752b68723eef95a0b80c90fc76827a09577e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274521, "uuid": "1cb00f56-d68a-4efe-8521-ad1b3599d56a", "value": "T1CEA42394C1B857962448E3F9017F19AE1F302CB6CA3DA78E941FD6E84B64B8CD3E6057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274521, "uuid": "5868cc60-e2c5-41d5-8caf-36b6a8234c7e", "value": "12288:+SCDe0U+m1V6ECbniSPfS3e2R3feeintFck+TsuC8hHk:+De0wUTiSWzeeiGsP8dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274521, "uuid": "d1983e8d-214a-4ad9-a3f5-0c55c763c927", "value": 487683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274521, "uuid": "50072d9d-c145-4ab0-827d-65a370fe018b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274521, "uuid": "5a82bd9e-acba-4d38-8e06-b30d3e21b236", "value": "f01c789737aa6a0a17a0817ae23769a0df8ceb28d37b7f5f29a732830146f2e1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328d2ab6-c15e-11f1-927a-4201ac107004", "comment": "Malware payload (WannaCry)", "timestamp": 1791274574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274574, "uuid": "c35d6da4-8d1b-4dd6-aa63-43e6a69f7220", "comment": "Malware payload (WannaCry)", "value": "8240919c6c1723113f8db83d8dffcba3", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274574, "uuid": "1909a394-6a0d-430e-b16a-989e63ebc35a", "comment": "Malware payload (WannaCry)", "value": "f08f76ee0bc11c6383b83b70fb86dccd7668b76e17450d42453942b8fc148dea", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274574, "uuid": "e333ab52-4aba-49c5-b1e3-4e7d903e9ea7", "comment": "Malware payload (WannaCry)", "value": "e086c103ab4532878e0bd48c9165914ed8515356", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274574, "uuid": "7623e152-a3cd-464d-8b85-52149dda339b", "comment": "Malware payload (WannaCry)", "value": "41e2866c6fc43ee794323f61850dd98d802816b3ab8e3a6301c307b8c68a0845b3db4255fb7d5b1099e1975f748b3e20", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274574, "uuid": "97e4e497-3e74-46ff-9b00-18c47de08459", "value": "T16636C0037285C065D4280639CC6BCAFC65A3BC95FE2D910B3ED67F0F7973A85AA51B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274574, "uuid": "216e6c11-b61e-4249-8782-b6333b46ea6a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274574, "uuid": "7733737a-9f08-491a-baa8-d27e25b60c2f", "value": "49152:jnXnjQqMSPbcBVQej/hIN3rHV7YoG/QC51plAH:DX8qPoBhzha9YodKp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274574, "uuid": "b03ab8bd-c291-447e-965d-84af5bb137b5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274574, "uuid": "a26d9610-0a7b-47b0-8cd5-6a567fb8cac7", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274574, "uuid": "c7771374-4cfe-403c-976e-65f8f849db6d", "value": "f08f76ee0bc11c6383b83b70fb86dccd7668b76e17450d42453942b8fc148dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6804d33e-c16d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791281106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281106, "uuid": "020e8edc-0610-4108-b03c-13f3093d470c", "comment": "Malware payload", "value": "977451ce759112925bb90a824c8879d6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281106, "uuid": "99bcf16c-49da-4211-b35e-71a873792424", "comment": "Malware payload", "value": "f0aa95e0c712a1cc9a8733562b0a59bb907bbda06cdb896d42b3c4f4f01537ea", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281106, "uuid": "29f54a53-1f66-4548-a164-046a5947c197", "comment": "Malware payload", "value": "c34bc342fa4e0a605bbf93a42f5f193067c1fd43", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281106, "uuid": "deab8820-57f2-4ac1-aa27-a9cd0e27b34c", "comment": "Malware payload", "value": "0d3c3e57f3b8ce13904f56e94940cbea932fc3e1fc4e08ff35f7b04e0d953303a65f80c5a7018a92f1db1c6ed012d3be", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281106, "uuid": "f295e1ac-5513-4265-ad28-b9325abe3bf1", "value": "T14EC5D1877DD8D87AFA4BD8330161A0793D184B68D0057C17397419AB98B2D8D1F2ABFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281106, "uuid": "d36962ea-b7d3-4925-9815-1a83d4dd0ee4", "value": "49152:pBoWnJJ26bex0iEsqijWYcm53ZrclkdSp8nOgeezyd5z8cJ1SBF7zm3Wb1Dtd:DoWJ0fxrRWoJHdS+OUuixPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791281106, "uuid": "c281d5b0-856a-4de5-9a58-07e9ef6ca008", "value": 2735125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791281106, "uuid": "5c6e07fe-baa1-4932-a3c5-5bc4be02dc1c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281106, "uuid": "54166fb4-300c-43c5-8598-6591e2e170de", "value": "AloticRSPS.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a88079-c163-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791276760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276760, "uuid": "978447a0-1ac9-40ef-849a-1cc8c5b78970", "comment": "Malware payload (AgentTesla)", "value": "70f89a44e7bf77fde724f52a8a36cf4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276760, "uuid": "2345c9a8-3931-4655-a2d2-3c045f4d2c45", "comment": "Malware payload (AgentTesla)", "value": "f11e3c6bc6b46f1b03732719e6422c762536e813be0d2827bbca041c84406410", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276760, "uuid": "353401a7-cc33-4d2d-aa82-b17ba40f35a5", "comment": "Malware payload (AgentTesla)", "value": "2d392c4d8f00996a0181c8f3e8c48a522898de3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791276760, "uuid": "704d56fd-667f-4620-a75f-d1547d26645c", "comment": "Malware payload (AgentTesla)", "value": "af823b6e5c81800804cf85c60002c8c9c43c216a799ed8b22795bb6b0a85c70a18bc2f6e0daa6f2ebdb08d2c3e42c8fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276760, "uuid": "fbb3dd0c-3dae-4f98-a34d-3e239625f5ca", "value": "T1BDE4E1F40958F69E0D9CF227A74B4A06F4731BF1F64CCE4092C7D68692648DAE5F0CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276760, "uuid": "a0f5161e-b1e1-4758-b2f8-a8b998be676d", "value": "12288:D4KIe5eHxRRuZnhKCxKf2SX/vxV7e1S6nDpETd67jp1MDrAMKbwjw7:bIAWxmZhRY/r7J6DpgsXMD+wjw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791276760, "uuid": "4a7d5bb0-442a-46b1-87eb-3522f75c337d", "value": 707973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791276760, "uuid": "ebf74bf5-ec29-4ee5-af38-87d2da32ebd2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791276760, "uuid": "5ee43062-b762-4aba-bbbb-d43ea508fda8", "value": "SOA 7105298330.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f31cb11-c156-11f1-927a-4201ac107004", "comment": "Malware payload (RevStealer)", "timestamp": 1791271159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271159, "uuid": "536dc622-7a09-4730-bdc2-78ec6ac3f9cd", "comment": "Malware payload (RevStealer)", "value": "29edbb113a824210409cf41619959db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271159, "uuid": "74c185b5-8106-459b-95a8-b8bd45f746a7", "comment": "Malware payload (RevStealer)", "value": "f19a811deb8f1af8d6b3b6b922b5bc90e64fe7bf246206bb061aa89572bf5828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271159, "uuid": "fbc1c757-4a60-4874-a79a-f323629839b5", "comment": "Malware payload (RevStealer)", "value": "b21256437427af45b36270ff26c8e075af34c9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271159, "uuid": "de6c54bc-5e97-4448-bc3c-0eca1044950e", "comment": "Malware payload (RevStealer)", "value": "9f0681a13c456354181517781c3b2caf9bd170f5cfb4387b97b1d87943fa499fea34cae4fffab934a3a6e11a767f1e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271159, "uuid": "95c32c42-f3f3-43e1-933a-7402d3f78f49", "value": "T104D523D9A9B629B0D873C3B18F86E07DB12EF7980AA09F9771CD5C108DA36056C36774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271159, "uuid": "dbb37682-40fa-44b8-b5a6-9170be8e5d44", "value": "f6ce08c0cf7798e8b58a99c4c1552f29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271159, "uuid": "d27142b6-ed4b-45f1-87eb-156bf4af6a9c", "value": "49152:toVLHy4/Do8yTrCm9XIdJUcY6mnQpFgwhBS3sABkdY/u5rBisJMgJeKh1dQI8:GVLHy4LYnCYXIdJJY6mn6FgEB8ZBOsum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271159, "uuid": "4fd3abf8-d029-4d34-ae74-122f9f771b4f", "value": 2908672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271159, "uuid": "e043992a-e468-4c0b-80ea-4895bbb6cd8d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271159, "uuid": "8e609926-812b-423b-ae21-2cb1595deb2a", "value": "6eq5gvOfRvNmCi54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87098531-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791273427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273427, "uuid": "a0d21b04-8516-45a6-9958-d3ebd5208fe6", "comment": "Malware payload (AsyncRAT)", "value": "45c672e8f8940339bac971529c541958", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273427, "uuid": "f819d74b-7f80-4c9f-9711-1b7b15214b93", "comment": "Malware payload (AsyncRAT)", "value": "f297af58ee4523452773eb7a18943f1634103e39d100cc2128aeb51039130eed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273427, "uuid": "693e65f4-d64e-4332-b3aa-03998ebedca5", "comment": "Malware payload (AsyncRAT)", "value": "f3b2695c0ae277926ee73c2a79aeeab7f5bcf58e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273427, "uuid": "97b2fb61-c447-4174-a508-34fd0ebcafed", "comment": "Malware payload (AsyncRAT)", "value": "77399604d3e00052672c9a255ffaf9e1cfcae52199af23325d9e5ca9531ac2e0627c251c593b657588bfd268ffa2eaa6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273427, "uuid": "81e5514f-2a5c-4476-83cc-2bf77fbe3844", "value": "T1C136506EF0D16ACC5C8456A93951D87F63DDF9BC1B3098D3E02AB12CA9CB1F58902D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273427, "uuid": "ea65f259-fb3e-4caa-a6fd-ef451fdca315", "value": "384:BLeY0/EVppE+nbDn0awYdfKUsr1boQiNgRK700jXaPB42fc0fI28wFuZiUzc2WJy:0JPhOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273427, "uuid": "77c7c950-70b1-401b-9f3c-56373476346f", "value": 4897038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273427, "uuid": "78e04f59-47bd-4a61-af3e-80c97bad6621", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273427, "uuid": "356ee3cf-d46a-4be4-ae72-1d4dcc20640d", "value": "New Vendor Application Form-Ver 2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af6353f-c15d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274105, "uuid": "7a8b2696-edaa-4ced-9e02-86ae331b27ff", "comment": "Malware payload", "value": "7dab3ed377f4deb0f35c880f01a28075", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274105, "uuid": "2ae4264c-5ff7-4a0b-9d31-2e9ce6b779d7", "comment": "Malware payload", "value": "f302a2fee559d8812231d090205f7c05834e645500dc383718cb3a7648063e4c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274105, "uuid": "9c86023f-f58b-4563-9b9d-d2254938bc6e", "comment": "Malware payload", "value": "f61bfdaea25bcc8fb5ae1cce8623b2aa0c039f1e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274105, "uuid": "9e340f46-3984-441d-9661-db7242f37473", "comment": "Malware payload", "value": "e77cc58300b633a58a2c01ab9cb1763a4c96b2700b3afe9614773a4ba7e194685e030fcb87c310987b033b3ffe3806c7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274105, "uuid": "6d5d57d9-83eb-4369-a5e4-ee141de0dd90", "value": "T156553386817C2CC48F7D066677BF955CB2244EFC200204776A6B4867213F6AF8B7995F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274105, "uuid": "35eb9eb6-4d66-4a14-994f-a15596c6b814", "value": "24576:goZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR26WAoMnCP7:goZ9bq+MmMEL+hcjXHC/wnwdMAoMn07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274105, "uuid": "7ac4737d-246d-4162-857a-c95e1f528373", "value": 1380820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274105, "uuid": "e7dbebe4-62c2-4323-b27c-ce50a143e216", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274105, "uuid": "467981b4-09d7-465b-b317-4ac44939d59a", "value": "f302a2fee559d8812231d090205f7c05834e645500dc383718cb3a7648063e4c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d4f5d5-c196-11f1-927a-4201ac107004", "comment": "Malware payload (VantaRAT)", "timestamp": 1791298932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298932, "uuid": "7d531774-f732-48f3-b371-dada1a855dd6", "comment": "Malware payload (VantaRAT)", "value": "805836d85d002b708ac1693c1117f863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298932, "uuid": "ad75546a-f4c9-4ad6-a4eb-6a6dc1f3e9a7", "comment": "Malware payload (VantaRAT)", "value": "f3cdb85bf342b4efd4abf22ccaeb3cec511b5f6fe7bb9e4f1b9461f090425971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298932, "uuid": "f3a5eff4-148a-4fbb-a799-230cf1b51e16", "comment": "Malware payload (VantaRAT)", "value": "514e1f8c11ddd9625e0aba2a21f4790381b79b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791298932, "uuid": "8f37b838-18dd-438d-86b7-1337f4018595", "comment": "Malware payload (VantaRAT)", "value": "074acef27f853966d181ddc3922de16265606e4fd15046e98fdd661f70f48ea99c75da5e6f187b0a10207b71b45ab628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298932, "uuid": "b0dac45c-0b2d-48b4-94e7-3ee43c384642", "value": "T1E0658F1BA2B540FCC0A7D274CA075907EBB2744503399AEB56D0CE662F23EE15F7A724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298932, "uuid": "dcc6feb1-cda6-4c35-9b66-ba338cc1f835", "value": "602206ca91caf0719f705b6759ddc216", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298932, "uuid": "73ced847-f177-46f6-be09-2b8ce642c2f8", "value": "24576:85RlObGN1evygzJC9tlLja55tzHVWGREzlDKbFHYbcZU5PF00+7ithB0eSFYepGW:85rOiN1evyd1i5tzHVWGIlDYFHYbcZUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791298932, "uuid": "445bc075-11ce-4d24-981d-e5b13af7586e", "value": 1419264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791298932, "uuid": "20ec6497-defa-42ae-8fd5-a43fb5dde4a4", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791298932, "uuid": "f1cfe8c8-d352-40c8-a4d9-585e92de3265", "value": "f3cdb85bf342b4efd4abf22ccaeb3cec511b5f6fe7bb9e4f1b9461f090425971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f6e688-c159-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272352, "uuid": "4dc68424-1560-43f8-953f-2a9869b74d57", "comment": "Malware payload", "value": "b10a19a4aabb95045d4cdb590587fc7f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272352, "uuid": "96ec5469-cb6d-4783-b3bd-e520fcf6822a", "comment": "Malware payload", "value": "f3e3e61c79ad4dab5b4806c245c616ae9dd034c71a5ecbd8306f17efc3f11e07", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272352, "uuid": "54a87312-958a-4f07-a8cb-1753c8afee74", "comment": "Malware payload", "value": "be82304fd3accce55309cd741e71fc8816a16a08", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272352, "uuid": "6bb83de8-87f6-4093-b2c1-ba12d84d1572", "comment": "Malware payload", "value": "e9b434010c0a664b72914bc8332a5edf6482741116ec9492997d61891ff0c915e4cf2aa47b0cd79f68508478571846ea", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272352, "uuid": "480352bb-d240-4be8-85e0-df6c3743e1f5", "value": "T1A25533C7813C28C44F780A97ABEF855C61248EFC10021C776F2685EB653F79F86B995A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272352, "uuid": "e8d0f2f4-1bc2-4007-a730-2320e5da80f0", "value": "24576:MpjJAtAoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR/:M9GAoZ9bq+MmMEL+hcjXHC/wnwd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272352, "uuid": "37259006-73bb-4ebe-8166-cdedc077c1bd", "value": 1381514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272352, "uuid": "b87f8f59-c9d9-4969-bd74-395ae106681d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272352, "uuid": "c6bfd891-7fd6-4aa6-a2ce-75708b3d8cfe", "value": "f3e3e61c79ad4dab5b4806c245c616ae9dd034c71a5ecbd8306f17efc3f11e07.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0fbd4a-c130-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791254940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791254940, "uuid": "1f8a395f-8d34-4955-8979-fdabae9c9783", "comment": "Malware payload", "value": "9f0408b201fb5f56c05cf1079ef7e9c4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791254940, "uuid": "cecf6c3d-aaff-4032-9018-4799fb429573", "comment": "Malware payload", "value": "f41ab7f2e25ecf5fd8136d8702edd825fba8c0881f3612699003b26df5518d65", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791254940, "uuid": "2110b3d6-24f4-4714-bbd0-065713c60963", "comment": "Malware payload", "value": "adae0da19f1d791a10315e7609b1c0833e6249e0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791254940, "uuid": "9e881fcf-ea7a-480f-8519-5b5067d48a2a", "comment": "Malware payload", "value": "e500f225989e20a0134683a3835f839b335ec0d04f6a94e00e51dbfd360a4dbf9a21179fd0ee9909c036bcab5a38f86f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791254940, "uuid": "6cf61d5a-0f62-4474-aa87-76b4ce6cc217", "value": "T173550101CF6A909AF58CEA343E365E37DE34365019446BCA63E27F999E31393F147229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791254940, "uuid": "28e8215d-f96f-4ef7-a3b0-46ce2b8fc295", "value": "24576:G/+wLbfKrXgybIHqXFkFRhSfSfB7qrBMy9IpqtL/:GxrYNFkFLpZYlL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791254940, "uuid": "062bc3b9-494d-4a9d-948d-c973c80ab9f5", "value": 1281056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791254940, "uuid": "66028940-cc13-4f97-9552-62c1f9850b77", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791254940, "uuid": "d152442b-109a-4958-a309-92ccff7fed43", "value": "macho_f41ab7f2e25e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043bf2e5-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791271919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271919, "uuid": "268da24d-46ee-4960-91c7-9e084289da8a", "comment": "Malware payload", "value": "9ebcedb802bacfddda2ff67e1da7ea3c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271919, "uuid": "39adcd37-8b2a-4524-8098-f1c46685d8aa", "comment": "Malware payload", "value": "f4890466911bda743d25dc3573e2170e783992c65b008ec5bf1f9ba1f630eee8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271919, "uuid": "192fb452-40fc-49d0-af5e-a6f80c650bff", "comment": "Malware payload", "value": "d7a04f415c452f04dcea43de8837d498c5ce262f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791271919, "uuid": "22aadca8-c72f-42e7-8334-b953aa86a66c", "comment": "Malware payload", "value": "a2bc147913e4c79473e08a86fba43e31b2cfa6aa4067f785f12af33777bb8498b8007e78f2f345ac50c2015dfdad87ba", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271919, "uuid": "458df43b-e910-4efc-95e9-b107d6e0cad8", "value": "T158B423CE5A286CAC5BE85E834F5DBFDA2CF8413F862411F3F3581A14D4C956672A810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271919, "uuid": "73a5c2a2-2bf0-42fa-b942-da5c6288a2da", "value": "12288:BGRl4nbDDGIabs/7iiEVwYg2l3/2NHHy+wK8t:tTabs/7iiWw0KSxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791271919, "uuid": "d4acfa36-f19c-41da-a767-c3e9347d8baf", "value": 517076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791271919, "uuid": "f9d664aa-9227-4540-a4cd-807aac10ac43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791271919, "uuid": "21f04789-bc0f-4865-a388-5627c53a1a52", "value": "f4890466911bda743d25dc3573e2170e783992c65b008ec5bf1f9ba1f630eee8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0733c032-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275360, "uuid": "8ff3ee28-50bf-49ff-b4b3-013cb1d8c485", "comment": "Malware payload", "value": "23db5fdd0cd0017308244caa1bf86fcc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275360, "uuid": "9872d52f-ae2f-442c-9c20-77b034b8311b", "comment": "Malware payload", "value": "f51ed474f6eec27f88641519b96301468a15a56e78bc86203d2faa0c3eedf960", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275360, "uuid": "1baf98ed-6490-4faa-91aa-c61e72088ed5", "comment": "Malware payload", "value": "7120fef40e79a9fedd1b2ff7194b7fdd50a704d9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275360, "uuid": "7e88b17c-0517-44c7-af9c-81b692d37d55", "comment": "Malware payload", "value": "398c9c4a3551e297a0de5fbc6df30bdfec435c3741c7cfe8829489cc7bfd7896eb67a88e1c649d428f2bf9850a3ffee4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275360, "uuid": "caedec41-85ba-4ad6-a48e-296315a93d36", "value": "T15A553387803C29844F7F0B9BBAAF952C62158EFC10420C635B6959A7263E79FC77451F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275360, "uuid": "afe869b8-1655-45f9-9779-3c2557fab711", "value": "24576:6wzyCmwOA2oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRw:NzyCmHA2oZ9bq+MmMEL+hcjXHC/wnwdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275360, "uuid": "182d834b-c524-445b-831e-fa3c16683635", "value": 1387851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275360, "uuid": "8cf10376-9581-468e-96e1-3298076f9368", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275360, "uuid": "a5c76600-27ff-41b5-ae31-efc808b8f05c", "value": "f51ed474f6eec27f88641519b96301468a15a56e78bc86203d2faa0c3eedf960.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1af330-c182-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290109, "uuid": "621bc8be-beaa-492e-bac0-608d02e6cc3e", "comment": "Malware payload (Mirai)", "value": "377437ef0ab34ea0ecf4d417a157ce4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290109, "uuid": "36db2854-d3b0-4787-a18d-b586c7270034", "comment": "Malware payload (Mirai)", "value": "f5951581d76cf5064d2a3f589ef15da197f58fc4b93fa167192cda9412497bfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290109, "uuid": "89a32d60-9088-47cf-9068-13cbb9b2e7c5", "comment": "Malware payload (Mirai)", "value": "2795d5a53a7c36ebe47cb9a396fafc113b7c9c13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290109, "uuid": "f8c719d9-5603-4de0-ace6-05ea2c35777f", "comment": "Malware payload (Mirai)", "value": "96a2a4ed69b4b7e4877ac29beec439ae72c1d54bee71bf46eafe3f2e2d6ae9e1cec888fff514993bc537604ca8416718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290109, "uuid": "d599a837-ac7b-487f-9c1c-3df3c2ed592e", "value": "T101144C02731C0F43D1572EF02AF717F183EBE9512AA2A644F61EFE845372BB16549B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290109, "uuid": "51b55170-1d7f-4bd9-ae75-a2b96600802f", "value": "6144:e9y5e0ex+vCzmPxJrTz2DAke6IXUtj/3EXPtlr4uvk:vEw60xNTz2DE6IXUtj/3EXPtlr4uvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290109, "uuid": "f496ed05-bef0-4790-9393-944fb55d7cf5", "value": 208699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290109, "uuid": "728e4c84-2352-4657-b997-d994206ed79d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290109, "uuid": "157270f3-96aa-4ea7-8754-a647220667c5", "value": "qv3.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f09d2d-c148-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791265349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265349, "uuid": "581148f3-7e29-4769-85dc-46d319dfd051", "comment": "Malware payload (Mirai)", "value": "3aca8a0e2a1ce31cad826855ee3cebd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265349, "uuid": "2372f98f-90eb-4805-88c1-5822b2b00049", "comment": "Malware payload (Mirai)", "value": "f64e69b29a732cad6a023c77ba8dff6bd35fc0afef35364b367e6cd30f4b216b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265349, "uuid": "479e773d-5e8e-448e-aabe-273ebc9ec9d0", "comment": "Malware payload (Mirai)", "value": "204d2a2f0fd3a78f19f03e52a0dab02752093d00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265349, "uuid": "436904ec-c106-469d-9cea-757fe5a66948", "comment": "Malware payload (Mirai)", "value": "bbd395b6832f076fe9e680067ccbdc5a295f13d2eaffbfb001ad746d39bb9c7ec520797be011ebbef5b94b96f37bce15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265349, "uuid": "bd91aef6-3c51-492e-9706-72d28d86c8c5", "value": "T11BB33ACDE740D577D58319B2D29787234072EA361A1ACA05F3DBFCB4AB25184B221BED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265349, "uuid": "d1fc02d0-405f-45df-87fd-4ee483ce6232", "value": "3072:YHS9r0UVKOtvsad4m3KkXP+jZBHDaSo4XRZhSvn:9KOtvPxKC+1BHDaSo4XRZhSvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791265349, "uuid": "d08923da-cdf8-4ef5-90a2-a966ed09f719", "value": 112289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791265349, "uuid": "959ca758-8fb2-41f2-9045-6d290eee4298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265349, "uuid": "71286408-0860-4343-9606-e5d1af0a67fb", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30dc674-c179-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791286493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286493, "uuid": "90b3df7b-008d-411f-a993-09bf5659559b", "comment": "Malware payload (Mirai)", "value": "46a37e99f20c2c39a395faf423d9c4ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286493, "uuid": "1554dc41-a649-4bff-b565-c4f7aff55e2d", "comment": "Malware payload (Mirai)", "value": "f687e7d67fb6e57e6ab5fb13e8a726c449bd2a9d2d96701dbb7c4e34e3adeac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286493, "uuid": "e162d5e9-2e12-42bc-8dbc-63007306bdb2", "comment": "Malware payload (Mirai)", "value": "a89c9645096b8930da6fd48cee9911f69cfb2a69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791286493, "uuid": "67f36647-ff2a-4c12-ae13-cc2a0d147efb", "comment": "Malware payload (Mirai)", "value": "0b96278953c941a42fc0f005efd73a94ba0dcc159af47333489f53a9b7e7d3a7807ed7f6bc45e868a50d55e9a78093e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286493, "uuid": "e5ae9325-8cdf-4b36-9f27-2d11a2399333", "value": "T13DC49E009E0D6831C6C5F0BE8D4E0B91736F78AD5622C3A61E23D65CCD92BA4AF79771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286493, "uuid": "3b3869dd-b750-49b3-863f-1aa5ca90be02", "value": "6144:0ERMRmohnZQOZS2LvcmW/CSNF857nSbrGa2p+NtY82CqLMyGc7qkpGNTjbhrpYn9:gIKz0bCST8Y0p+Ntn2VMyv7qFjFCv0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791286493, "uuid": "a9d4ba84-4db8-41d8-9a6c-8d0c81bf1820", "value": 588000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791286493, "uuid": "94d448b4-c06a-4271-919d-22ec48242d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791286493, "uuid": "cfd60454-2eac-44b8-bd24-917554f1062f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b735091-c15b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273247, "uuid": "af7fe286-9af9-445f-be5e-fff9990d5fd2", "comment": "Malware payload", "value": "d476f2e6eedcdd9702f918cdd11bb467", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273247, "uuid": "aafe7b5c-b45a-4c42-98bd-0b6901c18546", "comment": "Malware payload", "value": "f6c47c0a5f6e92b82d82fcd8025512211eba757b45a0a264f51438aeeb6be8d2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273247, "uuid": "1103c233-86a4-4a3f-9ce2-9eb8c3d51c4f", "comment": "Malware payload", "value": "aab75adc0599203cf171e6125ff4f36de1b24c06", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273247, "uuid": "64d5ed42-c215-45d1-bbfa-232408afc05e", "comment": "Malware payload", "value": "4b03f0077927fc15dc4d26c1fbd8b8e4af9d622ea3c21e83f2397a26aa640a9cd9218274a259d5855f9bfe96c573c39e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273247, "uuid": "7b02a0fb-b419-48cb-bd10-757703d5608b", "value": "T13BC42304340641D5835A2B1EAEC4E7E0BEB5A0DBFA1CF940AADD7ED06DE92A177C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273247, "uuid": "219a46fe-88a5-405c-95cc-b98609875085", "value": "12288:L6wlOMWROC/FTeHo22Qm7NzofOr68mueA924EwCM:z4MQOC/gHozN7NzomW8wA9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273247, "uuid": "cc3ab7c9-a6f8-4c74-b8a4-8443ab778ac3", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273247, "uuid": "0605bf32-c543-4113-9dff-93dbc0eaf588", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273247, "uuid": "b88b871a-eba0-42f8-a73e-bbfcc560386a", "value": "f6c47c0a5f6e92b82d82fcd8025512211eba757b45a0a264f51438aeeb6be8d2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c1df42-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791273341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273341, "uuid": "5ce7151c-89ee-4230-8d25-8a831d369660", "comment": "Malware payload (AgentTesla)", "value": "6d69abad8fa068db74dcbbe0000647ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273341, "uuid": "640c2c9f-deef-4ddf-a1a7-795587c8ae51", "comment": "Malware payload (AgentTesla)", "value": "f6dbff36a90643835171b21c02ffc255575cdd161d6a4b71a81a7f3eee95c687", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273341, "uuid": "fce0c5d3-db86-4eb4-9f4a-8bc265608a41", "comment": "Malware payload (AgentTesla)", "value": "2dd8aaf476df63d16109bc2b82d26a139b333808", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273341, "uuid": "71eb9b92-3cfa-4f02-81e6-759d1256da3c", "comment": "Malware payload (AgentTesla)", "value": "80e04bd3c7f330397d51977f058fc737a963babc846d7d24f3da13ce4088376dd7728c4330a6ee4117ec0e4642f223b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273341, "uuid": "174c77fb-52ff-4cd1-93a2-bd0010a026d6", "value": "T1C0B21E44099178845373ABBEBB1B98E8FB77056B01948407B86CB851AFF2D1CDEE4DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273341, "uuid": "2d91a6f3-7835-43a9-bf24-6ab8ea2ce45a", "value": "768:PQ6X6RylvbR2XO1fl1HYwtXwwVeraTP7idghCPxm7wtjf1MPjXvcUsarQCP0s6Wg:I4VZekDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273341, "uuid": "e445281a-7a47-4168-81ea-5c9dd18f82bb", "value": 25660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273341, "uuid": "42af715a-3d36-4bcf-9942-1ec53398ea6e", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273341, "uuid": "a49f4916-b2c2-4634-8c64-a0bc6ab2f9dd", "value": "Confirmed_Order_QTY_6413620780.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28c5e0b-c15a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273071, "uuid": "43fa254a-c6d8-40d1-aec5-603555f3d9c0", "comment": "Malware payload", "value": "2194ca19a2eefdc2a5fe526b4f918ed5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273071, "uuid": "fe88e32e-e1c4-418b-a5bc-924e472dc735", "comment": "Malware payload", "value": "f735a20eb54ba2189535e5ad8c5ea8404d10ee00fb6098dc76c365c2cd5380a0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273071, "uuid": "34089bc5-b1a0-4878-8204-06097804467c", "comment": "Malware payload", "value": "933411c07c430d7e6b4868edc5b69037c6696d26", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273071, "uuid": "31655023-1f4d-44dc-839a-1e4f7dc1d697", "comment": "Malware payload", "value": "d2f28b01f98dc514569c3496b9d2f5be811954f9bd29d2431d3926c774d4f1ef582183ae0e54f71e651082bf5263aa51", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273071, "uuid": "e5da1fad-52b9-459f-9f02-9f3f389dc3d7", "value": "T14FB423CD64BED0A87B658DDA9FDCFFD30CFC403A6D7526F2A51C1A13A1C400B64A958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273071, "uuid": "c799c80a-6448-483f-b74e-5fab0e0ff5f7", "value": "12288:0B/e4pqNFTFbEXkBDoGbDDGIabs/7iiEVwYg2l3/2NyY:0Bm4pgTToGTabs/7iiWw0DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273071, "uuid": "441d3bbf-0ee7-4741-97fc-fbe56b758b60", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273071, "uuid": "7cb59693-68d3-4f4b-b156-36a58ce69304", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273071, "uuid": "9724390a-3f3e-4f89-b088-6ade1a9dc7cc", "value": "f735a20eb54ba2189535e5ad8c5ea8404d10ee00fb6098dc76c365c2cd5380a0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165a7205-c1bc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791314899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791314899, "uuid": "e50e12a2-f2e5-4173-9d97-dc7626e02a69", "comment": "Malware payload", "value": "bd882a7f7d98b668b45455ebb357532f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791314899, "uuid": "30e4d68b-e964-4923-927e-a501663641fc", "comment": "Malware payload", "value": "f7553d5037de0393da84fed09eaa9908768b91044ef42c8614a8c7efac81fe7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791314899, "uuid": "6508bc1f-58aa-4884-81c1-e43a0771863a", "comment": "Malware payload", "value": "24fc3646beaa8ed473483c40547610a8c40be66b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791314899, "uuid": "2fe8ff3d-d479-4487-aaa7-f1e938c8a1a4", "comment": "Malware payload", "value": "0c70df01930c9f38c26a6d26dd6f6da715cc199332f634d6edf43c5433ecb2fc3757a97ba6cab9992e5962f8c37aac62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791314899, "uuid": "6c5c0edb-7ac5-4dff-8876-cc79056db861", "value": "T19C48F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F63AE45E7BB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791314899, "uuid": "7cb55dbc-8606-47f9-ab12-ba076e26887e", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791314899, "uuid": "ff74967a-7eec-4d3f-833c-8f6cb20c048e", "value": "1572864:1Pp36F/iKRzyo0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZg:1PpIlyheuXpX/z/5NivOcC7hlTre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791314899, "uuid": "44829fd4-0f04-4276-94d0-2746468e18b7", "value": 116907444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791314899, "uuid": "6aedceef-5e3c-4825-bdc0-3360e420e581", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791314899, "uuid": "94613faf-6b1d-48b8-a32c-cb5baa88adf3", "value": "CS2 Aether Tool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ce0074-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303094, "uuid": "e208c532-e55b-49cf-823d-ee4b7f707bba", "comment": "Malware payload (Mirai)", "value": "38d44fbda5cc19661801b95e19de086c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303094, "uuid": "ed06bb0d-2a87-4ded-b89e-0001bc26c2cf", "comment": "Malware payload (Mirai)", "value": "f7724e6386bd8c3ef54bcd8b093ab7b40af8879ee3ec8b5fbd9a36e966790873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303094, "uuid": "80c1a1f6-c324-4bc6-8c62-24ac5dd6ec1c", "comment": "Malware payload (Mirai)", "value": "5e2925801e71e9dba4196fc677a4b2c83bacd7df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303094, "uuid": "45c51f55-c6c2-4e9e-8e45-30def2a2e34e", "comment": "Malware payload (Mirai)", "value": "3fd7cc3531ced3dec601dc025e7eea6f6e9620a2678caa0a21745fbe3b6cfed919b5ed325a608b768a9105f9ab0bcc8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303094, "uuid": "28423f1c-7e61-4434-bcc4-1bef3ea7a7fc", "value": "T165048E9CAD0EBD01C7DAE3BD8C0A8B62B03774B44325C1737D0152AED9BBDA6D5E2521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303094, "uuid": "88e133b9-3189-4d9b-9441-3d4f143452d7", "value": "3072:bg44B913uRwRLgOuPucRfI0oniKljNlHayTbD/VUOpPMoilp69KwSvvo5:044BDf1HiKl/HaIbDKOp0HpmKE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303094, "uuid": "c9c3b025-fbf6-41c9-b49b-01b187fed5f5", "value": 173808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303094, "uuid": "3ebac3ed-0d71-46ee-bc6d-77b07fec8fe0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303094, "uuid": "bf66364b-5dcb-4ce9-b1ce-5b010ea243fe", "value": "flutter.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891e6f55-c1a0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791303066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303066, "uuid": "be3c188d-bf37-40f5-8e84-345e77a95307", "comment": "Malware payload (Mirai)", "value": "dc3c555c5b7054d110da6cc1ce8dd8d0", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303066, "uuid": "ebacb875-6552-45d8-82fb-9f2a089be136", "comment": "Malware payload (Mirai)", "value": "f779453d4aae60401303368ea4805602f8428807b1d0817e2ee8409951bdcdf2", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303066, "uuid": "d88c5ee1-8452-461f-b326-bc6697c8c557", "comment": "Malware payload (Mirai)", "value": "75aba6148944c9bf0f1a34bb9a91be8319b4fec4", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791303066, "uuid": "28703806-a476-49f0-965c-38e457913bb2", "comment": "Malware payload (Mirai)", "value": "fa18bc0b7a56d51f7d27dc4caf8bd0712a9d7dd5aaf90da1a3198aee7fd9e949f2fd7c6673b57c34d735499dd5f7f5e2", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303066, "uuid": "9090f23c-0a71-4417-b1ae-edf0ed9650ef", "value": "T12D9312DE69841016F4B6FA30781503BF74D1F02D5FFCB28F17D9A42435CD2B96AAAA80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303066, "uuid": "a977bb82-c9d5-4558-9e79-12c6380e1b8e", "value": "1536:HDVkpSBnbsnpSVAS++5tqOuaqAvVMmJLTwhsIskIJmDWob2wmFC:HDV+SBn+8VAcduaqEPJLgsIYYDWobcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791303066, "uuid": "85c8b4e3-a6da-42a3-b5f2-04c71239d728", "value": 89840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791303066, "uuid": "26289488-68dd-4ca0-8872-243f11090bbb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791303066, "uuid": "d4056cbd-4c1a-472c-87f1-d3b45d415bf0", "value": "flutter.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff58586f-c160-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275777, "uuid": "a3a7bc7a-993c-4f7d-890a-69c2bfa9cf0f", "comment": "Malware payload", "value": "6754f75b199a44647dd25377dbd00e21", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275777, "uuid": "d6e9d547-5a51-4480-8bb6-a25eb4093079", "comment": "Malware payload", "value": "f806881784bbf2fcd4a1d432e13c1d484cfcc173743075ea9a3074904b6e6bac", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275777, "uuid": "e26edafe-a5db-4e9e-b1dc-4e42c9cd5f37", "comment": "Malware payload", "value": "039ce23566b400108e2fe5b4a3d8436a419eaeb1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275777, "uuid": "7f8759c2-d0e7-485c-a52f-7f568be96b96", "comment": "Malware payload", "value": "d27d137f3785f84bd18665ac19114169aecf7fd84ee15ceb54cd7ef3d1c83e954acedd539d7b07ac1c7cbd446349cff5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275777, "uuid": "8201da6e-35b3-4afd-a678-273cd3245ced", "value": "T180C423052521C0CEC3891F3E5BC0BAD06DF6509B9B48F5843ACFF91D79C0AA536E9B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275777, "uuid": "407e5fce-4c26-46ec-8100-62f6964e80d6", "value": "12288:H+CGvJAevoAVcAD6wlOMWROC/FTeHo22Qm7NzofOr/mShv:JWJR9cA74MQOC/gHozN7NzomLmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275777, "uuid": "4b510667-3f51-4dc1-9832-9cf71eadd5d3", "value": 584667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275777, "uuid": "fd8393dc-e2f5-4ff3-8a0b-968f414d9e50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275777, "uuid": "f02e9293-5ef7-4060-8a80-c53dfa4be1af", "value": "f806881784bbf2fcd4a1d432e13c1d484cfcc173743075ea9a3074904b6e6bac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66268fbe-c161-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791275949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275949, "uuid": "2d22a767-d0a0-4613-abcf-de056950ef98", "comment": "Malware payload", "value": "c4b80cb07b8e4528854554783af22551", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275949, "uuid": "1c90299f-140e-470d-af2c-3359eacfb34f", "comment": "Malware payload", "value": "f82229367d28d96e73008c6b057cb82439402571fb5f30b78139f33c824f0004", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275949, "uuid": "9df38a4c-9989-4ebc-aebe-0cfc06ab9998", "comment": "Malware payload", "value": "5e0fdd00796222eac7d0246cd36d3e7c9e9870d9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791275949, "uuid": "9ee6b9eb-4d62-4538-a975-edc2dc28211c", "comment": "Malware payload", "value": "195e100d3d6d6c0ab38bcdddca90020ee8d7545b3f5c8cf331f0e61a1b597786d1c69767db2593688ad33bcae9eda0fe", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275949, "uuid": "3762847c-21a8-4e69-9000-55d3e95b23b4", "value": "T1BAA423BCD4E40E292C9332545E642F020F10945A7BDE99D91B2F3EE8CDFEC1426E991D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275949, "uuid": "21b4e938-e75f-4a25-b813-38db1f0b24d7", "value": "12288:ezYfcEaN9B/Jm0LU0gM7aQYgf+FXUPu3vSo:FfclN9BhmSHaRFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791275949, "uuid": "81a8d2b6-4c68-40e0-94ae-5e612254d6f0", "value": 465586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791275949, "uuid": "4a7bc807-c28d-4ac1-9a32-7bcce77c6f21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791275949, "uuid": "af093bcd-8a29-4d5e-88ab-fdce439cf081", "value": "f82229367d28d96e73008c6b057cb82439402571fb5f30b78139f33c824f0004.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09310285-c19f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791302422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302422, "uuid": "b8f03e45-c0c6-4d27-bfd9-f4bf6e969eeb", "comment": "Malware payload (Mirai)", "value": "f2e37cfa1bfd795f6eb93c08e6a4e7c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302422, "uuid": "0a5ea1b9-ff0b-4036-8c92-344d733dfdd2", "comment": "Malware payload (Mirai)", "value": "f83d71ed3617fa50c6cfc5dbbc2b9a3ba4c50d6011b791e07117722615d74a9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302422, "uuid": "4019895e-c7a5-45b8-9cbb-cab02f85d0a6", "comment": "Malware payload (Mirai)", "value": "ba3889b2b39fc11dcc4306d826b4c854a01edadc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791302422, "uuid": "1df255e3-6d6f-4e7f-b847-aac84ce4655c", "comment": "Malware payload (Mirai)", "value": "f6853ca2e91bbb2c1bd2131c07febd08d569e7ba0dadff7aeaf9080e2070e30fdbea9deae1edd4c6797b8b6c48948ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302422, "uuid": "38e36c22-e4c5-41ce-b26b-0c9bf72cfd2b", "value": "T16F053A076F509DF7C86BCD3306B5CB2625CCB4C332A53B6A7678DA8CBD1960746938A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302422, "uuid": "341eeed9-c0ae-4516-b040-6c75d149a379", "value": "6144:GTbAYuBAnlY441HE6jt3ucpciccR/8BmwM/RBkSrfBL37VeUPG7K09uhjuovEQ:G7sAlY4AE+tefMcSZLhmP9+juG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791302422, "uuid": "27449086-d834-45db-b8b9-66ef6c6e20a8", "value": 858584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791302422, "uuid": "00d72af2-3297-4913-93c4-8bc583e071e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791302422, "uuid": "07f6d962-8eba-43ac-a288-6edde2a19af3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b1bed4-c1bd-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791315375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791315375, "uuid": "be45a627-d51d-4c27-b109-b51f45ec1a63", "comment": "Malware payload", "value": "261927f5140fa0abe2f60d82e35211f4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791315375, "uuid": "de00663f-98c6-44fd-9ab1-ff5e690f8d1f", "comment": "Malware payload", "value": "f94c1aaa08179bda1d9a6be54cf159ee9e80a92fcd01e6a6ecf6dbf434f9513e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791315375, "uuid": "d73eae8f-983b-48c1-851e-ea4f2c44c952", "comment": "Malware payload", "value": "07343f01663ef050b87d60c2cfb7ee7f03f0a51d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791315375, "uuid": "95f9fa76-04ce-4a05-98a1-8a4b3afd9e98", "comment": "Malware payload", "value": "082fdd143aec0d6d857619b7cc78a50a560fadb5b0c66724e35207963e69d4432f5ca13066213e4aecc70741c5ac8734", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791315375, "uuid": "5c0b8f73-a445-4aae-ba0a-b8006a56ba82", "value": "T103B3F15DB16DC024D41ACC74ACC0E6EFA6133C92ED0B951B36AAF70E14BD0914E6F76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791315375, "uuid": "9446b470-7c82-4007-85a7-806f109761e0", "value": "1536:iREpq7Q9U8e1vk9HOH5o5SVRc1eHIgXYTyAOoOXH49n2qc2B:izG7eCOZo5SVu1epoTyPoqHyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791315375, "uuid": "01c0a3eb-d1ba-4a01-907a-d8c46ac86909", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791315375, "uuid": "6e2295da-0858-4682-93c4-56c01baebc9e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791315375, "uuid": "ce3b511c-ddec-4e18-9006-a553ec17baac", "value": "SecuriteInfo.com.X97M.DownLoader.2343.12252.12934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9beaa58-c15e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791274774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274774, "uuid": "7237bfc7-2082-40d9-8bcb-b6f67279e85e", "comment": "Malware payload", "value": "d03543c99e7baeb65211c7ef13edb3ab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274774, "uuid": "9b3a0bfd-815f-46f3-aa19-827e71b4386e", "comment": "Malware payload", "value": "f98e51dc19c82a35fd3e7d9629863690d85596c8ce5d3b28cb81d97a2cb1ee52", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274774, "uuid": "c114a553-1761-440b-a3b3-a8191a5fdb5d", "comment": "Malware payload", "value": "9d6d8cd994ec170fe91bb7ebda2d928ee3f5b283", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791274774, "uuid": "57b7c172-8b04-49fd-a13d-b72d93dd5677", "comment": "Malware payload", "value": "695b78be435b34176dd42fb33401b5aca94342d974eb7eda073f7b443d75a74ea8331980207432c3c1b26b0abc480769", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274774, "uuid": "ef8aa0d0-f7a9-4443-8305-9e654c669cff", "value": "T12FB423856C682B73F541F98C1AC4342CD4202C3B9AB762DC5E8844D3647FB66BD6A9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274774, "uuid": "be3dc658-f50b-40ce-bb75-eae56fe977c3", "value": "12288:3jXlNMiiXBZTvViRziobl9jcr91+rTY3r8qSfUhurk:TXR2BZj0RLbl2rKY3IR8Mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791274774, "uuid": "0b9a3374-1012-4031-999f-141de5ffe5a6", "value": 530766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791274774, "uuid": "9a71217b-bac0-4239-9a89-a3e59d6e3a19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791274774, "uuid": "5852d41b-459b-4355-8116-12b772447d28", "value": "f98e51dc19c82a35fd3e7d9629863690d85596c8ce5d3b28cb81d97a2cb1ee52.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2752c0e4-c154-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791270260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270260, "uuid": "5be5634e-db00-4860-be3e-9db2001f1868", "comment": "Malware payload (Formbook)", "value": "0709e53641829dc93945aece20e2da21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270260, "uuid": "1ec1b479-d5b9-47c0-8166-21a544c78d4e", "comment": "Malware payload (Formbook)", "value": "fa1d013f5d8f4833ca5e80b1987ce0908625fab234048fe16e293d5ccbb963fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270260, "uuid": "580e6f8d-5baa-4456-b166-ea7cd4251c32", "comment": "Malware payload (Formbook)", "value": "13e07c20dc2e25f48cb91682f2d5f97b9e398148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791270260, "uuid": "87f40cb1-2d3b-4e18-a8a0-9dc7b2485f54", "comment": "Malware payload (Formbook)", "value": "56f98ad968c06335a0cb5b683ebf68703a667beab38e84ace980cca6f9ce9c311180d1aea8043ad91d3f51d217e130f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270260, "uuid": "a5d370fd-16fb-40d8-bd96-4e904dfd2831", "value": "T152059B04221BDB23C65526B0C973E2F90374DD59ED32832F49E9BDB77F36EA0A4541A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270260, "uuid": "7a1a1e2b-a177-4e25-a8b3-5cc7fecfe54b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270260, "uuid": "a39490a1-14c8-4f34-b847-e12d9df555a1", "value": "12288:QX697n4P0onz5sVZ+vuE66oCKgQXws7toWAaD8uFYwR0Tex3DnFSA9KyR:VdEnqVzEx0w4D8uWwRuexkAXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791270260, "uuid": "37582969-2397-432c-b77d-b25be0d13137", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791270260, "uuid": "22e5411a-bf05-4aa4-9255-290bf50fc2d6", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791270260, "uuid": "621b060f-5c38-4528-8f3f-cc816899722f", "value": "neue Bestellliste.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8565e34-c1d5-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791325962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325962, "uuid": "423f7007-f08b-45b8-85b7-39454604c5ff", "comment": "Malware payload (Mirai)", "value": "06f8a7b518e0d42375db6032b9ed1fcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325962, "uuid": "a05c546b-656d-4081-9251-5aea68b2a32e", "comment": "Malware payload (Mirai)", "value": "fa2384bd1fe35beb69afa1289e4856b015a9f822c4c8fc5acfdafa82b47aa94c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325962, "uuid": "5a36e8e8-7dcc-462f-b095-cf30b1b7d644", "comment": "Malware payload (Mirai)", "value": "2280a455eb5c546370cb3a7722994c42be4ea77b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791325962, "uuid": "2bcf277c-3c44-4b12-beaa-1c8dbf07ae84", "comment": "Malware payload (Mirai)", "value": "88727dd7a097362bccd38232fa9e6dd9c74ca3e0650c2fa954a1b341f6a81856f2167fc46b4ba2c1b747f6482c6f0df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325962, "uuid": "04201074-445a-4948-bb68-d92f94d82182", "value": "T159733A91BC815B13C6D022BBFB5E428E372653A8D2EE72179D226F1137C785B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325962, "uuid": "685d9d43-7464-4a35-b9b3-c3c90cdef599", "value": "1536:7BxiqP7YhGCz7ydCjmw13t2AgPSnJz28OBngzs/h7:9xJ0rBp13wKnfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791325962, "uuid": "7e83ff77-70a5-4cbd-8768-6c56ff3e5e02", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791325962, "uuid": "54fe4786-a075-4950-b0f3-7e0252cbb880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791325962, "uuid": "d20d0ce2-70c2-4529-a32e-292724167218", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6d4ad9-c133-11f1-927a-4201ac107004", "comment": "Malware payload (Vidar)", "timestamp": 1791256203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791256203, "uuid": "05d74dfd-a455-4e40-92ef-18f509f47c4a", "comment": "Malware payload (Vidar)", "value": "f2d88aa41c35d7b0af0c79b8ef09192f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791256203, "uuid": "94a7a421-1b4b-4663-8ad8-9cc1dfcc03e6", "comment": "Malware payload (Vidar)", "value": "fa3e9bf80185c5524b3669d856f619ff94538fb71b3c56a636cc0d819e3e81a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791256203, "uuid": "8792c69d-77fd-4c18-87f6-05f6bf6ebff2", "comment": "Malware payload (Vidar)", "value": "dd05335ee340229742d27722057774380ada19c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791256203, "uuid": "91512898-47be-4c82-b5ae-a4cbfe407279", "comment": "Malware payload (Vidar)", "value": "e139ab11312a2db163265446f493df1a65837655880a554f056d552b18d42349d17c2ca93b72605a590351c3e2e5c8b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791256203, "uuid": "3f3c62c6-a516-4486-b9c2-02ebb859fcdf", "value": "T1FF565A07F9A31CA9E099A33188A79252BBB17C495B3223D72F90F7782F727C06975714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791256203, "uuid": "cb26e581-a66a-4d6e-97e3-0bf1d0d1e729", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791256203, "uuid": "2161b968-a60b-440f-bb75-fdf471486c86", "value": "49152:FFklDT/uQkck/7Tgr5jAt5mzP68YR66qUMre+iM5FOZ30TMqcuzOBexKcK9KJEIR:FCYeAizybJqxL5Fk0TMv4OCEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791256203, "uuid": "97de38b0-ef62-4827-9b03-a4226d851c9d", "value": 6328320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791256203, "uuid": "3e9473d3-2a85-4d00-9fb5-44e5adb2975b", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791256203, "uuid": "c94b11c7-dd01-4772-abd3-71261dddf3ad", "value": "fa3e9bf80185c5524b3669d856f619ff94538fb71b3c56a636cc0d819e3e81a1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02933462-c120-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791247865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247865, "uuid": "0d9a752f-b70a-4032-b4b4-ca72e51fed7d", "comment": "Malware payload", "value": "0f0cc223aee12adb3ae07ccf35323baf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247865, "uuid": "47fd528c-5ae3-4456-a58b-8ce33463b875", "comment": "Malware payload", "value": "fa74ed2f9c2bc8a4257d2de880cbf91f3a011620c165400078e667614c844501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247865, "uuid": "546690a8-868f-404d-9e01-1fc2741b684f", "comment": "Malware payload", "value": "34e2798655351eae14545dfa1592efcab09fb401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791247865, "uuid": "abfc5677-4b3b-4a16-aa06-be040792c0ea", "comment": "Malware payload", "value": "3389ef4b0d197ed465642f41d62e761b2fe803eb347bcd5d3fd9137402282ba47106b9199a2f2a649789fcf77f746a2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247865, "uuid": "9300a061-93f4-4791-9048-af87e35ebff7", "value": "T115565B13ECA915E9C0EE96318A629513BB717C894B3123D32B50F7382F77BD06AB9744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247865, "uuid": "94cd7bda-ac95-4330-86ca-86c5d451291a", "value": "49152:RgslYLo0E4udTiDXta3Eofs/oMmN1p+4y4R98WvWHXJm6zDqr/KlK1KctCs5E6:RgXL5W+YJvKgrZRE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791247865, "uuid": "44225133-a292-482c-b395-ab47aef05559", "value": 6230178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791247865, "uuid": "f9d6897d-c632-418e-9dfe-7f7e2a50a008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791247865, "uuid": "e9588e75-4208-4e50-a917-6a7fbe75e7d7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f6c1c9-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288590, "uuid": "0312da4a-53c9-4e1d-a323-9e71b670da2c", "comment": "Malware payload (Mirai)", "value": "1279d91bb5e6fcbf981a9a0d7429eefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288590, "uuid": "7950678f-9a08-4f92-9ab4-f4b246d07e32", "comment": "Malware payload (Mirai)", "value": "fbcda0a955da4f01c2a6eaaae7b58f1f806b71d080c85505177d479def10621f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288590, "uuid": "e52138af-c418-4875-9776-6e3bcdca99c7", "comment": "Malware payload (Mirai)", "value": "af629b6d0737f5569af5b6b2f908ad372848e169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288590, "uuid": "8eeb228c-9b1c-4eca-af0e-4f598d1b102f", "comment": "Malware payload (Mirai)", "value": "27dd8d50e796aee972e8f79c99dd5b4adbafdc8c4fbf540c03266bec50339b38ccd9ce465f7afb41ab834875fd7e4c09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288590, "uuid": "249974a3-eb42-45ca-98a2-d13e84a74b48", "value": "T1FA043945A656CAB3D4C30FB612A74B210633E83A1B2FDA45F32DBDB44E565D8F50932C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288590, "uuid": "faf47ad9-a27a-418b-9fe7-026f2115923f", "value": "3072:baIBs6aMyu8dU7d2oS04/ue4F63Pyt1J2mgA+0jsTJgFrwt7Lej5jby//OHK0lIA:baIBsfkxM3Pdm3+0js29wt7Lej5jby/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288590, "uuid": "8563c732-ccbe-4ee9-a73a-e8615b320ed2", "value": 186724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288590, "uuid": "c1d0b6e6-9779-4c99-b9c3-7757a22fa313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288590, "uuid": "a481a554-820b-44d4-a2cc-f80e8a9df161", "value": "qv3.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c3c60e-c16d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791281136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281136, "uuid": "38ec4056-b71b-42f3-a3a3-7e262268de84", "comment": "Malware payload", "value": "9bb7e3d3c9766cde915c5457f5791524", "object_relation": "md5", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281136, "uuid": "74cfda4f-f692-4b01-b410-631db5c1381e", "comment": "Malware payload", "value": "fbef4b812f60353df1319ec1c6a019d06ceac792be840859ec3b3d427dce1235", "object_relation": "sha256", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281136, "uuid": "63c1e7b0-d98e-4ada-92a1-b12c57038ffd", "comment": "Malware payload", "value": "29bfd00b4300376587681f9674b5791758ac7fa7", "object_relation": "sha1", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791281136, "uuid": "5a247df4-848b-40fa-9695-9d7b76c93237", "comment": "Malware payload", "value": "ebe8caa482164d3408c28daafd5d6b4f733959ef6631e32c70db3b97d1cf3e93bb4a5042ee874751b66ec3e1648d523a", "object_relation": "sha3-384", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "runelite", "colour": "#ADA192", "exportable": true, "hide_tag": false }, { "name": "runelure", "colour": "#A983C0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281136, "uuid": "1d04e096-2a58-478c-9ecb-62d21ca33707", "value": "T131C3BEA3D94D18ECCE32033DE1539965A8EE62AD680EE4A778FD204DBC1356407AF357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281136, "uuid": "e30737bf-57e8-4b95-903d-9ad9b5eecf26", "value": "1536:4tyluy36mOKUbAJy01iQz0+iwsJzd2r8bG9fsq5pRKKNT5jOT0emFJ18fMqPGA++:guuyxLJ/1i7FnWOENpOgLrvdn1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791281136, "uuid": "7e14e98d-42b6-46b8-bf89-549e6f62c7f5", "value": 126032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791281136, "uuid": "b282ab98-7865-4f9f-b4ee-d75b8bb3beae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791281136, "uuid": "ad9dcdd4-16db-4cfe-9a33-059ddf36fc57", "value": "plugins.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614ed3a9-c146-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791264344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264344, "uuid": "7b8bcf6c-ee32-4ad7-92c9-e66a21bc1930", "comment": "Malware payload", "value": "1457fdd40f949a57a644aa681a925c7d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264344, "uuid": "4806c532-0221-438b-bc2f-61be9e230125", "comment": "Malware payload", "value": "fbfc28b37223ffc003a3dfd0f36b6b60693a752ba9b1cea672d45de0bb2af408", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264344, "uuid": "61ff9a95-2990-4f80-a7a2-a494cacf108d", "comment": "Malware payload", "value": "542b39aee5b71f56ada8e88f6209cc57112e0cb0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264344, "uuid": "6d56ce8e-bb34-4533-9816-514bb3ec2580", "comment": "Malware payload", "value": "0529e5d1c9ee6d3df46f29e366b6c49a0aeace9b5da5d84a536f5408473e6c4447ac9729079916623e78096c70a978ca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264344, "uuid": "388a49b2-c2e0-4900-bea3-9322950c55c7", "value": "T1D27533075D6CE413FCB343744B8D63AACACD701A0D858A7B5E794261CD9BED80F1897A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264344, "uuid": "fb5c4dde-cf76-4361-9038-f38a568caa6a", "value": "49152:EOqmeWI/MKTLCrnhb0KASE93dYiH53GWJd:EPmeWKTLCrnhb0KDE/Yq4ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264344, "uuid": "6a4b4adc-d06b-49aa-aeee-973669be9e8a", "value": 1584681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264344, "uuid": "bf628304-85de-4301-9b51-126698f3aa7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264344, "uuid": "a77f1d68-6fbb-4e2f-adb3-b79eaedcb1f4", "value": "fbfc28b37223ffc0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d244f419-c139-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791258951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791258951, "uuid": "61231ff9-d316-4e54-b91d-fed0273d6e71", "comment": "Malware payload", "value": "cee71eda333ddc85fee949e2ab9e9802", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791258951, "uuid": "faed10a7-b453-4baa-a82a-cba0816489ff", "comment": "Malware payload", "value": "fc3f00548bda33731dfde28ae4a4ce238ee5ecb809dc98021117bee05e0025e0", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791258951, "uuid": "36caa5c9-83c1-4d85-9459-8affd55d18fa", "comment": "Malware payload", "value": "c1fbf2843fa451ffad31132ac6063d4b6b09a988", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791258951, "uuid": "40c34bf7-c4f4-4edb-8111-e67a53baf29c", "comment": "Malware payload", "value": "8b2c75c9028119a4c87a7358515305533240b55e347c6dc359a6b257311d0b44cd5a3d32d52fb894da11164e945e8b71", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791258951, "uuid": "6631a80d-f1d4-4011-9c2e-96e392f1f7d6", "value": "T14D45D03A19A536E0BF54262CF87D3B090BF020571D12114EF3AE3E459EE7E4E446B6A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791258951, "uuid": "97358abe-1544-4c88-937e-bf9cf9e6632a", "value": "24576:MjpJ1LgfYLbkghjjsATai06RACaos+kiAkLnWxdn:XgS7Au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791258951, "uuid": "2f6f0c2b-6d3a-464e-9eea-645fca981d39", "value": 1226207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791258951, "uuid": "09e7e507-a317-4d41-b3e1-375abce0207a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791258951, "uuid": "079e80bd-8196-407a-b863-15561094db54", "value": "Supply_PurchaseFiles_C58C7223.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500b65c1-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263886, "uuid": "bc775f41-72c3-4f0f-b004-7aad61a1631d", "comment": "Malware payload (Mirai)", "value": "15210be92035966e4a6864174eb3c9af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263886, "uuid": "10104451-e178-412a-a634-d9e99b664c67", "comment": "Malware payload (Mirai)", "value": "fca1b25147be9671daeb060decc08637ddae8a11ae9554ea7d155bbf9312e8c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263886, "uuid": "2559fec4-ede3-4bdf-aeab-9349989b1d9e", "comment": "Malware payload (Mirai)", "value": "4425a0734bd45c73f6d97be4847016436986a224", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263886, "uuid": "a5d71805-cca5-4e30-8d4a-d7f21f3469be", "comment": "Malware payload (Mirai)", "value": "7842282c91388e2696fa622bb814f204b6d0568ed8e94da915f091d04a447d64b6411a9746331b23ddcb78094f2cd091", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263886, "uuid": "3db6431b-59a2-40ac-aaf3-820d596c8e40", "value": "T170144C02770D4B43D14B1DF02AF717F183A7A9112AE7E644F60EFE985772E71A40AB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263886, "uuid": "843b4b12-ad5e-4c10-ba10-34d41d079c35", "value": "6144:JEAWvuxA8EhvmS8I+NDYGd6IXUtj/3EXPtlr4uvk:Jwdx8I2DYU6IXUtj/3EXPtlr4uvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263886, "uuid": "059480df-704f-4ce0-82ce-e7129c11c4a0", "value": 208783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263886, "uuid": "e7d06d30-0f27-4d3e-b9a0-03f4276e9d13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263886, "uuid": "676919d1-288d-497e-bedb-ffd0aa8747c6", "value": "qv3.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0d56b3-c18e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791295285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295285, "uuid": "2cc36e7d-8860-4aa6-8c06-5322770335df", "comment": "Malware payload", "value": "effe5f81e3e67f17022fbcc4070b6fbe", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295285, "uuid": "e15d6786-c432-4532-9efa-49529d66558a", "comment": "Malware payload", "value": "fced413a9960c7da5bc4f1e10ffb0c2898b8f053e56f0f168543265529044bd4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295285, "uuid": "4cebacba-c476-4acb-a803-986e4bd33ab5", "comment": "Malware payload", "value": "c95f2211632796ee238601c3629c504011cf3462", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791295285, "uuid": "366e7101-87e7-4835-b024-1760eb388062", "comment": "Malware payload", "value": "c339163bf90eaec1de53945d5319b946da812bd76b7869fdf8ac895a994126514331b4e6006353e925483249bcee41aa", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295285, "uuid": "aa8fe4d3-9aae-42f4-88c5-c2869b5fb9c9", "value": "T180963A73411B6B6DCBFBC7F180AD442973118D8153B74EA2A9D83D75AA9BE40F11C32A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295285, "uuid": "a9954356-9669-49ce-b157-a357f9665c3f", "value": "49152:wYiZGnbl4jBaBeSad+abPJDWJmffB/Gob2ns4YVPRqLC:H3nyjMBcFJDbf4oNmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791295285, "uuid": "93aa8138-fcbf-4070-b713-598edcc4b9e4", "value": 8841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791295285, "uuid": "8d8c420a-ce81-4dee-b9c6-14c9f9474cdb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791295285, "uuid": "162e287c-0410-4ec7-b947-c99970998b52", "value": "Electronic invoice.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e25fc95-c182-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791290082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290082, "uuid": "82a61dc1-6335-45f7-a2fa-3e981fb1d420", "comment": "Malware payload (AgentTesla)", "value": "00b61ee4c9907cb2dc9daadeacaa3e05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290082, "uuid": "6ecf3e89-5dfa-4b22-9822-ae92cdf2a835", "comment": "Malware payload (AgentTesla)", "value": "fd0d23011657d0185f6e4fb5fe57eb7894c9fc606b9ae5fc6b977efcb2ef1eeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290082, "uuid": "5ab2dc43-4f02-4848-ae92-a9be0258b81a", "comment": "Malware payload (AgentTesla)", "value": "dc1e99af1aeb99dd7366b04c12f4d8c878b3e7c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290082, "uuid": "a70e86ab-27ed-454c-a6dc-abf1194ae3fc", "comment": "Malware payload (AgentTesla)", "value": "86af8f235254df8b4a5bbe80c9295793a7804a036b977a9ece5562d5ac9d4456fd47e8003e847469c44ec12329e6351b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290082, "uuid": "974b64f3-ff0b-43cf-9fcf-f6c7031e7c81", "value": "T104340F027F88EB15E1A93E3782EF6C2453B2B4C71633C60FAF49AB5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290082, "uuid": "aaff8671-feb2-4cf3-8d07-9042996a6a12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290082, "uuid": "289298b6-3a67-454e-8dec-7ff53ba0b71f", "value": "3072:7yniyqayzRc0stgWlZ0eTHo9rG8KaG5jnTh0S0ufzz:4iyqay1/sVnsq8KaWTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290082, "uuid": "e6ef5d5e-3212-4b56-9d8e-eeae9e7a6e35", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290082, "uuid": "32b42863-a19c-4a92-b226-a239f2443dc3", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290082, "uuid": "e90e0e38-e8c4-40cb-b65c-daba29d06bf4", "value": "f45b853c-c9d3-495e-9acb-d41a4a90029f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474dfe29-c146-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791264301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264301, "uuid": "64e05655-9256-4d10-b514-de3018c21ef5", "comment": "Malware payload", "value": "581cb14d06c74898bf6e0e37f92bafef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264301, "uuid": "1f2706e0-f8c3-4826-bc5a-39255b9d4329", "comment": "Malware payload", "value": "fd2a80dc3d8012a9e1048215a440f43afbfc6d3652d1046e03508bb3bdff00f4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264301, "uuid": "b1438d10-3d0a-4b2f-ae38-366f6b756975", "comment": "Malware payload", "value": "b5fba82477f28d9866f350e45302ba08d1c61849", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791264301, "uuid": "e45dd5e9-bd15-4c52-8f8d-08819d4fe884", "comment": "Malware payload", "value": "1fd7065c352e29be30dff3ea13e09f109568dcfa72f8a5d3b4492d07ed8737f39d70f44efea9da2402565a871a623aec", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264301, "uuid": "a49c62c1-a517-4072-bd78-d10caa698b8e", "value": "T199753313996CA813FCB341744B4DA3FACAC5B01B09959A6B4D7987118D9FFC80E389F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264301, "uuid": "7de377cd-5e48-4ae2-9413-ac1c09f88525", "value": "24576:/sPsVZ4GDkq41M6FlwEgKZUwIrntFZkWp0cjTXiepO3jECdHQPYDzfPrB3pfMAWF:E4aGoq41M8lF8TZpp0YSeQ37dwwft3qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791264301, "uuid": "cd90e889-7fe7-45e2-9020-f08ca087ce8b", "value": 1584471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791264301, "uuid": "8b5a46e8-e294-49f5-b2d6-8a9362387f75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791264301, "uuid": "c8ab80e9-301d-42fb-9348-24bd8e5abcf5", "value": "fd2a80dc3d8012a9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7bcb0a-c145-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791263878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263878, "uuid": "4df085e3-dc20-4d19-8c2b-57e9de9ac213", "comment": "Malware payload (Mirai)", "value": "895bb26a73dfd4ca45c14734a3614bf3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263878, "uuid": "08f8a608-4796-4930-9bc7-7bcc8d1f16a9", "comment": "Malware payload (Mirai)", "value": "fd536d4b570565c653d6a0273aa7441dc0e181ec9c346c1ffb7398605f2befa5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263878, "uuid": "172398b9-1cdf-40a5-8409-267e6ff84f89", "comment": "Malware payload (Mirai)", "value": "0960f5043d970f42b6635e078ba92605652916f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791263878, "uuid": "027700ef-28b2-465e-9232-44ca4346cb3b", "comment": "Malware payload (Mirai)", "value": "9bf95695c70b976b96434652fc6ffa6b7cbae1638b1f0c9d8e7bb526cb3e2e782957b28b16adf79ad4ae20d9afdc9128", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263878, "uuid": "343a991d-712e-4d1e-9b3e-8626e57c476a", "value": "T183043946A656CAB3D4C30FB612A74B210633E83A1B2FDA45F32DBDB44E555D8F50932C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263878, "uuid": "b0205e6e-36ab-4c51-a566-364048623955", "value": "3072:baIBC6aMyu8dU7d2oS04/ue4F63Pyt1J2mgA+0jsTJgFrwt7Lej5jby//OHK0lIA:baIBCfkxM3Pdm3+0js29wt7Lej5jby/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791263878, "uuid": "649a8056-f237-4a53-8b05-a83f671c68b1", "value": 186724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791263878, "uuid": "3c53d613-d048-46ed-94e4-cb8f28a23566", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791263878, "uuid": "c6b33760-74fd-4157-b6df-784926f5de80", "value": "qv3.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a11396e-c14f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791268090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268090, "uuid": "fefdef02-b76b-478f-91f6-b8819d00ad26", "comment": "Malware payload", "value": "26f056b6845630e991de904651e5aebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268090, "uuid": "a946843a-57c7-4edc-93d8-5607b4673710", "comment": "Malware payload", "value": "fd5d41a8522c016b3131229352c7787830a00a383937dd884c326a728716b15a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268090, "uuid": "5dfbe3ae-826a-427b-99f9-1a7c58fc5cc2", "comment": "Malware payload", "value": "35899eb779cb103ba5a37b3a6a4343f4d4aed51e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791268090, "uuid": "84facdbe-503c-4586-a820-60c348dbbc6a", "comment": "Malware payload", "value": "32673344d23c9c1d3ce04582fa37da864e59487d8635af238ae8a5f461e07adcd9612a3ddaf159b1c72bc843a0028d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268090, "uuid": "c7bf1591-6256-4563-982d-b661cf2c7923", "value": "T129865A03ECA655E5C1AE91318A639152BB71BC490B2123D71B90FB347F77BE06EBA314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268090, "uuid": "cc8a3250-c928-4530-b833-10051932c2e9", "value": "83939d7928a3e0390512536ff80992b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268090, "uuid": "4c82c0fd-57b3-4621-8657-ab2470075216", "value": "49152:gyRBWdlxfmqkTNJuT74ZHuOlVWSuJinNTZmflV1OmIiVo684evvB5EGo/fePXvdJ:gyCbU1uVMC+vEU/vMyExwn7xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791268090, "uuid": "b99f7724-0147-4aa1-9883-dfa7be4f7ec4", "value": 8187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791268090, "uuid": "30451408-b806-48b3-a000-e06c8207d417", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791268090, "uuid": "be1e8354-9678-46df-acd9-e575874f3e8d", "value": "26f056b6845630e991de904651e5aebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cec252-c15c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791273880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273880, "uuid": "b46b9f15-64da-4e0e-8130-34413f2ef2c9", "comment": "Malware payload", "value": "6bf2b324798f70f63e238c5cd8ae4939", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273880, "uuid": "82971b80-5097-4d4f-9e77-39923f714c5b", "comment": "Malware payload", "value": "fda151637a4b285bb072c3a3266400f5ca2deccd07970d944d501e395ae4797a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273880, "uuid": "3febdb4c-d69b-4f61-a4e6-310bd2753c7d", "comment": "Malware payload", "value": "46aa065def9506ba5e243adb86ce7ea5348533ab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273880, "uuid": "0d435bda-2804-418e-b379-4684f04a8542", "comment": "Malware payload", "value": "1bdb92a41e4daac1ac11258106d02bc371733a45c2462a5bcbdb44f6eab04d5c29721fc3e3684d50c6108bf7093ef1bb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273880, "uuid": "2c38fdb5-a272-4dae-92cb-a44da945ebea", "value": "T1ABA423EC4DA10A22AC6BB604690C5F430B65D44F3BDD8DE91A0F3EA4CAD7C544AD92ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273880, "uuid": "1f2b6d17-960a-4ed3-be7e-6caa55adf5c7", "value": "12288:4zYfcEaN9B/Jm0LU0gM7aQASDbvyiXKkFfaKf:nfclN9BhmSHHaCKkxaKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273880, "uuid": "f5946666-cac0-4c49-b355-21486f52b065", "value": 462519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273880, "uuid": "50aac47b-6c5f-4f09-ac03-1470cff39b47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273880, "uuid": "0c7703ab-d18b-420a-ac48-d0f04241d120", "value": "fda151637a4b285bb072c3a3266400f5ca2deccd07970d944d501e395ae4797a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ab0c8e-c15b-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791273395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273395, "uuid": "060af001-de96-47bd-9984-baa9a0f5d320", "comment": "Malware payload (XWorm)", "value": "4393757b6d66b1d5ca4fd2689ea4d1fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273395, "uuid": "60705409-b58a-4775-87c6-78e7b916da7d", "comment": "Malware payload (XWorm)", "value": "fe0bbb78b1f52629fbdd1be72411412ced1a1ae2dd97cb16ae7199ab621fcdc7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273395, "uuid": "e6f5b4ba-56d8-496d-b176-688359453a16", "comment": "Malware payload (XWorm)", "value": "1807342b9d339eb8c135158565274531c586604d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791273395, "uuid": "e5b90f48-6941-4eeb-979d-e934ceb3c666", "comment": "Malware payload (XWorm)", "value": "a1fda69a765f29fa242b34a53eaf9ccaec68ad62841435eb89540e1b245ffc4dc5c2673e5acbcdba2810fa0806c221f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273395, "uuid": "f1c7e92d-8019-4aa6-ae75-2904ceb1a851", "value": "T125C5913C4229A6B0A62D1B9DC039591019D9324732C6EF3D31F87245B7A6B137B8F9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273395, "uuid": "6a2246ef-0b98-4465-a5a7-cddab6288c22", "value": "49152:Jfsrdim5KsVa+N6wNmwGSgKvGSR0vJQnmw6HgAwPO64PrJye:Jfsrd18sVRMwNmwGSfOS0vJQAHgAwm6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791273395, "uuid": "3a8dfaca-2105-46dd-84dd-de9b2764a24d", "value": 2531448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791273395, "uuid": "dd86d797-1c5e-4e8d-ade7-3116fb2e530e", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791273395, "uuid": "66b2aa19-0945-475d-ba71-6f36ba4885fc", "value": "RFQQ2026080900.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d908630e-c158-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791272276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272276, "uuid": "600a5c6c-b324-4e3b-a018-75328a77fe20", "comment": "Malware payload", "value": "66a6e8c4ece7c0542fb9f9a1166d5d3d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272276, "uuid": "1a9fffdc-e0f6-4c3a-b989-75caf883b549", "comment": "Malware payload", "value": "fe5dffa1d124f89cb238c87714b950c03c6210848cd64703154f8796b0913e3b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272276, "uuid": "32dea178-7ad3-4b30-ac0b-d7d26bef0d42", "comment": "Malware payload", "value": "732d483cd959881bdd025c7e5f7a0a03bc2c7b89", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791272276, "uuid": "77553dcb-d76a-402c-ae70-49ae6e46ebc8", "comment": "Malware payload", "value": "de5da025e3b9228bc22f4b70e5e67042f23e2788cb081e4a19daba286730279ba03c1f50958628d1ec10a25d9b098857", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272276, "uuid": "7d9d1613-a3f7-4591-9cba-604f16db3fae", "value": "T1F2C4238BA3FD845390BF1F58AA5BB48D091976F34722DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272276, "uuid": "1b97095d-bace-4906-8b29-88d560714e9b", "value": "12288:D+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2bygH9I1P0QKw6FE+:D+QqldA/TSO713u7xngH9IaQKHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791272276, "uuid": "3a60deee-a9b4-402f-affb-2fac74f6adfd", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791272276, "uuid": "1eb1904f-49fb-48a8-afc2-677c01aae389", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791272276, "uuid": "433f3c3f-68d0-4651-844a-55ac2812d5d0", "value": "fe5dffa1d124f89cb238c87714b950c03c6210848cd64703154f8796b0913e3b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b628f0c-c177-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791285246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285246, "uuid": "ed1ba7d9-41c6-48a0-a4af-6958006e550f", "comment": "Malware payload", "value": "fecd15c15e747486b4f07448154f09e7", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285246, "uuid": "d6c639fa-045e-478d-8d04-c072538ab868", "comment": "Malware payload", "value": "fe9414dcdf4fcb3d0224440b6c46ea23658d2a1bb7f7f6dbc621eb8b5b2e0bda", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285246, "uuid": "c77ccfcc-60ee-41c9-b33a-2ed8418a3d24", "comment": "Malware payload", "value": "5ba2a1f3df180e64d66ec733300dec2c6608da3f", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791285246, "uuid": "bfa32261-86f8-409c-8cc1-9153d58bbcc3", "comment": "Malware payload", "value": "b4add3be1e7bcebd9387a97f43952970294a83616f3d35fe73e1c97c2d3cac69e8a3cca82fd5a364abbef703589e1f78", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285246, "uuid": "f15b1fb1-6bac-4c40-93b9-f7003344796d", "value": "T11825F1008EA244D7F6CCD7302A3A9E3B8F217654888967DE66912D98DE313F3F16725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285246, "uuid": "a3a9fc71-29e5-4baa-8997-451ed0f72928", "value": "12288:nrbLCbg/CofIt12Bo2NDEV8+YlxJyUdjgFSqvCNK7KezWmYFqw752/IuNpsTamW8:rygNmlqMmJyUd8SWn253aYq3AUFk6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791285246, "uuid": "86fab7f5-6e1d-464d-8833-f2e69df34303", "value": 972432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791285246, "uuid": "f4aa54c2-3503-492e-8ba5-a228d7d6bad7", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791285246, "uuid": "530f87c1-9b00-46fb-bd6d-a1f8a49096fe", "value": "fe9414dcdf4fcb3d0224440b6c46ea23658d2a1bb7f7f6dbc621eb8b5b2e0bda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cb639e-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288595, "uuid": "aa18379c-3728-4f56-8cbe-9e0a51a2cc66", "comment": "Malware payload (Mirai)", "value": "0d3c55d6550f70fa9b5e414ae5a81130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288595, "uuid": "33b22448-a2ea-4cb1-af7f-fd585a125d4c", "comment": "Malware payload (Mirai)", "value": "fe96cfedc05ae4e0971e5511db0d04ef45d25a40f59b7e5145a0c213d2418da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288595, "uuid": "1b33f22e-8065-4556-9ec0-abbb8635b183", "comment": "Malware payload (Mirai)", "value": "035ffea6094bd15a73b566136d6c3fa14b2f34f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288595, "uuid": "204d4a31-078f-44a0-af6f-75d00edb61ef", "comment": "Malware payload (Mirai)", "value": "61749d7ef239b4ddbbd1ef5969c6822a2e5cb7e992cadc855079a98fa4991b8c928f88116bc29c5fbaa53aa3c6ac252b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288595, "uuid": "bef97332-c591-4289-838f-419c21701805", "value": "T14BC47C07AAF7D9B6F4A340B1115217B94963C936257BD98BDBD61CA0DE201C0E32D3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288595, "uuid": "4427721c-4528-48a9-8bef-9cbfaa40a035", "value": "6144:Lx7+OzaKq0PVKzVqnSh0IPyuubrcSYdsxgj3KvPy9I9i+B0Jke:sOOB0PAzkwjudYdWgGMRAMke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288595, "uuid": "14ee9b95-61f2-4d10-a2fd-42bb2e2c583c", "value": 579512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288595, "uuid": "9078d58b-e39f-4cd8-a6a6-2da093a9d6d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288595, "uuid": "b8cc7068-2624-4c8f-939a-9f802b739ab6", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9658e24c-c149-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791265722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265722, "uuid": "245cd28c-a25f-4eaf-8a0c-bfc88e44371e", "comment": "Malware payload (Mirai)", "value": "d86eb45aad73ac88aa5de1e98d2fbc52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265722, "uuid": "55421c34-cdaa-4048-8530-5fc3ea834c9b", "comment": "Malware payload (Mirai)", "value": "ff101756d6d494cc8f670ed6578f438cd520c05b8e27b74053d350afdf7e8a00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265722, "uuid": "425b87de-837f-4a4f-a158-76549d3a9767", "comment": "Malware payload (Mirai)", "value": "88bccb808eb6bf9e07440fa987bc54610bd9ca8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791265722, "uuid": "2ed391c3-3154-4cc6-a54b-5964f3175d02", "comment": "Malware payload (Mirai)", "value": "d4dadb7075bddbc84a4ff6dd501b19b58d02fdd4faecd3f50c5fc7d1259db24cbaea20188528e98a9f9b03a11084b1cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265722, "uuid": "3d28b20f-ffbf-4740-ae03-fa63b9262ce6", "value": "T1DEB46B22E836AF49C122E5B4F871CB781F527C6459472EE9E0A3DAB8C153DC9F6143B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265722, "uuid": "8db6c245-8109-4742-ab79-63a5600ab0ed", "value": "12288:2UOwgCQyHXWBRnuYNp5YLNly7ujfxSwbByEX9MJoD1TekXvYFt2Qcr:bOWQyYvklHjfxdByE/H41c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791265722, "uuid": "1bf44b4b-79f9-43ca-a6d4-c682d41441a7", "value": 518432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791265722, "uuid": "8722bd50-23dd-4cc3-893f-19cfa0da7472", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791265722, "uuid": "c1e798ef-8030-4444-884f-4a0e47df63b0", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ccdf66-c17e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791288583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288583, "uuid": "3c500ada-df4c-46fb-adf8-7ce6423fd2ca", "comment": "Malware payload (Mirai)", "value": "2e4ddb5853d416d4768b21b835bcc3bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288583, "uuid": "88eec70c-bf2b-49ff-94c7-337feb520736", "comment": "Malware payload (Mirai)", "value": "ff6043d165e0e55b8109ee48cc263af090000aedc9565704e1e63649444a91af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288583, "uuid": "7ce3e3df-5329-4cea-9e39-b95f4bec5d0f", "comment": "Malware payload (Mirai)", "value": "0d300bfa7380f97563ec88f03d9e24f311f37f61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791288583, "uuid": "e8ed589f-ced7-4c95-b643-6136ef172249", "comment": "Malware payload (Mirai)", "value": "b2d63ee6a4af317d8c9e26b6d62080de09ccfc1e4c5f3eb57f89bd94862ee998b5ecb50713e3a333e289ba7bc13edce8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288583, "uuid": "e339eca5-0ede-466b-be73-f8d0ca08c8e9", "value": "T1B4C49E2399766F95C4B7C1B4B4B08F780F12A88642E76EAED5A6CDD18547CC0F62C3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288583, "uuid": "1175f931-6797-415e-a040-d68d345a3765", "value": "12288:r67uUGL7KvNjXWNQzFdWHgjWP2Rephm90AZ:rNDPYBvFd7WM0m90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791288583, "uuid": "159e693f-674f-41ca-855e-d55a0feaf3a2", "value": 589832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791288583, "uuid": "01209a7d-7f69-4905-a565-b63fa3fc7a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791288583, "uuid": "75e47a74-002f-4860-a358-672ee974d52f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9bfcf6-c183-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791290432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290432, "uuid": "e60e5dc6-9ac1-4444-a240-63529a768a14", "comment": "Malware payload (Mirai)", "value": "db3820eb1e4262e77da61c6ac104ebf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290432, "uuid": "6d818ae4-2855-4408-8535-5dcd6bd96ec6", "comment": "Malware payload (Mirai)", "value": "ff69fca7a790d5be2615fb6dacfaf5af9ffa212fc2fa07fe8b2975a1cca45972", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290432, "uuid": "1d9a330d-dfaa-4946-8b38-801045834169", "comment": "Malware payload (Mirai)", "value": "23cee40617ae9ac956afaf5f1b5763a63d264d43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791290432, "uuid": "ad311aad-4d74-42b3-8e47-90e102e738e9", "comment": "Malware payload (Mirai)", "value": "7883a3fbe0299fd1fc048de9df97b786f2a8acdb052eadc4302e4104b2b39c90e09e31073ec5a7356521d2598caf6b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290432, "uuid": "fdfe8ffe-9927-476e-86fb-1129808406a7", "value": "T113D44A03272D0F83E3A75DF0777717F083EAA89621F5E588EA0B69C69271970618D5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290432, "uuid": "2856a14e-2f44-4816-ba4b-1f873b6c2662", "value": "6144:FISPA5aykl2Tyx6x+pVn1ZAQHASIlo/ei8sn/WmQw9OoCHUyobxfIxaQh6ijvmkX:FI+AoykUyIM/w9oO4c6imkurC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791290432, "uuid": "723e9808-5a86-4b56-8b7e-d80f38d3be8e", "value": 642256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791290432, "uuid": "2e326d3a-72a7-4877-bc09-015e3c18c6ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791290432, "uuid": "090a7e0d-9421-4a7c-a972-2858f62463af", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfeb2e13-c198-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791299776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299776, "uuid": "51bf439f-1981-494c-9bf9-5ea90e24674b", "comment": "Malware payload (XWorm)", "value": "4c3747305b868bc35cdc0c06783c2414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299776, "uuid": "ec0f445d-9399-40b6-a9a9-09a55616e175", "comment": "Malware payload (XWorm)", "value": "ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299776, "uuid": "5023e4c9-6a82-4142-beaf-944c34e6d34a", "comment": "Malware payload (XWorm)", "value": "ea45acf7b04e2c0c2e350bbe6eec7e949b16ea16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791299776, "uuid": "be1807a3-f909-466b-a961-2a7abebff9f8", "comment": "Malware payload (XWorm)", "value": "1de8e76da2ebc59c1e07c8f4d033b571decabc8fd17f80e6593bd0363930b31a2d85b6037fa204287cb3556274007b99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299776, "uuid": "738f17ee-2133-4bbd-89d4-f34be1b4f187", "value": "T119F24D083BD44225D6FF7FFA59B371021670F9079913EB8D4CD89AAA6F27BC045143AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299776, "uuid": "751add97-c181-4006-b37d-c51319a316d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299776, "uuid": "5a758359-f634-4ccb-93f7-5a62431914b1", "value": "768:sLJau6SW06XPdxcOMqbFJ9YRaOMhr3xzC:slautWzXFVMuFJ9YRaOMdZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791299776, "uuid": "f7e94002-064c-4e00-8b0e-1d22cb79781a", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791299776, "uuid": "39c9cc82-6672-4bea-b6ff-c132a87d6924", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791299776, "uuid": "7b2d24cc-83eb-4166-a6d4-a2a992b1500e", "value": "Aakdhfi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }