{ "Event": { "published": true, "date": "2025-11-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-29", "timestamp": 1764460982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c4eb42e6-61b8-4504-ac1c-4bbc583adae1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20918e70-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764459345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459345, "uuid": "1769ea7e-89be-4ce2-a450-bf1a259994c4", "comment": "Malware payload (Mirai)", "value": "bf576931f7b015f2f251927bb23b5aa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459345, "uuid": "c393e899-3e33-4a4f-ab21-cb821bee6e32", "comment": "Malware payload (Mirai)", "value": "01beab3ce8117c67f118172d13126e51ee4c4287aaec94d0675870585f407539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459345, "uuid": "62b24034-40ec-490b-bbf1-5d67e3bff4c5", "comment": "Malware payload (Mirai)", "value": "3a9f3f8ff868adaadd9de1b8f8674edd00a77e6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459345, "uuid": "f9ef3266-bf09-4e21-bef7-ecf463f39eff", "comment": "Malware payload (Mirai)", "value": "43b98bf0a87a50b65ee90e06fc49572505ecb5ae2f4e844829da7b9f6b2547d703829c2f4ae4c4735691cf71500d0b3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459345, "uuid": "51bcae0e-5b18-4907-aef4-4d0dde5d21d4", "value": "T176C33ADAF802DD3CF80BD6B644634D0EB921E3A156835F26225BFD93AD331A4B813D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459345, "uuid": "19e9175a-ce63-4ffc-8204-706addd731f4", "value": "3072:N7wLf5ESlkpq2sL3XunXVhxNAp47Zt4gBl:of5nlkCeXVrNHZt4gBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459345, "uuid": "dbf5bda3-24a3-495b-9fc6-e9a01f0a23fc", "value": 118676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459345, "uuid": "3103030e-75ce-4017-a6fb-4664731170da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459345, "uuid": "48d4b100-41da-483e-8ce2-37761fc6e50d", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc30bd01-cce7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764395718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395718, "uuid": "9f09c215-906c-447e-861f-4171a2c2b74a", "comment": "Malware payload (Mirai)", "value": "11ee463accda4ea9a8053c0318a39d93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395718, "uuid": "b769f084-1376-4088-9cdc-4b8859068d3c", "comment": "Malware payload (Mirai)", "value": "026455ff533d1afe87e46694ce5700ae933bc0c4d116600bfe0b6a0bc4587b68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395718, "uuid": "cf0932c5-01f5-43fb-81bd-05278fc25836", "comment": "Malware payload (Mirai)", "value": "5c9a04e66926199b5fdd81ec526efabe2d8bdba4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395718, "uuid": "391d366a-f3a9-4878-b680-42ec8806e1ea", "comment": "Malware payload (Mirai)", "value": "a444b18ded23285d0b7c151df55749d023f7feba7f0cfa030c7ac413d89e903b1115d36e54bb58fdffa08a5897c74993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395718, "uuid": "06cc1cfc-4cad-4e1b-b9e8-df71def9e66e", "value": "T159A35AC5F283D1F5DD56013210B6F7BB5A72F1751238DA43C7A5CA32AC22E41E60ABAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395718, "uuid": "426b527e-2902-481b-9c7d-b0d4b5ba3f7d", "value": "3072:x2NVrkhL0bC1McOYxuuuNVGsF3uGul+FDO6OUBT:x2NVrkhobCn3uuuD31NFhOUBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764395718, "uuid": "95da70fb-d9ae-414b-95c6-3a28896474cd", "value": 100016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764395718, "uuid": "3c0d97e4-ca95-4f0f-9228-69a6f6179ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395718, "uuid": "43d05577-35e9-4bb7-a3d8-2b6b5aac6c48", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd452e2b-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409786, "uuid": "5d59060b-ee72-437b-8a51-5948ad0030ac", "comment": "Malware payload (Mirai)", "value": "c41df0f73ebf67d1e3087992902c76bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409786, "uuid": "ed5a572f-855b-4e49-9a9d-3beed8de8b98", "comment": "Malware payload (Mirai)", "value": "02cb9570a733fd0117ec91f59428a0971eea9ff279f80c529bfc923927a6973e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409786, "uuid": "25e95980-ab72-4779-aa33-caaa27162225", "comment": "Malware payload (Mirai)", "value": "1e24dc3de8b30ef7ac687a840e51e3c5b71c3f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409786, "uuid": "8c8657c7-39b7-4513-aa53-82b11eefab9d", "comment": "Malware payload (Mirai)", "value": "8a7b9090737c1b8372c32b620d14082e084976108df8154476c208c2ea4da1bd76fc8c699843d505fadb3355def1a7cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409786, "uuid": "d1b855f7-0cf5-4e49-84bb-9d07d2b9501f", "value": "T1C403E9A569898D2EC5D4133AB1BE03AD3310A7E5D2CFB717C8095B543A46A6F0F73B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409786, "uuid": "0716e220-059d-4aa7-aefb-13e1c9df6e8a", "value": "768:+efTlg0W65Qqte0N7uMsLsrwdKZ7lNjK6WUp/K126UJFlzjjw2:fTlgA1te0lgQOArjGUp564nzjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409786, "uuid": "a8e4d20b-9b1a-4c1d-ab23-23d2efb4c4f4", "value": 39465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409786, "uuid": "d00f30ec-4b17-4731-8668-43f852b6b0d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409786, "uuid": "b2b6a2be-3054-4734-9e9e-7ea6d201e5d6", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb37b48-cd0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764411584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411584, "uuid": "673d15f9-702d-4644-82cc-7752de74666a", "comment": "Malware payload (Mirai)", "value": "dae1eaeca2cf312d29b93cf1a520ae5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411584, "uuid": "d5eda719-f7fe-434d-a238-50b3eba66a1b", "comment": "Malware payload (Mirai)", "value": "03489ff53ded556413da8f6742dd92cefa7023be9406b88921944e7353ab38d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411584, "uuid": "daed2371-0a3f-4672-8c40-c916e6898c2a", "comment": "Malware payload (Mirai)", "value": "f9d63e5a16f682a554ab981cbe00b3c16de0ada5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411584, "uuid": "a8b14b7e-16bf-46d4-9ffb-3c737e67ebb6", "comment": "Malware payload (Mirai)", "value": "cc15ff59da15ae5a1c710a88c7c434941743711ed2642468cfe8ab946f1de3de8e74cea2939b3c3f73c437880bf5b90e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411584, "uuid": "5748ada5-5148-4458-99d4-03c8b00799b8", "value": "T106B3AEDBF7072191C86247F007C74BDE3E6322119E6BA8E76C0F6A7A0A790DF5916391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411584, "uuid": "2dd5de7a-61ae-4280-b54e-0afae302df45", "value": "1536:eF38syuPgwHMD7qEywla4Wq0z0zkppYjjHBZibxZJ8EkgH/LWk:838syV0MfywlBtMhihZiqbgHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411584, "uuid": "e3fcee1e-c5e8-4bb5-bdb5-552fc9453a2d", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411584, "uuid": "b94a4ef3-1122-4f1d-a912-092b0c93efeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411584, "uuid": "ef25d176-dcfe-4f95-878a-6e5e0bf8b23c", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab045cd-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764443041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443041, "uuid": "c36d5f39-a66f-4ed5-b430-e7a2ef4e17ff", "comment": "Malware payload (Gafgyt)", "value": "a10098e3315fbfe6b3a140ab1e642ef6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443041, "uuid": "25a47f2b-556f-459e-9569-ca53c751debb", "comment": "Malware payload (Gafgyt)", "value": "03a1e30b7dffb0cf98d176e3a43de17def78589fab62f4518dd00cd9adfbb40b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443041, "uuid": "0032cec1-c45b-4636-bf34-4b239b00b57b", "comment": "Malware payload (Gafgyt)", "value": "200153f5a6611aea1c3e8b36830baf2d4babeb5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443041, "uuid": "a00dc52e-a9e8-4fa2-884c-096544fc82be", "comment": "Malware payload (Gafgyt)", "value": "610c1965912a638d57cd0d6c90a2d0df531fe042cbeacb5f5d3bae7935f6426968fceb50a7d274d846d1f8872d15bedb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443041, "uuid": "7eb79f22-6ab3-48eb-ba70-7e81a48c2222", "value": "T153934B17BB1D0B53C49B6AF11CAB3BF18769FAE112D26285620EAFC44733AF02911F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443041, "uuid": "c2fdf474-26e7-4f05-8694-5f6e8bcb70f3", "value": "1536:IwHJoQLXDxRX8zHcaN7IwRoCobrUgihiDmBeUmX2VMDrUuKfa5X:IQmQXxwHcaNUs5x+mBeUmX2VMDrNKfaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443041, "uuid": "ab2ce800-7aa0-4723-ae1c-d12c05ae1bac", "value": 95320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443041, "uuid": "500dbcec-f3fd-4016-8128-1b692755ad74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443041, "uuid": "3d1fa61d-5175-4d63-a35e-777495649b4b", "value": "Fantazy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d991573c-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409834, "uuid": "2c9da48a-e171-49ef-b998-65fbaec027fb", "comment": "Malware payload (Mirai)", "value": "d6a20830deab2dedc6fa3845a9b09734", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409834, "uuid": "fb6632cb-76cf-4654-8a14-b4d72fa9dc22", "comment": "Malware payload (Mirai)", "value": "03d4e2ffce136584d82bfc72a0df779fde0831f4ba168687f972760c5b118d4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409834, "uuid": "6dfdf0ea-d12f-4271-aa08-953436c3c183", "comment": "Malware payload (Mirai)", "value": "9a7ef9afa486e0fc053585628d84452a33aeced2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409834, "uuid": "77bad7c7-3fa5-4be9-866c-2ad655652920", "comment": "Malware payload (Mirai)", "value": "c79b96be54a6579357efc25526bc255782c70b0641260645fa3da4c8aa50b3d9927866f7a5c7229f4cc52ab6a65a9c8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409834, "uuid": "115b3c0f-e100-48c6-8193-969393a7f6f7", "value": "T191E3F709FB250EF7E86BCD3B09F9170528CC555722F97B3A3534D928B64B25B1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409834, "uuid": "0b663f4a-898c-4f49-8135-e275e959dd9b", "value": "3072:H4noMd/j/y3sQfOeOXzvH62DFQrhkzKe4hHl:YoMd/j/y3sQVOD95ehS4hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409834, "uuid": "9d02a4b6-ad22-4a1c-8354-10adf36c55cd", "value": 145908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409834, "uuid": "d83b2677-03b9-41ca-851f-64e85d243a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409834, "uuid": "38dfb53a-bdbd-45be-8cad-f3603d5869cb", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76f9fa3-ccdd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764391335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391335, "uuid": "c2bf7a75-49a2-4876-8787-845bd0615528", "comment": "Malware payload (Mirai)", "value": "fcd3d85845d296f15426b9f952c28f7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391335, "uuid": "d413137e-8f23-487c-b9ae-1b147e3cb7be", "comment": "Malware payload (Mirai)", "value": "03fb44bb9f6f3a31aadfe907f9a21369ddb6d04835933afb96ac3a70f49c44ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391335, "uuid": "335cd3c9-6bcc-4936-addc-98adcf244c42", "comment": "Malware payload (Mirai)", "value": "a21e4d746135c22296688d246057477ea7422b9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391335, "uuid": "5a642a67-1482-482d-9f7f-459bcae36122", "comment": "Malware payload (Mirai)", "value": "93dae80f6bbd695f63b005c7695be3be8ebd1e81aed56ce3cc210441ce220eb027aa604a2da2d28d0e5d66e2f35e20d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391335, "uuid": "1a16c4de-b737-4c98-b9a8-6209b522d595", "value": "T11A134A85A643E1F1FD6211B6213757538B77E47A1A3CEB02C3A56935FC13A10A62B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391335, "uuid": "17b11e19-5d2d-401d-9a9f-413cf3e8b52d", "value": "768:hwDLx/7gBIDg4bMO8/AX4DxVxHrPHK3gkKZTDPZ8/eYSUcIp:K/MKDg4bMO8Iw/Ji3fKZ3Pg1SUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391335, "uuid": "3d315fe6-06c3-4942-be57-bdf2bbd3d659", "value": 42128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391335, "uuid": "69e59193-0678-43ee-bdb4-adfd2785e732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391335, "uuid": "3f2d908b-bb89-4696-875f-9bc96db744a4", "value": "niggah.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3e70fd-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764412954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412954, "uuid": "b553606d-e12f-4f69-8055-8d0579ec0628", "comment": "Malware payload (ConnectWise)", "value": "31181c6d69de3b62ad467a6aca918089", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412954, "uuid": "ca7eed80-a1a0-4c56-a7a7-8bf068bbd017", "comment": "Malware payload (ConnectWise)", "value": "05d31c095c90a5c4d15544685cde3ad42437d70d78a2835c37680aba32391a7e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412954, "uuid": "05132d9b-18d3-4a5d-8ac0-90b3369b3292", "comment": "Malware payload (ConnectWise)", "value": "132218cf8ec41426c9889d60909b95bc7a0e56b4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412954, "uuid": "5d8bd88c-8ca4-466f-af50-236b2b879edc", "comment": "Malware payload (ConnectWise)", "value": "7e948f325df3bccdcee59a292c7e63c414f53f1b39b7712c9e5eec71975fc503f461d402cde3f9d5d550323ae8c215f4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412954, "uuid": "83cb86b8-7700-4a20-80cd-bf2a329761c2", "value": "T1D4A6233662E4C026E2B71E39E9794AF25939BC468913C15F533C794E68B1E81E973333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412954, "uuid": "733de372-eae6-47f0-9833-9b1305a8f9e9", "value": "196608:6+kLGB1X+Z3/7+kLGB13+kLGB1O+kLGB1:nkqBZHkqB4kqBdkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412954, "uuid": "9fb6baa4-996d-4eee-a8fb-63b58dc38b7c", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412954, "uuid": "c01cd1ba-9fec-4bbf-89f6-b1c10d083e5f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412954, "uuid": "34217d41-ec2c-4ee1-8ea0-6a81c9599fe3", "value": "Payment_Receipt_11_28_2025.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c162740-ccdd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764391101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391101, "uuid": "d8fb0d52-0e2a-42a2-8103-3d92d6874c03", "comment": "Malware payload", "value": "75f5206c5784552c74868a0a713820ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391101, "uuid": "ab36c286-faf1-4abf-9a6a-79ccd6be91e5", "comment": "Malware payload", "value": "07fb572de06b3c19441b75c23157bc0f54a63bd0618a9b4838e7d8b25736846c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391101, "uuid": "86c41caf-fd42-43b3-8aca-e0e5eaba5f8f", "comment": "Malware payload", "value": "33b1b4b8723b78c0d033e1d4a5cad25fa1980228", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391101, "uuid": "3d888ee0-9932-4448-bf1a-eb775c46444c", "comment": "Malware payload", "value": "e8fd2fc163e3a1a0bf902f4af0673d8a8834e587d01118c35a34271d6fe37b92d5e643250feea8e93b600e0e4b58d1cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391101, "uuid": "0c1428cf-1775-4838-bed8-8575c53dba34", "value": "T1BF4319EAF800EC7DFC1EE73B8457080AB130E2A905921B3663577967AC762E44977F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391101, "uuid": "8a85d95a-ce66-4070-bb64-0f4b671ef424", "value": "1536:IWMU2+29EJI3x8hKsolvS4MiZh5UrWVocqo4Q:iiJI3psyM8h2Xo4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391101, "uuid": "e5864d5a-9d11-4e3a-b091-dffa68a5ab58", "value": 57828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391101, "uuid": "c8ae4eac-a917-4f36-aa50-ec6407db1f61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391101, "uuid": "ddd502ae-8c97-45ae-b555-35d79a64f626", "value": "niggah.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa5003c-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389622, "uuid": "176f29d3-adfb-44c3-98b5-67def54176f4", "comment": "Malware payload (Mirai)", "value": "604a6b95ecc6113bb88774f6cf3fdfba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389622, "uuid": "6e4a5e4a-3a82-4867-8d66-b60937a1d069", "comment": "Malware payload (Mirai)", "value": "087361e4d823f19a32649cb56139de3ab718533990c5bf411ece2ddebf010d50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389622, "uuid": "cf1a4a21-2250-4ef9-a807-e95adfa1f294", "comment": "Malware payload (Mirai)", "value": "475ec0905acf9f1a83dcc7525c2606d6c4cae949", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389622, "uuid": "4bc37099-4963-477c-823a-8c971aa7e40c", "comment": "Malware payload (Mirai)", "value": "3af73e3852691c8387e07304cd21f40f93e28f6e309a5fa9a5fac18f7664ad9cb5bc284f81b40a051aec3b744a880361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389622, "uuid": "e81fa873-2a8b-4c0c-b9b5-1c828dd1ac31", "value": "T1E1C35A73CC657F98C654D1B0B0B08FB91F93A959814B1FBE6A66C2758087D9CF20A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389622, "uuid": "d3b927c1-e3b9-4a43-b6e7-fe59c55651ed", "value": "1536:KqJnjzFhS21M4yuRiSW0jJUCfKS/mEQ8OtJPmpJ2rWoRklrBOI1xQNI:bJnjzV1FiSW/TSmtJPmCrWCIrBpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389622, "uuid": "2c10937d-3b32-49b1-aa85-7af855c82dc2", "value": 129764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389622, "uuid": "fd473b90-a637-4f3f-ab1d-be8feea196c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389622, "uuid": "6a3564b8-094f-46cf-9d7f-a19b9f4a70b4", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e9bbf9-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389213, "uuid": "578211ea-12ad-4af3-82e6-03c3204484d1", "comment": "Malware payload (Mirai)", "value": "35e3f8ce0d25b1a3b8e2e90b938679f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389213, "uuid": "033e33bd-51f5-4728-8ae4-31a5e9c7ac07", "comment": "Malware payload (Mirai)", "value": "08dde2b08d538b279b0b863e399883ce020811a89269960fc56cfd3360f2f705", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389213, "uuid": "ed13dd41-1e79-4da1-9a54-4528e7bc370b", "comment": "Malware payload (Mirai)", "value": "9041ca3fcfa0b66aa2c72f77116dddc441736152", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389213, "uuid": "2242e02b-ff4d-4d90-81dd-0f62784a0bb3", "comment": "Malware payload (Mirai)", "value": "44db28b5296c678001df6436874a322dbad4d5745fe5d4068fd2e236e35de957560d991cd323ace9eedeb105b67011aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389213, "uuid": "f91890df-9c82-4f0f-a2a1-b4675852d364", "value": "T10AB32A46F9819F11D4C732FAFB5E514933136BB8E3EA3102DD24AF6123C699B0EB6512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389213, "uuid": "6eb6d126-2177-4e01-883a-401f32010e2e", "value": "3072:7Lt3sfvg+haSCirxFFQ36gVGrCfIW0X2y:7LUhhaSCirxFGKg6CQWc2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389213, "uuid": "c49b0020-5d08-4b0c-9d5e-a4df7da76967", "value": 111756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389213, "uuid": "26446b79-0eeb-4725-8c33-41a8bc2f6733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389213, "uuid": "e79caf13-3b1d-48b7-9363-827d7b6e65ba", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e552381-cd13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764414244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414244, "uuid": "bf7f95a0-cfce-4524-83cf-050f0502c1f4", "comment": "Malware payload (Mirai)", "value": "4b68cc41af95c5939e00e74196e8a5b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414244, "uuid": "03830266-7e05-4354-8cef-2ece972336ee", "comment": "Malware payload (Mirai)", "value": "096fcc524acbe0f6c92d89103dfba000f384798a127bd4897486271b92fd84dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414244, "uuid": "44f7c3bb-020d-4f17-9af5-c4db455944fd", "comment": "Malware payload (Mirai)", "value": "25a631941b833c9e3bef691a61c9ff08af933639", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414244, "uuid": "b2c90e3e-5ad9-4f6c-8c8f-7f0544642753", "comment": "Malware payload (Mirai)", "value": "e8326646c6b1c67f8e72c5f16f1bf4ee6db2a7038715d08349c76af77df7b1b35725b9d4485fb30f7fdda56ad46bf36e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414244, "uuid": "3f2cec32-59be-4b73-bb4e-b94ed880bced", "value": "T15DD2D0BD625041F5CA59EEB50BF807C03D350F5BB891A99139D9FCA21E860B93C325F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414244, "uuid": "e623fe19-f8f1-4967-908e-6f025172e7b2", "value": "768:0nO0BLnfQa+ZyaisAilB2qLjonuweUt070eIWJgGlzDpbuR1J0:0nOoHzsAEB2WoAm+/lVJue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764414244, "uuid": "fff010e8-9877-44c5-81c5-cdb04c7f36ad", "value": 28324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764414244, "uuid": "516b5038-d7e6-4d45-a072-15e07eca5b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414244, "uuid": "4981215f-32f2-4bf7-912e-eae3eaa1e0ba", "value": "niggah.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39654b2d-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764413001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413001, "uuid": "0f3f4e5f-d0b8-49cd-9c53-96b71f05bcc7", "comment": "Malware payload (Gafgyt)", "value": "0dddebe36827f4b319dfa0617c4bd207", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413001, "uuid": "6d09aab5-e41a-48b4-a01f-3a4fa1d83fe8", "comment": "Malware payload (Gafgyt)", "value": "09b36f58f368f6ba156e21eddb3e53aad6ce6134ba55ec332e12ff8aa352d2a2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413001, "uuid": "8be731e2-39b1-4027-a944-a5d8f7a10d45", "comment": "Malware payload (Gafgyt)", "value": "c9d8592365b84d6bc4cdfb3f9b44e69c0fe90713", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413001, "uuid": "16a22f7d-2992-4d07-b03a-eea871d2c8a1", "comment": "Malware payload (Gafgyt)", "value": "d4b2f52fe18bae9c8d5499a72233d1851b5086ad2655928b5964d6c9f82c2fdb1eb5881d83da5e0c1faa6046439e67e1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413001, "uuid": "25f8152e-8a8c-4c4e-818e-6900dd07e90f", "value": "T189B0928A103819300400A60AB2935619E120B246638E2EA08E1D111A8849F6C719394C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413001, "uuid": "e149fea2-7e2b-4cb4-a5c9-d5f7bb61db13", "value": "3:L6FBeS5SgIMxrYDOSdHY1QeW:L6FB/5h8Dr4aeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764413001, "uuid": "90171b10-37c3-4e20-8c1f-fe429161ce0b", "value": 106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764413001, "uuid": "93e42556-7aeb-4a01-8d56-86ef242e33b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413001, "uuid": "77734a08-b1cb-415f-8e62-4612cc4bc0c2", "value": "update.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b456ceb8-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389155, "uuid": "e853d999-eab1-4662-9095-6d2aa08a5405", "comment": "Malware payload (Mirai)", "value": "1233bef863c98fa69e9b511a9ce872fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389155, "uuid": "7c31f25f-5bdc-49cc-936f-1041ba2bc84b", "comment": "Malware payload (Mirai)", "value": "0a64d0a0e5b402be74f5b959223edc9dddb7a853df580f49b9e4d7d49b14e032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389155, "uuid": "e5f256d4-1a10-4329-aa85-6c3fd2685dc0", "comment": "Malware payload (Mirai)", "value": "edbdad0090905d1f63a1f86d1cd65279714c8801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389155, "uuid": "3fe11a7e-725a-4c90-9dbc-5acd22b20e4f", "comment": "Malware payload (Mirai)", "value": "557d16d50803f8bb7b5030366d1c541f5f19a82f94d40081ec1a61a70c000c34fef57c542685b3cd445be1f7363a111a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389155, "uuid": "f800aa30-1e01-4901-8d4c-e1d3d3d9a640", "value": "T1F513F13CD3566DD0C6449AB56E7E0385562C32D5B3FB28E50F9088386C6832662EAED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389155, "uuid": "ee242964-71b5-4a06-8330-b8161600f820", "value": "768:O3wnj82JCAzMR7fEL3tqjNUa0psSMoBW8aPsyqXwbnMslDPh4xVchgN9q3UELlc:ng2FMdcL0ya0ORPshXqMkbfhvLlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389155, "uuid": "067a5bd2-44db-4488-bc0f-59b9fc610ebe", "value": 42988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389155, "uuid": "6e67e988-fb8a-424a-b559-714659b9fd39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389155, "uuid": "180c9c34-bd65-4210-a0de-a2433b1181ef", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576280af-cd65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764449558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764449558, "uuid": "7455019b-3517-4b68-a06c-4ac4e4081488", "comment": "Malware payload", "value": "b7354e8b01ad3b4525ee3b83e28b546b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764449558, "uuid": "56bcf29f-2c39-4f79-a55f-279ad01f8747", "comment": "Malware payload", "value": "0c96adcaeb26b939cf068e523556e5c73324674f8ab6c8955345e9eed6e4d057", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764449558, "uuid": "a6254119-4442-483e-bc78-fdd92d6dd807", "comment": "Malware payload", "value": "f7af5cc6da17c36e6152cbe146667aabb8fce8ed", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764449558, "uuid": "05a4f378-4225-4db5-b896-4855a78826a2", "comment": "Malware payload", "value": "004d372483863604f0a0dfe53dd483696d35817754afd38f4ef4734c098711c37b7127c3c86b1b69d54fade5d800526e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764449558, "uuid": "4207b389-5903-4b57-94ba-073a7d0ad06b", "value": "T1B921A98363001F2DF2A6C75941A51F102A3D734FA6220EC4B7F869597F24704C3BAABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764449558, "uuid": "279aade0-447f-4884-b3c3-54fc1918ce83", "value": "24:QIO4tm8178Cn3rD5MGbddPBd8VQvbIozW8b+dCWvAJoJe7RWud/Bd8VQvbIozWMq:tjn7D3X8EFDr9aedN8EFjru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764449558, "uuid": "00bb8b30-623d-4766-9697-7fee18e7cf94", "value": 1354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764449558, "uuid": "407a2d38-ac70-4378-bd53-afee674c19ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764449558, "uuid": "996a67b0-99c4-4ced-8dd4-44aa36b6b9dc", "value": "system_obfuscated.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2be3bd-cd19-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764416822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416822, "uuid": "782b0252-a24b-4796-8396-37482fcb61b5", "comment": "Malware payload", "value": "7e5d2de0f8c3d5171a06a44ebc72483a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416822, "uuid": "e428ff6f-e3c3-4717-b77e-b97b3ffcddad", "comment": "Malware payload", "value": "0d1d7e555a9c17636d3d83339cf9ad9382b1bb8aa970b5509f0855afe0475b15", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416822, "uuid": "9e7a8f72-cf1e-4c0c-bfaa-6fba9bcf2f89", "comment": "Malware payload", "value": "abe7c993bd6b1a473d79bc6c58b791209bb9d594", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416822, "uuid": "a07a5958-c4d7-449b-afad-c53e81ffec33", "comment": "Malware payload", "value": "7c10d1697df45b967ee7209f36968aa684bd7f3de0bb91a53abcbdfdf7f3bc8f3890e790b0fc3c76f6af5f2c60150ec9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416822, "uuid": "65ffd0db-fdba-449a-a96d-7b68d1e2c762", "value": "T12A9533EF31B92B39E019B5FFD548648F4ED211BB74AFF9022C44526B984E9C9CD12782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416822, "uuid": "97fcd289-e0e1-464d-a0b3-8aa024de2521", "value": "e008615264ef3e8efa4c24dd01b8e9ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416822, "uuid": "a036cf91-e307-4059-94b6-ce74a5e6bad6", "value": "24576:VRhs2C/dADWnlOCarW8lykH5bSiCbBrLurRiZUrSgXAYu+UJSnvsJHUVprhnX5zd:XG2Kd+WK5Ak1DiZUrSgVvlH1XlLzzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764416822, "uuid": "57d117b4-827b-4252-a3a7-993c856eff6d", "value": 2028032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764416822, "uuid": "5a9cbba8-5c93-43c4-a307-884fb3d5c1c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416822, "uuid": "2e2f7322-3e23-4c5d-89ac-fca2938518af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0234312-cced-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764398195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398195, "uuid": "0cc9bde2-46a9-4595-9abc-fdb4849c1520", "comment": "Malware payload", "value": "827a6a456e1778e0070f529401f303dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398195, "uuid": "f073e6e3-34ca-4c36-8870-69cfa786dab3", "comment": "Malware payload", "value": "0d42b991bafe277a6ea978b2369d102f38a43312922a215a41b6664fec9a4df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398195, "uuid": "09b1ea69-e4c6-45f8-bf6a-c4eeb9f6e5c0", "comment": "Malware payload", "value": "cf5a38008738c360e7a81782e1bc63883bb1a538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398195, "uuid": "73cd20f7-a2a0-4d31-87c4-23de35fb2b72", "comment": "Malware payload", "value": "7b597e18cab847c952932c1c39c274f8b884468c7f37d87d8bafcdc984bc861c183e8a8c47734338dd348c8cfe56723f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398195, "uuid": "09c12e3c-ce44-456c-82ae-0a28514d50be", "value": "T117763388535410E9E4B7443E9A82CA24D632BC635FA1C2DB5BBC437A6F33CE5587E790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398195, "uuid": "c1c81966-28c6-4b2d-bc5f-e6496185d8cf", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398195, "uuid": "64869d1f-f241-457b-8fea-bbca5a9ed7b8", "value": "196608:WMeImUVSS9onJ5hrZERlyiU8AdZYJERfSEIrTOgx:xV39c5hlERJAdZYyAHrCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764398195, "uuid": "01aed3ff-4d80-4f03-9259-b03bf6cdc4b9", "value": 7279822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764398195, "uuid": "ea65f345-e45d-4fc8-a1be-4dc1b983f49f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398195, "uuid": "c4ee437d-5cb5-4398-aac1-dabb0252ed23", "value": "SecuriteInfo.com.Trojan.Win32.Vimditator.neek.27314.21139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548b13f6-cd7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764460291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460291, "uuid": "3bc37aad-efd9-4feb-8671-3bb8718ebf40", "comment": "Malware payload", "value": "e6f243accfc926864c27dd77a4139c72", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460291, "uuid": "3a3e729a-e7ae-411c-8d7d-53790cca6e33", "comment": "Malware payload", "value": "0d4a282fc6b5e297f16baf7e67ec54b7e157c56bcf7f7017bfc4e108a61798c4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460291, "uuid": "ea2d8502-140c-4c6e-9d2d-bf3f78eaad06", "comment": "Malware payload", "value": "1c220e5c830bbc80a0c4f09225d7570b5a97121b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460291, "uuid": "8906f5f7-2651-41b3-bf92-542f5b68466d", "comment": "Malware payload", "value": "40801a2d8630b9d0693f41710effc5d1b035c21388eaecf5086777dfae55abb152e2a9f595384c3f46d0c3b27ea5ad73", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460291, "uuid": "c96d18ed-8f0a-4cef-84e4-e100d9e22a8e", "value": "T1187341480DCB85E8A667B8A849DF8C03FBE5C653562CDAD1BB5DA5E03F1043862F45F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460291, "uuid": "171b2147-1441-4a66-ba78-a2e0d33c8cc3", "value": "768:PdVAUUQv6x/+ZI1gOxXCVDzQKEfsYR99bplhfRAyF23BEtBmVPDqJ9avYdKx3sPE:WxGZIXnZhfRA/zaaQ4ujbvh5WXIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764460291, "uuid": "54ad1f93-9b1c-4ebf-9179-ef1c83b51674", "value": 77357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764460291, "uuid": "0aa72b6a-76e1-4ede-be04-927a90993ba0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460291, "uuid": "8ee34271-b102-41b8-a360-531aee118afd", "value": "newSide.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0540207-ccdd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764391296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391296, "uuid": "ab814b52-2bd0-41ef-988f-0732cb62d8b1", "comment": "Malware payload (Mirai)", "value": "bc658783ed36b69561a0e2bfd20285c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391296, "uuid": "9706d884-35ab-4878-b436-25e656c72b55", "comment": "Malware payload (Mirai)", "value": "0df830a367610fcb028cde8f30920442dcf2912fdb318f3fc3c91dfc0d3e2429", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391296, "uuid": "6b46574c-6599-4e57-b544-2f87620d9372", "comment": "Malware payload (Mirai)", "value": "026f1daac21cc4784463b1672b70003aa192d2d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391296, "uuid": "3573568c-b4b1-4fc5-aeb5-510951a02391", "comment": "Malware payload (Mirai)", "value": "e3117ce1ea3e63004de84958031ec18d45c3a01ffca3afa867a429f1db5a4072430b74655440bcac15a613f8fefaaf98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391296, "uuid": "98659260-6f30-4c8e-b3ee-b87393da5948", "value": "T18AB2E1F5C9EBDE0EC5D81778034B1A70D8BA7E820D1EE196DA49C8D7DCC22388564419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391296, "uuid": "fd84da81-9669-49a3-ac82-4be703e319ee", "value": "384:MgMH4XEdwkm/1zlp7buu52otwrJe7qt86cLrvyQQv5oafo4p4k5ILv1RM:Dzp1z3buujqU77xL21ho6o4P5IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391296, "uuid": "9ad74884-acda-401e-b5f2-a6ee25537018", "value": 23956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391296, "uuid": "56d582e7-7114-46c5-9d7c-4ce9b80e5f33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391296, "uuid": "1008b912-9536-4c7f-8b30-46f9c42d252a", "value": "niggah.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2468822-cceb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764397366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397366, "uuid": "6b0e5f64-a98e-400f-8f79-c9578ba226ec", "comment": "Malware payload (Mirai)", "value": "4c4f4b27d3ecfab24822162124228d45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397366, "uuid": "ca4a2585-8eb5-467d-8edf-765d5f5da585", "comment": "Malware payload (Mirai)", "value": "0f612871387a45ff3434b0d5789947bc803ce23907761fac6cb28b6cf31cb8f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397366, "uuid": "97275aae-fcd0-4f2f-bc54-2b01845f7833", "comment": "Malware payload (Mirai)", "value": "dc6da606a18de64760500db4dd0679b92c5668c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397366, "uuid": "1a495a12-3f46-4e69-8ef2-2461559bf953", "comment": "Malware payload (Mirai)", "value": "03ea85bd7153afb66fa212ae7701cc1c006674fda53a5869b32cfc2c14d108122d9c01e3d596cbf515cef0b4461831e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397366, "uuid": "0f3f2b66-4a96-4287-9587-3b2c8c8a880a", "value": "T10404961E2E228F7DF668873547B78D24975D33D627E1D684E2ACC2141E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397366, "uuid": "e05cd659-a7cb-49a7-b045-9d9a2e737a65", "value": "3072:fwuNHDkNYWqP0fEEcD82TJkkM1C3QntHOVj8OqXulpe3EZX3Hz7:ouNHoN5C0fEr82TJkCgntUZqop+ERP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764397366, "uuid": "2f708568-6645-4ef7-80bd-d680151cd662", "value": 190108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764397366, "uuid": "068675db-2808-4505-b057-d301ae2074ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397366, "uuid": "63e0de68-8f49-4586-a150-e414fb5fef9c", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1c14f9-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764391938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391938, "uuid": "fdedbee4-6c92-45d4-bd84-b045493dca7d", "comment": "Malware payload (Mirai)", "value": "f5305cdc09e9443fb3a02b6e0f14e3b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391938, "uuid": "67652a44-8f86-4a1c-87c4-97d4e92ed425", "comment": "Malware payload (Mirai)", "value": "10a9aa95c9eadf33a2d1411ece2d5c73a53039d53c8e5cd7674463ab6f0724f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391938, "uuid": "54eabc85-2342-4f6c-bc24-665f53725eb8", "comment": "Malware payload (Mirai)", "value": "57f73856be2002fd8011b4fb82d79b48a38577f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391938, "uuid": "05477bb7-c307-4bc9-86ef-322da548574c", "comment": "Malware payload (Mirai)", "value": "692745fab466324b58d555fed31ba14f710c74697da1a20db71480cbfc2741afca8bfdb782b2526a2a8479137c2d1613", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391938, "uuid": "4cc3b1e6-1ec6-4338-8721-25161b81e1d5", "value": "T185935DC4F643D4F5EC46013561B2FF379DB2E1B9232ADE87C3E89A326C51941C906A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391938, "uuid": "189bd4f9-9a33-42e5-b637-3da6f997c22e", "value": "1536:/ANtCILBtDEaCijfMNr0MIjusj1L7MyPUGxGbhCs1iyuPKMM/ymVi6i:YNtCatxggMIisj1kypxGVjU9PKLi6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391938, "uuid": "211f79d7-db4c-4eb4-9ab6-1259a4030f65", "value": 96052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391938, "uuid": "5d552f3a-1110-403e-97b0-e8a53fea5123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391938, "uuid": "44715550-56d5-49f5-ba5a-87ead6bbd239", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ae418a-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389154, "uuid": "c383d6cc-98b5-48c0-907d-23ab28d149b6", "comment": "Malware payload (Mirai)", "value": "06c827d99d3a22e773fb8afa93fd588d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389154, "uuid": "2822e99b-b63e-4a2c-8c11-3509127199ea", "comment": "Malware payload (Mirai)", "value": "1120f6a02a73a88c9405b537d3c97c338d602a571f642ad32626ebf6f52bb350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389154, "uuid": "22a432ab-463d-4798-ad06-1b3b71e35b19", "comment": "Malware payload (Mirai)", "value": "85a4826916363f809a74f588c18f6e77e3ca7210", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389154, "uuid": "8d0342c4-c106-4586-b4c1-b3ab9247c3f9", "comment": "Malware payload (Mirai)", "value": "b41592c891b8c67264c60dac0544f03b66b4eb9876fb3089d4aab5e65bdb4588825edec3ac8a61607a5782011c9ff4b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389154, "uuid": "b8dce8e5-920a-49ed-b5d6-a1f945adcb3e", "value": "T18203E115061449BDE02A61BA6B6943B16D124BF3EAD2EE10238D8D8FDF6BA107C47FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389154, "uuid": "53bb1158-6c9a-4ef7-88f0-fe9ab5d077ea", "value": "768:MF+xYaF57IpHNUbn23DubCOFOFktKQmrzJxUa4kJ2A3PROz4abeqKJgGlzDpbuRX:MF+xR/gNUbn2KCOQytKbzJ14qJOh0VJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389154, "uuid": "03c84158-545e-4b8e-bb59-7412b4691a13", "value": 41104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389154, "uuid": "6cd3c9aa-59e8-4eaa-80a7-f82133e24830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389154, "uuid": "b05d0ae7-e15c-46b6-96cc-1f91d5df7eb3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f136fe2-cd13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764414245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414245, "uuid": "9de3b9e1-ab6d-4148-8039-95842694951d", "comment": "Malware payload (Mirai)", "value": "f24b6b8a267f6967a57787ce0549d433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414245, "uuid": "5b95f099-dafd-4f3d-9277-43ac400fb1c9", "comment": "Malware payload (Mirai)", "value": "11332376904f8bed307fc0656dad462388db91aaec7c4997f95456af5f3de070", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414245, "uuid": "9ec81238-92c0-4c69-891d-d851b47cabcb", "comment": "Malware payload (Mirai)", "value": "158fc7055dda99399602a90ada71b3637f33dbdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414245, "uuid": "8a938da3-3b47-4da3-8338-5b3a07605907", "comment": "Malware payload (Mirai)", "value": "6e778a2a5df2ba38d4e7e1cba08667d19bc3c070d41a00e0e43ebed70df3f70dccd38039b1dde9ccd94f32131d563051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414245, "uuid": "cd92751b-9d8c-477a-9f6d-0eac987d99a3", "value": "T10343F15BD27DB2FDE5D491393E470194BA2E2C4B9EA255AB448DB0F89C301B2CF41BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414245, "uuid": "322f52ca-8e4a-4556-bb90-34a60976d77b", "value": "1536:nBf02AMDKBMmHmGHhKWlQTAM7875V85AFUJb:njA3SmHmG8WlQTAME5VgY6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764414245, "uuid": "0ca80ba6-a59e-4140-b88c-cc68130c9e5d", "value": 58476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764414245, "uuid": "42ce9b1a-5deb-4225-9e92-d849e9205021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414245, "uuid": "91ecf0ae-d866-457f-87a4-7e8c0ff1ea5b", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fdcd16-cd0a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410606, "uuid": "a95287d7-65ea-447d-8916-27320510350f", "comment": "Malware payload (Mirai)", "value": "79a169911c263c93d3d8d3043b247f2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410606, "uuid": "feb6655d-50bd-430f-b01e-c39aad2f80b0", "comment": "Malware payload (Mirai)", "value": "12d20d25052ac22f531d6c2c3b4ef8d10bed2e9ef3f3076f2370d0f8edcde193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410606, "uuid": "410e6310-c7c2-4fc9-b785-87e386f16c7b", "comment": "Malware payload (Mirai)", "value": "25de4afd82edebcb7f95f34507dc6628eb0bba6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410606, "uuid": "d60e84a7-9177-4015-9412-43f76c7a1425", "comment": "Malware payload (Mirai)", "value": "c6d1b3b57ab7194cf967cca47f01d352cc437b3c9097e04aca9eecddaa462772f404f000ca11faa8676f5fd6b3e0b036", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410606, "uuid": "4297c04b-584a-400b-80ff-c389087d1afc", "value": "T137D34CC5E203E2FAD8460631D066FB32CA72E56A612FED86D7B8DB35EC12502C517E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410606, "uuid": "21d165f7-5f03-457b-87a5-62df13007fc7", "value": "3072:4IRe6iUslSGPS2xZC7g0/V7eB+rrY3DWirMFD:fY6pslSGa+CEPEA3DWikD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410606, "uuid": "5c877d42-2eb9-4a37-aa57-bedcbeced712", "value": 136688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410606, "uuid": "91f741be-9057-47f5-ac4e-3fa2a12159dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410606, "uuid": "9d465bf5-beec-4fce-b94c-2b9148c785be", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb2a8b9-cd59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764444331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444331, "uuid": "21888d18-67fa-44cb-854d-1d47dd450d48", "comment": "Malware payload", "value": "bf3348222e169b0c7369e314ece32324", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444331, "uuid": "ae802ada-b748-4706-b44c-a9e10f3de45a", "comment": "Malware payload", "value": "13bea46c880c2b66b69ca1814a7f7e19e02b5ea76a3a886ac8b3486bbf52b225", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444331, "uuid": "3273a5ca-17bc-41fc-905c-ca05978c89ee", "comment": "Malware payload", "value": "ced253b830d1ba22bf66af8a7d1021bcf5062593", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444331, "uuid": "6aea2db5-5b79-4444-88ba-a3ba3541d67e", "comment": "Malware payload", "value": "3deaa7eaf78d6e1c9ae3534a03a8e33b038f64c33909fc616467f50f0a1d22308b6fa91661fdd8d704f91c72681b46d5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444331, "uuid": "83a32138-dbda-4394-8004-4d271485a1e9", "value": "T17AD57C30F6D9462AF4F3263058BCB366493EBD3A5B76C5CF6298485D1A70AD25B30723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444331, "uuid": "06432464-babf-4646-ab60-c47dd400238e", "value": "d43f8c997b97502b3d143bdc0b4ecf33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444331, "uuid": "0db4dc15-bee1-4260-92bc-99e1c8dfa3e3", "value": "49152:Fmc1yZz0mKSdJJ9+B8TR0wJuvj5dSNSMn6nE:F3QZ9Jn+B8TtJueNRn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764444331, "uuid": "35ef7303-73cc-44ce-9ff8-ef0b974126a2", "value": 3002368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764444331, "uuid": "4d106e38-9924-45a4-92e6-668abe0d61fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444331, "uuid": "4842c438-9d94-4913-8d60-1cd4d8c6f9b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529d3315-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764393286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393286, "uuid": "c26637a9-4163-4fcf-8447-aaf435c8d4a2", "comment": "Malware payload (Joker)", "value": "1df6a07796127f0841c591ce8b4d045b", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393286, "uuid": "610a5c56-d90d-4066-9172-4527b6f339d3", "comment": "Malware payload (Joker)", "value": "15ee6ad5b289a95973e57aba2023bd1b12e62177661fb62b44bbe61a4e3e307c", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393286, "uuid": "59d175f2-1ff7-4974-9ba3-15767586d345", "comment": "Malware payload (Joker)", "value": "317cb71809b3b78beb64fe53663b27f98371a1cb", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393286, "uuid": "25d2e097-8813-4a64-a8cf-22fab623db91", "comment": "Malware payload (Joker)", "value": "ecd85ad5446f7c8b3fcae84d8b1b7f052a13b3df30821e6dee71eb3a20056f1aff52f19e604068897f6593750787a8bc", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393286, "uuid": "52a29f19-e416-41e8-95a5-df43d87052ac", "value": "T13F672309FB0DA82FDDA3F0788D7A035275665C89A240ABD7A511F11C6FB36C48F1ABD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393286, "uuid": "d6f8f154-f98c-4586-a69e-801eecf3daef", "value": "786432:TdKRfUZ1Oe4aArZ2FbIEU5XPAu+7XJaDnO9g2:TdKR+4aUZAXU5XPAv7Uah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393286, "uuid": "a21b1dc8-59e6-420d-ad1b-960985dec832", "value": 32105048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393286, "uuid": "ca2561ec-e563-45c8-971c-0147444acb18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393286, "uuid": "91ec6355-e314-41ba-9205-76cd932aa8d1", "value": "Phone+Cleaner_26.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cde9757-cd6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764453836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764453836, "uuid": "d97722e1-a6e3-4a7e-a0a8-95c1d4710d41", "comment": "Malware payload (Mirai)", "value": "cb386e6fca6a947d929587e262cd2b23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764453836, "uuid": "49510737-3acd-41f6-82ca-cf278140ef55", "comment": "Malware payload (Mirai)", "value": "1636fa0a3ef5d67bf97b5b79843f85d4bee194d99df2fe73058bcc7a28c8b9d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764453836, "uuid": "61f82319-f541-49c2-bcca-67a30ac8e584", "comment": "Malware payload (Mirai)", "value": "cf93ac56e390cb1933b1d431dc32e5c055ed4030", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764453836, "uuid": "dd576df9-64d4-458c-a0d3-b950e2ad2d9b", "comment": "Malware payload (Mirai)", "value": "0edc251f8661608cfb78dbf9c3db96f7291e2293e07cd4a1ecda52b43d039ef57d507bd383528834727aaef5e84234f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764453836, "uuid": "eba22341-78a2-4945-868c-1ec283f7806d", "value": "T1E6831946BD819F01D5C912B6FE2E118E33131768E3DEB2239D109B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764453836, "uuid": "d7e9a41b-0972-40a7-826c-c19f4699e7a2", "value": "1536:CxnjOSuwgUtOJ8gueoJYp0gNaIAEbSMDiYyom8Kxcl5kYG:FS09yQ0qaiyom8KxcliZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764453836, "uuid": "bc6a8529-445d-465c-bbb8-8add7dcc99a5", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764453836, "uuid": "0f87e701-6c12-4219-b314-fc778149ab3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764453836, "uuid": "89788191-da47-4b55-be10-f4fddea3b98d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb603c5-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389201, "uuid": "39fe9b20-4dc3-4dd0-a51b-041cfd5f2429", "comment": "Malware payload (Mirai)", "value": "6c9fafe2f2ebdf8740fcf606f5cace4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389201, "uuid": "bd63d03d-af06-4785-b6bb-65580e423b09", "comment": "Malware payload (Mirai)", "value": "1792e411cd34a904e1636598714d031e023152532a3af394fc9f9d36142a8146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389201, "uuid": "e0ce7287-4a4d-42cf-8a76-5ec726304f19", "comment": "Malware payload (Mirai)", "value": "b2868aca1722dee51aeda2b1547690580338caf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389201, "uuid": "b958c196-bfeb-4b6f-9309-4c6e210070c1", "comment": "Malware payload (Mirai)", "value": "176738bdfadcca7ead3c8319a2b81315394c0eedeb46221ba972ff4488debdfed3c9d1005080d82beb5128b434889713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389201, "uuid": "f64c7a41-1f0d-4a31-a7c2-557e7244bfe4", "value": "T13C733A07798081FDC5AAC439437FB136D463B0BE1239B29B53D8FE262D0AEA01F5D955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389201, "uuid": "be78bc14-f7c2-46c4-8bba-08d0bd29a6ae", "value": "1536:X21xbHR/B/wndoBR7qf7DqsmztgeyBlsPUVjxfq/kxet:X21xZB/wndojWDDOztGBls4xfq//t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389201, "uuid": "4a206531-03b9-454f-b38f-797f977e4537", "value": 80624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389201, "uuid": "2f2d37fa-98ad-47c1-baa7-5f89942953fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389201, "uuid": "ab160e0f-b07f-4615-bbd5-cb521ba76fa5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bbb696-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764392188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392188, "uuid": "7800ec3a-6867-4a37-8378-f30c60914da7", "comment": "Malware payload (Mirai)", "value": "562cfdfd4843ac3c3a287c464c5bc049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392188, "uuid": "3edc75b8-ca1a-4232-975b-4015af2785d1", "comment": "Malware payload (Mirai)", "value": "179ae830e7ce95750c848357e10a1899ade55af51e7803ee1d7ca0eeca31917f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392188, "uuid": "74884cf6-4db4-4de3-9a5e-ea289fd5e7be", "comment": "Malware payload (Mirai)", "value": "5a65c8dea7c39e845f36cdca33acf6574d87532c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392188, "uuid": "53dca09c-89c4-43b7-9a93-fc3efc6d4fb4", "comment": "Malware payload (Mirai)", "value": "a213c073101cf54e8ded524826e4b12e234b1f3187f00d20f07c658c00b7fd07b85a8c4b4705ff8d9047ffbb98ca7bb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392188, "uuid": "f67260d2-52e9-4129-bfe4-46036bd585a7", "value": "T171145D46EB414E13C4D7137AB6EF42463323A7A4D3DB73069928AFB43B8679E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392188, "uuid": "a41d7aff-5261-424d-a138-2cad777358d7", "value": "6144:IJUAi6maL7zHvTb/anndfgIUn5W1ySvfX4DnbxyM/9YzU:IiAi6maL7TvTb/anndfgIUn5Q7a9b/Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392188, "uuid": "cc57bb68-9586-46c6-b8e1-628c2a1c6de3", "value": 198239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392188, "uuid": "dde1a72c-b171-4331-8002-13d7939af0a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392188, "uuid": "db194d90-523c-4171-af5f-86240c4e3d37", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f368cc83-cd11-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764413743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413743, "uuid": "e54d9481-b951-47d1-9044-e702e2abf714", "comment": "Malware payload (Mirai)", "value": "ad14b8c7942e2557c0e7a0a080105c3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413743, "uuid": "5634c800-d64e-48e4-9b93-2cb542baa0a4", "comment": "Malware payload (Mirai)", "value": "1848aa5c8cf468ef7c013ef11c0325f7acc20ec71a23fc3a92fcf0374c3cc3f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413743, "uuid": "1ecbb7cc-b85f-4960-96ef-d5c9bb7c933c", "comment": "Malware payload (Mirai)", "value": "f4445cec7612f1e1b8520070369a1dac068c1612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413743, "uuid": "f80f5de3-9de5-4eaf-8205-3cd4cd5b82fb", "comment": "Malware payload (Mirai)", "value": "0f4c846e4fed099f2bad8e7d87ae8ded6c88797f5f9cbdaef2148dddae12a69848b8c3455c7dd664f8bfc2d9afdc5885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413743, "uuid": "dee07218-0fc9-464a-9d23-d5115fa4e610", "value": "T1F9B35C17B9919B11D5D126BBFA1E518D331307BCD3EF72129E10AB21238B96B0F7E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413743, "uuid": "32c1fee1-d7a1-4393-84cb-8421544e27f9", "value": "1536:0JnZt1UH68Xuj3w1x/7zpVkW4ke5OlyEZixL5a2LaF4gYW+yd3SiOKoJIrb7ngYK:iWa8Xu3w3/DVMeOLQ2LaFeKoJubDg7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764413743, "uuid": "edf20a46-d9fa-400e-aaab-9836199503ff", "value": 111828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764413743, "uuid": "db215d0a-2f5c-4573-a684-10783c7ceacb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413743, "uuid": "4c304716-5849-4340-9e51-336df0e869ae", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc817eb4-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409785, "uuid": "fb3ac368-c475-4186-9411-61aac1bf45e9", "comment": "Malware payload (Mirai)", "value": "d54610c1a59f71302852cfe2a4f0b81e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409785, "uuid": "a566ed0f-868b-4243-a749-ff3e4345213e", "comment": "Malware payload (Mirai)", "value": "189c6247ec560837a146794562edce3618d6522c402da5a8461706ef185d927b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409785, "uuid": "fb03add7-3950-42cb-9e1d-7be46c255a25", "comment": "Malware payload (Mirai)", "value": "871d3c8ae04ca34fee77b529d69050cc5ad19a84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409785, "uuid": "504512f9-30ec-467e-b455-b9ac2d7601bc", "comment": "Malware payload (Mirai)", "value": "7f4ff901fd4f8d2b8e3b0eea7d4f6e3211865b81e821ce5399ecf220bf17dfcf5a24df897e176a02ebd98b27f0b150fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409785, "uuid": "540e0cfc-954e-4d2a-83c0-54b81e9a0892", "value": "T1ADF2F13B91BAE5BEC8365C734C94E9D5B8B2E45314C66BBF6455C7BC4D31A043A00EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409785, "uuid": "5e42b9c1-056d-4265-8c68-dd77a8625e04", "value": "768:WwS0nQr9tpJEujVWoMwrIVOqs3AECHgJr6UAX6vGxUx0nZZ:JOXVLrIVOqsQZIJNMZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409785, "uuid": "613493ee-154d-4a21-b0e2-23ac8f97287d", "value": 36924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409785, "uuid": "3600b3c1-0b80-40cf-abdf-3e73b4eff9a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409785, "uuid": "9ca491a6-3ef1-4b47-ad24-b9b3c07a0c95", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa38a42-cd68-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764451102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451102, "uuid": "bff13cac-fb99-461e-a13d-5209f2487fdc", "comment": "Malware payload", "value": "00acaddab45da0d0771050cc1ee676bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451102, "uuid": "431a5be6-62c9-42f7-8c06-77a99ce201a1", "comment": "Malware payload", "value": "18e12d14af3a56c13b89d8df3c0f8e808fbdfd7da4e47cf63875cd2500a1f165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451102, "uuid": "6d78bffa-ac51-4ec5-826e-c1fad7d4ac7b", "comment": "Malware payload", "value": "29d8fc0d713ea733097a650d8f27e27b3c85ff9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451102, "uuid": "3185d21f-697e-4b31-91bc-f87c7b2ada4b", "comment": "Malware payload", "value": "597729947fbe0579ac339382e8db7aba290578e3d2fedd356df7cc1153a61bec2fa6d4c0c6fde7c0eeb931aa86d2857b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451102, "uuid": "6328ef41-1a23-4d12-8cc5-48bcb0172003", "value": "T1D7F73388AB905D8AFF78433A4521EE08AE58F00D67D94C1F93E8A5362DCF7DD1ABD501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451102, "uuid": "65b08715-8f57-4504-b857-03a7cbf185ae", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451102, "uuid": "b52d9d74-bec9-406d-9517-3729f7a9bb9b", "value": "1572864:gXZkCEWJ0izXUb9jETHPQmMpnx9luHY7otnq/2aCxoeSqjSABNEA857:oSCEW6jcvPOn36/ieSqjSuEJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764451102, "uuid": "cd4bb527-03d4-4067-959b-be1bb532e7e4", "value": 71870480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764451102, "uuid": "4f5080a9-fe19-4d24-b9dd-b62f540b33f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451102, "uuid": "b1ac8f2e-2ebd-4229-88e2-0dbfeb33fb55", "value": "stealth_agent_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85716ff5-cccf-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1764385211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764385211, "uuid": "4ce5e493-2ef6-4aba-8d93-b2c81238d6df", "comment": "Malware payload (NanoCore)", "value": "3b3d725dbf7b51775195b87cab728b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764385211, "uuid": "761d1f19-1afe-4500-9dfa-c898ef251b30", "comment": "Malware payload (NanoCore)", "value": "1937e2c3af17453c2ffaa0655bf3dad42c43f0a67268674b38595a098339ec8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764385211, "uuid": "812d5f45-5ef3-4d7d-ba48-069631e37343", "comment": "Malware payload (NanoCore)", "value": "7175e8a3f79a81c393742f85d6f30999a5469e6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764385211, "uuid": "3aa07ed2-6037-4f8d-ab56-0ea5a62305c3", "comment": "Malware payload (NanoCore)", "value": "4367dccd4f208b77ed101d510e719f7b41e2791a64eae6660a49b1561d637e038ffa583a28cd1ecf66ddd4526e1a5596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764385211, "uuid": "6c9e06a2-012e-4f4d-b140-5bc2cccf5eb0", "value": "T11A458C0263918825FEAEB2738A56B211567CEA193023CC3F32B81D6979705711E7D7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764385211, "uuid": "f43a33a2-eac4-4ff4-a11e-bc62e81e511f", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764385211, "uuid": "8588ab67-03e5-4756-935e-7b8eb74d9b85", "value": "24576:8MVZAFU/Yvbz6uOMOyxE1cmawiZXHHIwG2a5e:3kFWYD+MrxS7awiZ3I5ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764385211, "uuid": "923c7c55-f14f-4c0e-88c3-aa518637e56f", "value": 1192244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764385211, "uuid": "76dfb415-8278-4c61-9a2e-b6f19914be87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764385211, "uuid": "bf0d93d5-ff86-40c1-90b3-d8ce1a9ad227", "value": "3B3D725DBF7B51775195B87CAB728B2F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d78cb42-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764443046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443046, "uuid": "3063cd27-1c6f-4c77-afca-d51c621cc3c0", "comment": "Malware payload (Gafgyt)", "value": "0d12de995f27cb46fa2da7463f72f91d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443046, "uuid": "515775c4-0a90-489f-be77-ce28c498fec2", "comment": "Malware payload (Gafgyt)", "value": "1b04b273b5eaef3c9409176fee70dfc84b61363206419a8c5d0a0fccfac59710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443046, "uuid": "41065a1e-0590-4fe7-93c0-27c084a84f45", "comment": "Malware payload (Gafgyt)", "value": "746ce56fff3390dcaf631b4b52f760a42f36efc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443046, "uuid": "9aedf1df-6533-4da8-ba21-183fc63cc20a", "comment": "Malware payload (Gafgyt)", "value": "5691e4c7eda0320e3dab79becbe263aba69e4ff8340c2198c06004c47baeb3a52854721b27af4ecb6719f6095e8e7792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443046, "uuid": "7b32757b-3645-4807-adee-b02ed35a2c0b", "value": "T1A3932A47E9615BB7C0C66AB169E68D310713B9912F4F1B89713CA6F8074B8CDBC0EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443046, "uuid": "489c1c93-9332-4a64-9d21-8d5d64da34ef", "value": "1536:4TathcyY/axr6BrVtJtpGxgdKX+W3x8p0CbuzccmknVMOMuIfaW7:4aLdY/ax2BrVtPp8Xo05ZmknVMOtIfau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443046, "uuid": "0a8c8e54-5a40-4aaf-ad4d-474dbb1f45e4", "value": 89186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443046, "uuid": "ba3e2202-a76a-4777-9b38-0aede4aedb0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443046, "uuid": "09aea51a-18a8-463f-927b-6677ed09ec68", "value": "Fantazy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff81f60-cd6a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764451962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451962, "uuid": "606117d0-c997-4bf8-8e91-4e8338424992", "comment": "Malware payload", "value": "dfa8a4b26147aedd89128b227c16f8a3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451962, "uuid": "f27be683-af40-45c3-88c0-4b5e627d5410", "comment": "Malware payload", "value": "1b4a9f2ef2c2d24a36a720931c6b6ab75de02a0680ce73e0cd80971ddd11afe1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451962, "uuid": "0e385a65-253f-48d0-bcb3-819ab5391c22", "comment": "Malware payload", "value": "0f1e51b91dd6f5ed4e58cde26b42983c1d2488c6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451962, "uuid": "91218122-56d7-4a9e-bef8-7677c13cbe11", "comment": "Malware payload", "value": "edc109eec60ad5e78818cc23ee7fb46e2111e7e6e32d9b268ec8092ce88c434a4dae4fe61a1cab563903ad6e08a0a909", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451962, "uuid": "30b8cc30-f398-412a-8e4c-dfc06a603fd3", "value": "T1F5F2C01653C0EA607A949529D07FAD0B237929E70FB4BBC62E23644F7EC22C8C11D2CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451962, "uuid": "cce691f8-7259-4a5d-b96b-b57aa51b86fe", "value": "768:ARRTh2eC23juaUbaN+cUetwmx7e/IG+9BovLRuLRaRk8i:KRl2bAuaUb3Ewmx6/+oTR8Rck8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764451962, "uuid": "6304933e-7ab0-45ba-ad59-647d93d394a2", "value": 36043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764451962, "uuid": "3ae65e62-7327-4cc5-a16e-63352d08b45f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451962, "uuid": "0cbe872a-0ef2-4373-a2c2-95737b3219df", "value": "kryo_crypted_d5wsui32.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d2bf89-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409767, "uuid": "deff20a1-a7ef-4c72-8831-806bc5f91912", "comment": "Malware payload (Mirai)", "value": "187f4471e137e6c866f792e2855fa2c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409767, "uuid": "8e7ec2ce-75db-4abd-b29d-0fbf0aab0955", "comment": "Malware payload (Mirai)", "value": "1ba5856cdb5af6ac43e2508ec9db62e26ddc51db98be484e56419361eef0c36b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409767, "uuid": "cf83749d-d539-473f-9ad8-6fd41dd713f9", "comment": "Malware payload (Mirai)", "value": "b1ed02253118d1de8dbca1f0fd86e14141928d00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409767, "uuid": "35ca63e8-669e-4ac2-a850-3e62bdcf83b8", "comment": "Malware payload (Mirai)", "value": "4398a8582268feb07c0d92eda086a2c29abe8fa837ac998a6cc487a3efcb879122576070ab1fb60d9ff18649e0af31de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409767, "uuid": "b9eae79c-7ba0-4a26-801d-d7f328d2bdbf", "value": "T1D423F1ED383958E5C58E4C7832AB02434EE4F2A939465797E306CC0ADABDE9732550F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409767, "uuid": "6cc541e4-e0d9-45e4-943d-fbb52fc4c258", "value": "768:s3Y578O2xWBrZS9vhFfCc2ZWXQ8beUJda/FPKArO35LPwWPi/oGmXWZ:swYOc+ZkszMDqUJda/NKqaPwWGo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409767, "uuid": "bb9112e3-0512-4da4-aea1-ccdafee6e84c", "value": 48924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409767, "uuid": "ec0729a5-b6e7-4019-83e7-da949dfaa75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409767, "uuid": "a0655d06-432e-46ae-99b4-6a22b947ee94", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ead74b-ccfb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764404247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764404247, "uuid": "ca300bf2-a761-4291-baf7-fd8360f898eb", "comment": "Malware payload (Mirai)", "value": "c4506cee89e9873a61671ecb84309092", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764404247, "uuid": "c9b06b4b-f3b1-45ef-a6f1-8f0aa1c323ed", "comment": "Malware payload (Mirai)", "value": "1cb741770084a91d0710b2613de8f977c7490c3d53ff1db6d3d19d5a858dd33d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764404247, "uuid": "7965adab-a2b7-4b0d-88d5-193e3d8b6a38", "comment": "Malware payload (Mirai)", "value": "b059cdbab67fc94c0420c290a6892a7943b794b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764404247, "uuid": "f3539d25-973e-4532-9029-7ee386a6a87c", "comment": "Malware payload (Mirai)", "value": "2a48f744b5befad225e0aeabaff9eb1f891192a436a74d21d2ef64f028edc209a93fcc691a742dda787cedb7b4640b0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764404247, "uuid": "28d09dba-a86d-4d9f-bd62-f8c01d8d6ced", "value": "T1095302AAF9147EC6CF259EB693BEABD14844D9C871D4474CA3508CC636347EBB0DC094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764404247, "uuid": "5f30b328-e100-4767-8eb3-7af2810e3294", "value": "1536:/ZgY2kt+VXMmEZGgiftobgez1l14OUvNktwrCYAvju51:/ZMMcLt0ge+5wGCYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764404247, "uuid": "a3ffd3f2-a315-427c-93d0-aff4ba0f41b8", "value": 61608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764404247, "uuid": "73126a52-0919-41f4-9c9a-460e12567fa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764404247, "uuid": "dd1f5add-1e51-4993-82d7-bc7678012f2a", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715c3cf3-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459480, "uuid": "a4794b0f-a68e-4c66-8b3a-8e64200c4815", "comment": "Malware payload", "value": "db60eeffe7b3debc770078f8b1fee3d3", "object_relation": "md5", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459480, "uuid": "6649bd75-3ee6-4ccc-b469-dfa510b9e74d", "comment": "Malware payload", "value": "1dd730d30a2ac6670940da35b7fd5fbb2a901d62b16f3fbad87822e1f3e8c38c", "object_relation": "sha256", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459480, "uuid": "cc9a4ae0-f80b-48d2-be89-30166d606e3a", "comment": "Malware payload", "value": "2b38fec43e7f29e419f2143ae410aab5b8f35194", "object_relation": "sha1", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459480, "uuid": "ae602e2d-b1c0-4eab-8419-d19695526806", "comment": "Malware payload", "value": "eb0fc24179404655a682bf3f0e351e718978cfb6cfa6e658e713cc6ced38860246e84f809b4e3656841a708f632737ff", "object_relation": "sha3-384", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459480, "uuid": "b6822d60-a4ab-46cc-838c-d4da084cb94d", "value": "T171D633682962C44CCF35746783966A32FF3B04D2FA828188E2F1D34785A3A7F5E65CD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459480, "uuid": "c1af7bb7-00a6-4a70-b3ff-9cf382df6144", "value": "393216:1DH7WWFRxd9j663XtBjskpXKuT55T5ROA53/j12oL:pHx6IVswnbOo52W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459480, "uuid": "d77f5fcc-00f7-48d0-9439-b650cebddd79", "value": 13380165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459480, "uuid": "4a2bb18c-f367-4e8a-af08-8a976c131e95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459480, "uuid": "04d09209-e995-4389-a69c-8b87db6ffbfa", "value": "Setup_1764435582426.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecb0c60-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764443048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443048, "uuid": "a74e031b-33da-438f-adaf-c6d415c0154f", "comment": "Malware payload (Gafgyt)", "value": "9dfbd31bee1cb8347bc0e16f61faab5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443048, "uuid": "7de01157-ea8f-4012-83ba-d32ea10bf1d5", "comment": "Malware payload (Gafgyt)", "value": "1e560c14e3c5354e358f52a1823de95c97241955ff5227731feb00f4fa94843d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443048, "uuid": "e5942901-ad3c-4936-98b9-e289b1b44373", "comment": "Malware payload (Gafgyt)", "value": "ee90a9b535788d326783f9818688588a136d066a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443048, "uuid": "be501257-c556-4a73-aca7-5dc5ceed1f68", "comment": "Malware payload (Gafgyt)", "value": "874740d3398b0de9bbf87dcd8e92ad0c0b58ef03374e54b12cc991ceecc44ef631b659ee8326bb44336089836c5d4d78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443048, "uuid": "c0f51881-49b1-4533-a501-310624c3447a", "value": "T1F2C3A52E7E22AFBEE16882310BF75F7087A521D637A19342F26CD6581E7128D1C8F754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443048, "uuid": "30736469-00c3-4b62-8eab-091ae08cc2f4", "value": "1536:HbDwVYuaKurNAV2rKQ7j+4GeGISeG+GX8J2rKQnGx7M/wa5zIXp3xJJoPxe7Pb3q:QRGUwaMNoPQPb3SrmthjF71Dq1MdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443048, "uuid": "057263de-77de-4d53-b474-4424a459d055", "value": 126307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443048, "uuid": "765fff20-dd0b-41c1-a316-3696194880b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443048, "uuid": "b4a1fa23-8e87-4195-92a3-352ecd6fdd06", "value": "Fantazy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea1eea-cd0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410812, "uuid": "0b4cfbd5-9aba-422c-89b2-64de5ddbc15d", "comment": "Malware payload (Mirai)", "value": "5628ed1f7311a67282cbd705a39852dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410812, "uuid": "47078a82-6856-4595-8645-8c51f80d1b31", "comment": "Malware payload (Mirai)", "value": "1e5e9462a84458354cab5374f4c31c9d2c87eeec794a77a060c9fdb06f6c65c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410812, "uuid": "e909f355-eaf2-463e-b364-37df5f342ce3", "comment": "Malware payload (Mirai)", "value": "3b7d69693c14dc1b422d8b40c5f4d432282a36bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410812, "uuid": "26a990a7-810d-4814-904a-24155e0e3462", "comment": "Malware payload (Mirai)", "value": "2d98a1504e0caa7a0558372221c4d73969c559d69ace6eebe0448ea1f6461c864d895183539f7075c7d9ef46b8cbdd9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410812, "uuid": "a41e49e7-19b7-4e80-954c-2966d27dc040", "value": "T15243024AC36F18A7EE4BAF1C1FA983D03A95CE493A01DB8133D4D9063937CAD615D6D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410812, "uuid": "5f3b2b91-fa14-4ff5-ba9c-84786b5a3c79", "value": "1536:Fcen2HXD8LonjCgb5F2Gb7C9NN04u+qgw09c:FLn23QLBgbb7I/04u+qgw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410812, "uuid": "91255321-7235-4b93-9704-7fa00bf7c47f", "value": 55496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410812, "uuid": "9dae9486-8d4c-4989-af81-3b374963092e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410812, "uuid": "a5d28c82-1ca3-40be-beaa-faee1804e07c", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e8c2f7-cd47-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764436913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764436913, "uuid": "c730d874-21f4-48fd-9124-dc68d207f309", "comment": "Malware payload", "value": "1858d3717d985e1ba43e3f01d136b403", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764436913, "uuid": "aed729d1-bc56-450f-91a5-b21884079700", "comment": "Malware payload", "value": "1f2beefef1c5f493802c67f46a2e2557a0cff5dba6c7175637a98b6db4054158", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764436913, "uuid": "5effd65f-5417-4f74-bbd3-af5dd1a1bae6", "comment": "Malware payload", "value": "570deb3e3523e5d357f3ceacb2a543a69d5ae61b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764436913, "uuid": "9de3f037-0890-4c0b-b3c5-6c3d02362c1f", "comment": "Malware payload", "value": "a0ffbdbb03f92c04a75a8e7f33bafc9708354eb75e587f5a67f869d755e0e3afb94ef7030b46988632154af8ff674463", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764436913, "uuid": "9942d38a-3687-4509-8f9f-4bc2191cb50f", "value": "T10E53F816ABF54844E4EE5A700CAE69B4C9B3BD720E14D60F3391362D2E73E93DC66352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764436913, "uuid": "a358dbbf-dac7-412f-a0b8-a62fe9a1a91e", "value": "637df1e8f3c074f2ce79b53c3e34cfcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764436913, "uuid": "68cd775e-600d-4ec5-a4b3-cda9e9630747", "value": "768:tKR3I7/LfGZsRdnLZ90PGmqTkHXqScKiQJ5o3Vm:cR3IvfGmRX90+TTu/j+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764436913, "uuid": "15b8403f-e243-49ce-bbd6-992768c1339b", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764436913, "uuid": "b5134139-0129-48aa-8774-8164425fff2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764436913, "uuid": "2a14e3c2-1091-4600-9e1d-1a735695af18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4133b0c2-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393257, "uuid": "d877ebf7-9021-4b7d-91db-4460bce0fbed", "comment": "Malware payload (Mirai)", "value": "d3ebca77b43ab525a02f1080febfe748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393257, "uuid": "e17b5722-0e89-4def-9926-f13ab33ed875", "comment": "Malware payload (Mirai)", "value": "2002ac185701575cd923b07523ea6ee8f8bb3e52fd09f02646dcb1cd8f82ee91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393257, "uuid": "dc74c9f5-2c5b-4aa2-a8fa-4cd5e4d5b17a", "comment": "Malware payload (Mirai)", "value": "26e8620e37a6c595afc01a609eb2640dfb11ea1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393257, "uuid": "b3461f00-ebc7-4681-b321-a13fc2ccf348", "comment": "Malware payload (Mirai)", "value": "4747d84012cc80428e4653dbb70199874685e14ac35ac22abe2d34680b35bcb31b701ab6b11ce2cef006dc8060184407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393257, "uuid": "702e7fd5-6503-4a8e-bc30-b2579b8c1fe4", "value": "T191B34C0173180B43C1971AB02E3F5BE587BFE9D121E0BB89655FDB9642B2E37154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393257, "uuid": "a48c462d-b8fd-43b1-af56-6820fbc46661", "value": "1536:ti5mb6Cvta3TV6QnR2nFp0t1Ov4/xzDrg5HwSbazUITM9ZB5:ti5mb6l3R2nI1pRg1wLYF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393257, "uuid": "58d0fccd-e548-4738-bb52-b2bc91bb6616", "value": 108108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393257, "uuid": "1e8e89aa-7470-48a2-8370-baf2717d4551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393257, "uuid": "e50a10f9-8416-43a4-add2-1387a97da393", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a9ce68-cd42-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764434656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764434656, "uuid": "0def5d50-3267-44c0-8d74-f6efb8109d52", "comment": "Malware payload (SalatStealer)", "value": "2b2c7cd28b9941ae8ab0face9f604610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764434656, "uuid": "5cb6638c-6dda-46e1-aab2-90e0af7f6c60", "comment": "Malware payload (SalatStealer)", "value": "207986ec1924621868bc54c46094f13025a9ec683d83f1db1f71c591a17323e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764434656, "uuid": "6075eb99-e2e8-4409-b077-d753c8d57510", "comment": "Malware payload (SalatStealer)", "value": "a19182f6b56acc0dd2aaeaa37962c2a9c1ef64c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764434656, "uuid": "04a3c2c7-b1e9-4de8-a8b7-21e97912c1ed", "comment": "Malware payload (SalatStealer)", "value": "e5a66279a5442df223fa0f932862739e01f529e8721e8c9969e4450fe74146cea6c904eb455589b8d4ea827dc6aa2c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764434656, "uuid": "6cc8c1e6-6b0a-4ae9-a39b-e83309ed0aca", "value": "T123C65A51FA8B94F6E9031831405BB23F63345E048B28CBDBFB547B6EFC77681196A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764434656, "uuid": "e906ea75-83e9-4f85-8191-f711f4a6c29d", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764434656, "uuid": "27f872d3-bcc7-4c69-8ca6-5ef7ce3d58c1", "value": "49152:8LJNzmR6QKHL3/t/1xjaFq9jErzZDqQBYCzfb07o8pNseXPh6TD3qCOvmXYnxVD4:e7zid2tflYvl/S3vuJaw+pKN11+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764434656, "uuid": "d81c5fd7-1947-485f-a8a1-fa8d69b02bdd", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764434656, "uuid": "70020ad6-592e-456a-bcc4-813c8c78c5b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764434656, "uuid": "1e35b3af-405d-4ce7-a415-e10e8565e2dd", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e83550-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412987, "uuid": "3a473152-7550-4a8b-b860-d47aec761c1a", "comment": "Malware payload", "value": "fe2468f7870683aacbd1d9bf06515f16", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412987, "uuid": "1670ab5f-de9f-4175-9f85-e554a6f9f94c", "comment": "Malware payload", "value": "20c16e8fc6209e84a81ac74e875de6e90b1b406f11c3bafe2b3374f08ae6fccc", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412987, "uuid": "ca4269ae-46fb-4c29-8f99-b4b53714154a", "comment": "Malware payload", "value": "8c008f3bd006fb94fa76881f5598df7e87a66a05", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412987, "uuid": "869b8f69-2a6b-4b7e-8579-b32ec4b0cc37", "comment": "Malware payload", "value": "e8fe5290c62360db9db327b1c77382cee1b8bd0eecc72b60c4c299246dc80702cabf0cca377793a5a71e74dc8fd0d563", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412987, "uuid": "48dd9ef5-818a-45a7-aa2f-7b7ff706f859", "value": "T1EFE5D15D84B05CD26014FE74F685FBD7CCEA53852A2B07520FE4858A3352C83FAA77A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412987, "uuid": "7382c96d-05d0-415e-b3b3-fd435d48676a", "value": "24576:2W5Lt5sUX3ZIuD+RYRs4fxg/M9OwbfoINDDCGnMKLALcdzJHccjR31t39gc7gyJd:RJqSfVfJDTMET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412987, "uuid": "de78c521-e228-4f72-91bf-5c5a6e18a966", "value": 3263228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412987, "uuid": "5b1d5c26-8df5-4e0b-b2cc-886320fc8c21", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412987, "uuid": "139d4089-f51f-40db-a672-0e0f1da8391f", "value": "fsdf6456ffghfg4234dfgdfg343g3cvbhf544h4dfgd34343676hfgh45.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc2cf2c-ccdb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764390164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390164, "uuid": "9357699f-f00a-4b02-b53a-53155d023e90", "comment": "Malware payload (Mirai)", "value": "075faca0509194dff2befa9149dc4a39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390164, "uuid": "fe34e29a-d6a0-43ec-b7d5-f4d66166ba97", "comment": "Malware payload (Mirai)", "value": "20fd8eebf66afe0aead82075f62855d6e60ff85cc979fbbb4c5c55fb70af5221", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390164, "uuid": "1c723e2d-2813-4349-81bc-1e1b9707ffd4", "comment": "Malware payload (Mirai)", "value": "c0a601eebdc0a9430198261323f1f3fff45ad467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390164, "uuid": "4c3d24a0-8640-4a1c-83ec-1e46502d07b1", "comment": "Malware payload (Mirai)", "value": "d5ea376fbddfcadde0aef4a71ad5574c5b5fb70eae0805a01199efb7fbf155fe9c2a27d4eaabc8d919f3fb67156bda52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390164, "uuid": "e76d2983-ad17-4be6-ba12-756c7abea91e", "value": "T15EE2E16173006E218E695876CA944DD919095F3C5479AC1120FC466C2FD3AC77BEEBD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390164, "uuid": "1ef43034-6078-492a-9887-1a4c240913dc", "value": "768:vmPMhb2QJnpc2njHymYjjzj/G73yxkFj/9q3UEL51:hhb2spcK7tYjPj/G73y+oL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764390164, "uuid": "ae441261-8d08-4cd1-9ea4-0c3a6ec15a45", "value": 31740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764390164, "uuid": "48a7e515-9822-4a22-bc75-166f69395bd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390164, "uuid": "27460b3b-44a7-4d4b-aeac-f27d6aee46b6", "value": "SecuriteInfo.com.Linux.Siggen.9999.20500.31040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9623af81-cd0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764412298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412298, "uuid": "14c0ca26-7113-42e6-86b1-d4f8407223bc", "comment": "Malware payload (Mirai)", "value": "adad14b70434886129b215ac5243ca2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412298, "uuid": "300804e5-ed57-4f6a-86da-0184a8d8105f", "comment": "Malware payload (Mirai)", "value": "2154b07ce5738f528019b8df271bd57def33e940974548aa539f13ebe47e5973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412298, "uuid": "fcb6e704-b0da-497c-9ddf-39157507c0c7", "comment": "Malware payload (Mirai)", "value": "917ecd7bf7547ebac51529d84f8489a8b6558321", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412298, "uuid": "46502913-b770-4b43-bd2c-323a98413570", "comment": "Malware payload (Mirai)", "value": "dbab23b86e50ac67b3570234facb6976c80a4b2eab1be64a07442a7bbaa424e82875c33ccdda030e34c28808d9f427ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412298, "uuid": "e13f12e8-1a1d-4227-a3c9-d98b1162636e", "value": "T1B543F11C646466D2DED8B130A689A70E5868C118FB5034D1BDDAB8522EF9F6CBA3C3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412298, "uuid": "c00bce16-7604-474f-8fff-0a68340b04df", "value": "1536:2T2kMENGTxGf/aulbyfMEqJLOzvnouy8HyG:O2GYGfb2qOz/outt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412298, "uuid": "b6139162-fab9-4c47-bcdf-ceb380e9b234", "value": 56300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412298, "uuid": "407e4101-f8e5-4749-b22d-0d7a823919d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412298, "uuid": "d3e992ce-d6de-4865-910f-9ef2438b7617", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884c543e-cd24-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764421723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421723, "uuid": "25da2617-3b62-441e-acf4-168574e809b5", "comment": "Malware payload (MaskGramStealer)", "value": "fa216ea38903451321cbb883cfac51a3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421723, "uuid": "abd2bc5d-3e03-4477-9231-dc0db3e2e6de", "comment": "Malware payload (MaskGramStealer)", "value": "222e03c097595d8bee2bc348b7ac716a308a566d61ffb14a343610bc4656aeb8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421723, "uuid": "f627168e-9abb-4477-967d-1282853b553d", "comment": "Malware payload (MaskGramStealer)", "value": "c9f3320eb9ef3dfe9f6ffb1f5efb7cc110d61b77", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421723, "uuid": "4bd1039b-dfa1-4fb7-96f6-599b6bb9dd4a", "comment": "Malware payload (MaskGramStealer)", "value": "d210eedd96edcb3f21c2dd98ddbaded18e693599dd0d70de79cdb041c528e60309117fd60abb990096e4aee9e2520a99", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421723, "uuid": "c140b904-0fa9-48b5-9e93-ccaaf1fb0fb8", "value": "T1A1E5330037E5D7F1C9920B71A89537612DF4C69C0F52CBCBBA8919296F386C1FA392D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421723, "uuid": "4af9a730-e3ae-4849-8130-5762ab9e6733", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421723, "uuid": "95353b59-db34-4a8f-8ec6-c6d7e455ca91", "value": "49152:EI5yqojTq5fbWUbsce/zgJGuLq5+TxyTW/wHc1X01S7VxTI4YewRjB:EI51ojU1Ie9LCyxyT9H0kyV5HYRRjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764421723, "uuid": "fa1709c2-0475-491d-8184-9ba5b53426bc", "value": 3157080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764421723, "uuid": "eeffa422-e596-48ba-a59f-358be6330bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421723, "uuid": "863bb894-e171-4306-a44b-8399a0099a47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0aba893-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389149, "uuid": "6a7e7ed3-2092-4da6-94be-8aafb3d3c005", "comment": "Malware payload (Mirai)", "value": "372e81c047d624260b55acd51db809fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389149, "uuid": "41925111-84a0-4136-9ed0-1a8c2c586984", "comment": "Malware payload (Mirai)", "value": "22779c1d1025dd431cf82e09f2354068e46b38d6a8b361e7e1e0c69f6dd8a9ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389149, "uuid": "fcb927b0-0c15-4c37-9aaa-25847c7d76c6", "comment": "Malware payload (Mirai)", "value": "d44c5b55ce42b79c4b95e9a6bb5f14236bbc26f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389149, "uuid": "d0a0cca4-65a2-47c7-b1c4-157bd96bfe25", "comment": "Malware payload (Mirai)", "value": "6e3122825fbba23a27fc8f825d8b25088a5907bbf0aeb4e971602abec5e7fa662fc49847939b3f204a406bc50f83caa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389149, "uuid": "05a435e9-ce03-4ac3-993e-6d9702a6117a", "value": "T1F703F1201B059A23C179D9352E1F9701638F57748AFD61A22F6C049CBFC644A7A7ABCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389149, "uuid": "f2a12b3e-5e4f-4a54-8644-44443cf88eff", "value": "768:qPD2kAmMLT3LPizvv9RHU5R58TszAZ3Ehgs4Tvzs3Uoz9:UcLYvFR05/JAZE+ez9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389149, "uuid": "a32bb508-8db0-412d-969c-1dd59e11c453", "value": 40120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389149, "uuid": "b62f3773-0f45-4558-b1b4-2275dfacb6a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389149, "uuid": "d74271e1-e308-40cd-9ef4-2d1b746b8267", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e712088d-cce5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764394824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394824, "uuid": "b284d6be-79c1-4902-8459-d94cdfb1737a", "comment": "Malware payload (Mirai)", "value": "f6c96ba3445c510ecef9ece430af334d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394824, "uuid": "7a80008b-0560-45f9-8d71-1ba71cfcf13b", "comment": "Malware payload (Mirai)", "value": "2289868df72301ee613343aa9da948885b9bda530193dbee40e66b33c8936721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394824, "uuid": "ea0e08bd-42dd-4482-8f21-e5aa04fea00c", "comment": "Malware payload (Mirai)", "value": "89a833744e09a24d457204ea35f32b36cd81ae8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394824, "uuid": "364fb277-e221-44d5-b818-50757294e336", "comment": "Malware payload (Mirai)", "value": "3583898ddaad485571557312a0c144084353fd75f9e68dca93263ebd6b00a5915ecaaaad7417331f5b0a1ea218565058", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394824, "uuid": "632d9941-01ad-4818-a6e9-1bd84e10d460", "value": "T1EF432B31BA71181BC8C5987A61F74365F2F5478A24BCCA1B3D720E8DBF64640735B6B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394824, "uuid": "2469100e-61c8-46d7-a486-05a170e29265", "value": "768:rQ6kpWPXYgIkss7FzcAk3IfTO+lgG5V+lld01tcoIz3:rQ6CqOfs7FzKslh51tcoC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764394824, "uuid": "39a67c6b-6701-4960-bcbd-3ccf3ea40c92", "value": 58752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764394824, "uuid": "925fb368-dabf-4ce2-95cd-4885a9a8e855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394824, "uuid": "db08630b-2a61-4af6-b62a-c7bf1979c8fe", "value": "niggah.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f78b466-ccdb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764390167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390167, "uuid": "cc1f813e-edb7-47d0-8046-3e4d60c97057", "comment": "Malware payload", "value": "b21374d76c488f33b34fab9ac7ac73f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390167, "uuid": "e6b17ed9-a98f-4c6c-84fd-0c557b1eb45e", "comment": "Malware payload", "value": "237eed4a94c22a967bb8b3233affdd3a081c32d28355e259106b43a4253c067f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390167, "uuid": "04a91ca2-4fbe-4b7c-81d3-d2e6d1601365", "comment": "Malware payload", "value": "5b6eec95965c231e30dc6ae05aa5f4369f4c09bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390167, "uuid": "7cff9ddb-af7d-4b50-b259-b728da11c145", "comment": "Malware payload", "value": "24444d50463447bbbade94e3e9531c39d0664a460ab003e8e0911b5c4827382ba601828048751151bbca59b4815e2e16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390167, "uuid": "70c7204c-1de8-4594-8ad4-b5ab3fbea477", "value": "T17A433C32BA71181BC8C5A87A66F74361F2F5478A24BCCA1B3D720E8DBF6454073576B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390167, "uuid": "1aeadaff-c292-4162-b82c-3aea2afffcac", "value": "768:1fSGwYggkUs7FzIr/5b9dOTO+lgG5VXVV5F1tDsaoIQ:1f6mXs7FzMbalh5PtZoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764390167, "uuid": "092763aa-a1b5-48af-902f-2cfaead6d6af", "value": 58776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764390167, "uuid": "444afe7e-5428-48a2-b04c-7cd038615ba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390167, "uuid": "7b08aeb4-2051-4ea3-b42a-d242e0461dae", "value": "SecuriteInfo.com.Linux.Siggen.9999.17855.26687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f6a916-ccb6-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764374636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374636, "uuid": "be63b78c-da78-4a4e-9fd8-2af9df29f208", "comment": "Malware payload (RemcosRAT)", "value": "e50fe53a90b5eedd2b58f7f4dfec6bfa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374636, "uuid": "8fd8c31a-2c44-497e-9373-a7e820e33590", "comment": "Malware payload (RemcosRAT)", "value": "23a2a5f03848c37b276b28922d3f1f0415c188e6bf70a64bef2cc34f96da2de5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374636, "uuid": "6ce7e0e9-730c-4500-ae63-dbf9d549a087", "comment": "Malware payload (RemcosRAT)", "value": "13bd87faa155e91102ec4e1bf5b7d467e1e37af3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374636, "uuid": "0c73968a-4f62-41ef-bda4-e572e4e28423", "comment": "Malware payload (RemcosRAT)", "value": "434069e0f9268fd5d94b41309d6d59501b78825bf52b1d649e20c73943f713b0144a6075bfafe590ac6b6ecd572c44ec", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374636, "uuid": "ded7cbf8-3a09-437e-876f-531f83349cca", "value": "T19AD14C823B43E033BC764BE29C0E56812EB645FBC8A3947C529571DB9CB8225B13F526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374636, "uuid": "d6e8cb60-874c-46a6-8069-11c1f9ae84e0", "value": "96:ebEQ1sD5+MM8/IUs3qdyLoXBJMwqqxBFEDw6P3lhSFyc6CLFvURwOQUGj/kRa:iEo38/I/3q0LoXB6q9ew6U3c6jua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764374636, "uuid": "bafb54c5-f789-4ecf-aeea-5f35954936bb", "value": 6618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764374636, "uuid": "bdf4974c-d37b-4f8b-8f62-1013c0c872aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374636, "uuid": "b21f96b8-95f0-4283-9ea8-99a59d6658e3", "value": "Arajanlat kerese - UT10025 - 200 db.pdf(35kb).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcc89fb-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764391986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391986, "uuid": "c6e22fee-17ae-4af7-91a3-d778815ab29a", "comment": "Malware payload (Vidar)", "value": "c7158731153ba46dcc2136e284e5eacf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391986, "uuid": "b69e59e8-bc87-4742-bfb1-f62366cddb7b", "comment": "Malware payload (Vidar)", "value": "255e283e933a51b34fb82c27828b11fb33676394063bf0c33c3695f2aecb327f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391986, "uuid": "6cc6c5c6-9c7d-4110-9d4f-9e3dfe86625c", "comment": "Malware payload (Vidar)", "value": "39d1900fad10bfe143bf457df912f2760863aeba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391986, "uuid": "2afdb644-90e6-43be-8058-2e0be323fbd8", "comment": "Malware payload (Vidar)", "value": "9616a489d38ab3d4b6499237eb26d19235caddcd2810afa18aa0f08e55cec923e23e941932fffd3d499c983052024204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391986, "uuid": "3db8855f-6552-4f11-b498-faa653cf7229", "value": "T1F016AE216EA257ACC5E4C33CE46361A033607C08073E23D71FD366365E69BD156B6BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391986, "uuid": "e69630c4-8df1-4505-9a50-c553906f8453", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391986, "uuid": "829acb37-96fd-4c08-88ad-703ae365fffc", "value": "49152:0wza8xEV3kxxqN73LLD99Ph8ExI5u5/fl4rrYQuBnQ80h:0DvUbqhnDpZf8YQuBn7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391986, "uuid": "3a44392d-8fc4-4978-b5d7-21d3e467e3b7", "value": 4065110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391986, "uuid": "a6e26218-9dfc-4150-9ed4-abb35be451ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391986, "uuid": "c2330f8e-ed7c-4620-831e-eadeef9b38b8", "value": "a0qn6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544839a8-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389853, "uuid": "d15464a6-96af-4d30-81c1-99ab5cb3cec5", "comment": "Malware payload (AsyncRAT)", "value": "a5fe8bdeafdfeab6704221b55a5736cb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389853, "uuid": "1105f25d-b49c-42c2-909c-9d084ab6dda5", "comment": "Malware payload (AsyncRAT)", "value": "26faa0e3e27664d7ffe058a8e2a6a7a19777383bfde7ab22d92ab0714177f9a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389853, "uuid": "2a0c2b7b-6c62-4ff9-8902-fb981d30d5ab", "comment": "Malware payload (AsyncRAT)", "value": "2c0ec01f7c718cdc133bd7c51f221e7fc49390df", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389853, "uuid": "8415af25-90e8-4e5d-b199-d531fac351c9", "comment": "Malware payload (AsyncRAT)", "value": "df320898c9ddc462881d1f2437342ce019114e496e59d8c8259f54720f04daf0e0c43af85969d71c041bff773f937e0d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389853, "uuid": "98d0e362-feca-46e3-886f-37392beb1fd9", "value": "T16FB5E70667F94129F1F36B71EEB993645A77BC71AE3AC50E1284125E0DB0A90DE32733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389853, "uuid": "47688203-2658-4196-bb39-1a88c52f33dd", "value": "5b02d930e340e0ac871ec494d50401a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389853, "uuid": "fdce4818-c243-4f79-af3b-241c9c25d4f4", "value": "49152:ROXGQ6m1R2MtENFNZCWOLT4yXGQ6m6K2MtENK:qGQ1UwnLTbGQHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389853, "uuid": "f04a7adc-7931-4e31-9cab-c003b1a6c524", "value": 2474776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389853, "uuid": "1d6614ad-bed7-4fed-be06-2e85b92b5c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389853, "uuid": "e8d7986e-d779-461d-89f6-83b3f4ea86e7", "value": "AdobeARM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261f3865-ccdb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764390205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390205, "uuid": "898ea1ae-58b4-4da7-af9b-35ee5c8bbc03", "comment": "Malware payload (Mirai)", "value": "723c363733769d50cf5a1563d30920cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390205, "uuid": "0a6792e8-bc7e-47a2-8cb9-f7bd01b44017", "comment": "Malware payload (Mirai)", "value": "277276fc79af7fa085d62f443dd1d1057a0a20d3eb28b9711b5f518ce7b51dfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390205, "uuid": "7f25607e-26f0-4e7b-9bd7-7ff0c734835b", "comment": "Malware payload (Mirai)", "value": "4799091524252910bbf3b6f2872bf588784830c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390205, "uuid": "4e8cd92c-28a2-4eba-a896-6ac3fb54de18", "comment": "Malware payload (Mirai)", "value": "d84c772d0ab6607a68fcaacf035bd9e924d64bd52ff53e7582081da44d0cdf26557ab115ef8896b8a5be8fc4f6a17df3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390205, "uuid": "2fddcde1-93de-413f-bb5b-cb48dc39bfad", "value": "T126532A56B981AB11D5C112BAFE0E128E7323176CE3DEB3139D246F24778B56B0E3B416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390205, "uuid": "0512951a-0279-4e88-99f3-96cd024ca0f9", "value": "1536:manvNEgyV+TgFjLmPa56T+/MYiPcqy01Ygu25KYCV:F9yITCyPa+cqy01Ygu2UxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764390205, "uuid": "2d2ac7fe-8e66-4758-91c8-b5f72e79a730", "value": 64312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764390205, "uuid": "a2f32bfe-9310-4560-9af6-5cc464070424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390205, "uuid": "c5275b56-3096-4b17-b7ff-98004d096bd4", "value": "SecuriteInfo.com.Linux.Siggen.9999.20500.31040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae10196e-cd0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764412338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412338, "uuid": "d0ba2dc7-39bb-471a-94b2-1b2826d41fb1", "comment": "Malware payload (Mirai)", "value": "71e9cbcf157485187cdc127c638f842a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412338, "uuid": "9445c648-7dbc-422e-879f-5ae6d054103f", "comment": "Malware payload (Mirai)", "value": "2793d2896d769e2ae89d154824273b9bd909ac350e90dc5085cfb09e14b13884", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412338, "uuid": "de2ab0c6-38d2-4bf0-8c72-69f23b610d00", "comment": "Malware payload (Mirai)", "value": "5807bbf3854ec63f94867ed0ce1c9a3096ce9b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412338, "uuid": "7e5f6d4e-059d-499b-ad6f-6b463adf912e", "comment": "Malware payload (Mirai)", "value": "0f2dc6fb2df89de3677a6cde701f294e3395808508fac0e046cc7119f6ea22004d882b591664812f67e039ee2914ff25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412338, "uuid": "b903fa9e-c24f-498d-9a16-ba49829804f3", "value": "T18ED35CC1E243E1F6D845093060ABEB32D976D536221BDDC2D7A9DB35DC226C1CA16E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412338, "uuid": "cf8dd6c5-ded3-4ae3-b7e3-7e0b100884ec", "value": "3072:FyUSubBVjNwnEEsOcZnYG++u4uwtXrBBe:Fy9ubzRBFOgs4uwtXrBBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412338, "uuid": "80c9cc25-308a-4a47-8270-245a5a6ab8e6", "value": 140784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412338, "uuid": "8a25a313-d412-4b57-bcd7-74d65e20d8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412338, "uuid": "79792a93-a942-4d16-aea3-52cd0670a911", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae487c29-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389145, "uuid": "6bea20a0-bc15-4c4a-9bed-9260a9aa471a", "comment": "Malware payload (Mirai)", "value": "a1a3d8046040f35a2b20400e6b07dce4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389145, "uuid": "d09c2374-bf57-4493-b167-80ec0b52f982", "comment": "Malware payload (Mirai)", "value": "279a2060b123f734d7afa160cc2c31f0b294d681a79f29fa9b9104fc61a36ce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389145, "uuid": "8e4713af-f9cf-44a1-b7e8-4a5ee0a7e863", "comment": "Malware payload (Mirai)", "value": "a55d33b047355337f679e5bc573aa6bf75c05583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389145, "uuid": "b7686f1d-6e94-45e6-b5e2-8dfb592a919e", "comment": "Malware payload (Mirai)", "value": "331b0ef5358fafa0f7a43471635ca7c7c7de9da031d66409186b9bbd479e12ccac8836102fc3602b443209a52afd294b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389145, "uuid": "45d1b5e7-e183-484c-893e-521fffc9d7e0", "value": "T1F303E1CB227ED974E4A612376D360A40F736F95175C21B4E3DF4742F4A32B452922EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389145, "uuid": "94994f56-f6d4-4e64-987f-1b2745de1540", "value": "768:NkUD9pmD5dMCz1eE8lx+on0T2robGZPepncGoyrcMW5W3iBHx0YB:euvMdLBeEy/nS2riuyrcLE3SxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389145, "uuid": "702a127d-ad90-4305-beae-e488f0774dec", "value": 40068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389145, "uuid": "c872f17d-cfc6-4bb9-9fc3-d9a3ee08ccf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389145, "uuid": "5dec5169-f79d-4a9a-97ea-c93e9fc1907c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329db588-cd73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764455510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455510, "uuid": "0dfbba87-3149-40b0-b045-f335f6576483", "comment": "Malware payload (Mirai)", "value": "92a6ef0b56adb3d0dc5120beb0c1fa5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455510, "uuid": "1d0101f1-993f-432e-80e3-7e00e870f00b", "comment": "Malware payload (Mirai)", "value": "28084f4172eab7c16060ec0d75a7eb69a07563b8c5ff8de22816d916ee833e19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455510, "uuid": "fdce5e55-4287-4d87-8e19-83d410bbfc35", "comment": "Malware payload (Mirai)", "value": "575c265d773267cb64764706da34465fef3d2a16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455510, "uuid": "b5d52987-ba1f-403c-85fc-1fa4d11068e7", "comment": "Malware payload (Mirai)", "value": "dde925bfb66c89e793855625d95ae6b39a897f5ba602a5efd6428f62ec853d1968b589639ded8370a42bad21a41fb0ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455510, "uuid": "f0d9eb07-fce7-49ff-abfe-2936ba07e768", "value": "T1E533F15D60E0A5D2E7654D3552CF0FBB4D84B1E8B69FAF84972258CDCB881AFE4848F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455510, "uuid": "3023ef4c-9ef4-47be-bbea-04bc12f45761", "value": "768:+VPEFUoG3LZ3abs+FIjN05WNDGv6FCSD+jD4fiUKK5Ss1v5wq4UUv2809yscWt:6PEoZ3abs+SpoPSD+QfzBH1RdUeRV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764455510, "uuid": "eb11d23b-0e04-4052-b3e5-84b0e402513a", "value": 50528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764455510, "uuid": "009efc96-effc-4721-93e5-83a277f47f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455510, "uuid": "a9ae9674-dff6-42a7-8dff-49fa02608129", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6dd8b3-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764443049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443049, "uuid": "eeee1a95-9c2e-44e4-9be6-8fee323247cd", "comment": "Malware payload", "value": "b38d03fa87a984b3776d5498c7869669", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443049, "uuid": "ea6f3720-5f1a-4afa-8dd9-948bb8fe37ca", "comment": "Malware payload", "value": "2828ec15d173f8c4727582fd144c4b21591ccb79edc0c7b025e198c1db807b65", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443049, "uuid": "7465f421-007a-417f-815c-76361b7608f4", "comment": "Malware payload", "value": "1747ff93fda652b411ffe17e53895bd443f8e9cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443049, "uuid": "6c7b0ad9-4122-456e-8e8d-19bc71156d56", "comment": "Malware payload", "value": "1d32e6cd33e1d6d10cd97ba4676151f6b4baa300e85b85320173d3dab715268465ec1df5d830c1fe8c892c40ecf68149", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443049, "uuid": "f932683d-854e-4357-9172-9a3a55834d50", "value": "T1182121CF1164BA55084CCF482066859871E4CBD0F0E50E4B998D79FBF584B2B713DF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443049, "uuid": "ffa9487e-e4c1-4cc4-a3dd-38e39e3cddb7", "value": "24:tBE52NGEcJNENIZEtsNUEVKTDNtEHqNUEO/NKMETKNS3E3eM0NOEKPlN7Ez8N5E/:S2mJ+sFQDKqK/YpKQEeBcPlS8Cu+rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443049, "uuid": "ce72e60a-c483-4836-abf9-d0844ffa380a", "value": 1222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443049, "uuid": "6f6e179c-dfda-476f-90af-4197632beb81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443049, "uuid": "02def127-6285-4e58-bfb2-2b74c70f6ded", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6f9248-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409781, "uuid": "15e66a44-6ea1-4edf-9919-ee1740f1d70e", "comment": "Malware payload (Mirai)", "value": "908750b8c2e31b2f46b2a7a9240a40d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409781, "uuid": "e8a8c094-0fb9-4615-91b6-3c13bbe00f79", "comment": "Malware payload (Mirai)", "value": "282dd2ca1411c0f576b37c67b47c92147524c5d6322b0301f8950e212c368f2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409781, "uuid": "ccbebcd8-c24d-45f7-9828-55549efbf328", "comment": "Malware payload (Mirai)", "value": "1e50ce36e5dfd3d9c393b680a1979fe3ed272a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409781, "uuid": "2b718baa-7dad-4785-835e-25a6470c92d4", "comment": "Malware payload (Mirai)", "value": "f40568e591c8881c12d80fb3ebb7c3d4fe52df654df6315e290553c43dc09dce55ee462ba70af808be861b711d7ba741", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409781, "uuid": "4cf11e47-66c8-485b-b7ca-505441cbd24d", "value": "T10F13E2A3D8B6538CD57F61B805EBB31D40107E6D1490E86DAAD4101F6A85F94AD3CB3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409781, "uuid": "731d79b8-3468-44b6-b9da-6fa106e6b04e", "value": "768:gmtdUupPjJqwHW5iQzNXh7mWOTf+Nyq8vo3M2NxHCc31c7yspKKnbcuyD7UHQRjt:dPR0F5TzNXh7m7+NydZ2NJVO79nouy86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409781, "uuid": "76ba5db5-2037-4bd3-9384-c2822f4dcf1e", "value": 45444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409781, "uuid": "705f1924-c5ec-436b-9240-22c602b9666f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409781, "uuid": "97d00098-cc4b-4fc6-8e9b-5865cfde85a5", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec088fc5-cd0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764411583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411583, "uuid": "8c20207e-520a-4d44-813d-53bb1e0d6da0", "comment": "Malware payload (Mirai)", "value": "202d5844caac069f0e0a90c0dfbfff47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411583, "uuid": "bd038736-46a6-4aad-a69a-53d08bf0e33d", "comment": "Malware payload (Mirai)", "value": "291c6c8fc3cfd7763c0154a63fdd91169228ba05d5dfb02cfb8ea46e31b7b111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411583, "uuid": "1063a7de-570c-4202-a8ed-3c19aea2f8f6", "comment": "Malware payload (Mirai)", "value": "731874877585fbaa889cb68f5c41af9bfa551a7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411583, "uuid": "29bbb8c7-2340-47ca-b7f8-5aced5f5c8cc", "comment": "Malware payload (Mirai)", "value": "d0bfa080ab1ffa22adc6c7784067f6457dc31803a5565b043319fb07cd27364bc36ee41429d383cd16a147771302a220", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411583, "uuid": "b659e5e6-ee3d-491e-bb61-13a1d31350c5", "value": "T15AA3498BF382E5F8E91902F521376B3B4232D6360012CD45CB7AAA7EDD65642DB1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411583, "uuid": "a16bf6f5-cdce-4ab0-a8de-550a4497a783", "value": "1536:Ap7WRnhsR6xgmk0fqQ55nOzAcmj6+e/Rfhgqgi04kuQ3C9N10sh/LEvvRH3Vb:AWHsEQjzqghcKkt3SN1FdIhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411583, "uuid": "3da3041d-6878-4c64-84ad-d995867a6ce7", "value": 104388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411583, "uuid": "9cc267c7-ebf8-45d7-941c-11d3485d6b24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411583, "uuid": "4fe54a0e-01af-4017-bf20-ca3b4116cfef", "value": "rondo.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b352a3-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393218, "uuid": "98cd73e6-0bcd-488a-81aa-cdb225acf4e4", "comment": "Malware payload (Mirai)", "value": "f7ee9ba31f0b19836c1c2260c6674089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393218, "uuid": "676e9486-b55f-4a5b-8bf5-624c107e9aaf", "comment": "Malware payload (Mirai)", "value": "2978a4996ccf6399b46d568bebe232ce19185850e1c99be7563d1683f521d9ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393218, "uuid": "49d456e4-ac61-4b6d-b5bf-490d86a3b779", "comment": "Malware payload (Mirai)", "value": "acc38e3568dd72fe0b05ca02a0862d24725fe61d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393218, "uuid": "5312c066-53b9-4dcb-a0f0-443ca9ac84b3", "comment": "Malware payload (Mirai)", "value": "c789ab090aad8143c74c388393ba65400f644659d5ef6bc38c65e3ad4490845f97ef1e289017e0e881080d763de50990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393218, "uuid": "21af3d53-686e-4e55-8669-90533fc2e567", "value": "T14262B0307D5DA833CFA1153AFC3C48C9BD0527F541EE3616622086D4B9C52C66EEDA5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393218, "uuid": "e0f6de56-ea46-4393-8b08-f45f363f474d", "value": "384:A6aP8xCJ3fI1mWG1IL9dkh7qmdGUEpiafMxr:zoQId1Irk9q3UELfMxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393218, "uuid": "b74a9dda-1fd2-46ba-b650-f7cdef4a38a6", "value": 15928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393218, "uuid": "8905433f-8a25-452a-b534-eb78658613d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393218, "uuid": "7eeee605-ada8-4047-961e-c910f5725f52", "value": "niggah.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3cdd7c-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412957, "uuid": "312f643d-b7c4-4cd2-9379-aa5ece6279e4", "comment": "Malware payload", "value": "b3d80d5b54a198ade8aa0f9ff14e7f71", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412957, "uuid": "149b1660-bd4a-4761-b950-141fb5249680", "comment": "Malware payload", "value": "2a72f7adec8610009356139701b21e025193e4956e8ff6812e95241920637525", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412957, "uuid": "0afef515-eb32-4e18-8be5-15be2bfa02e4", "comment": "Malware payload", "value": "28fc2305ea416a01ce858c67f4ae531bb194cf61", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412957, "uuid": "828ca115-b4ca-43e2-a238-94e59370c63d", "comment": "Malware payload", "value": "8bf3d470ea66b3206490f1fbeb56125e21ad797056795102b77c74931c46447e3f713d589deac12027e0f10672fba8ee", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412957, "uuid": "16be5b30-d876-44d9-bfe0-ed8870b37f20", "value": "T126E61227F7496D6FEDF7A3347D7A029610256C658F03E18B7829B33C28B35C65A8A1D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412957, "uuid": "94a88a27-8d26-436d-932c-5c8af947f95f", "value": "393216:jZHQJZMnGUD1XkDSpOcSbZErLa2em9E8RA7YCK:jlQxUraEru7r7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412957, "uuid": "c8230e59-276c-4050-bd56-b72b2f7049f9", "value": 14775924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412957, "uuid": "679a7db9-3597-433d-80db-ada3e31accff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412957, "uuid": "dfe35dba-883d-4acf-98fb-83a7dca462a0", "value": "RODONAVES-RASTREIO8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b618f86-cd7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764459819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459819, "uuid": "fcf43a28-ec01-42d5-a7bd-881fce3518fa", "comment": "Malware payload (Mirai)", "value": "1b911f574fea64f5e9a92ed77f8859ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459819, "uuid": "abcd9c7a-5557-45cc-9d2d-9bc0b4b64857", "comment": "Malware payload (Mirai)", "value": "2aafb467d9c5e79f40bf92d0538d6632ff7dac2dc453ffd67c774ab9cf6152e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459819, "uuid": "e87e41fc-07f3-4682-8769-59d05765eed3", "comment": "Malware payload (Mirai)", "value": "027cb47694a5c895199b9a14fefd0f53a905c2a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459819, "uuid": "31be933c-3551-4224-94f3-96710bb7e5f1", "comment": "Malware payload (Mirai)", "value": "76dcacbbdd97a11218ae5da1f3f7860d7bdeb84f5db21197e1d115ac1babd503c2ce4a50853f6cded995621178d7708a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459819, "uuid": "10bd11a6-6f8b-4e5c-bdbd-3a9dc843bfa1", "value": "T185D2F1B0262BAAD0A6B4197E7BBC8A049526D438F0BF79731B9063A2D8C7095107C7DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459819, "uuid": "a14a3d9d-3e4c-4b30-8ba3-46cc519ccbec", "value": "768:3qb/SksuOJERJN634ZZCPzqN4pEs3Uoz/b:38/SeOJMGUZ4zuKhzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459819, "uuid": "5202fba0-ae64-47d5-b95c-39cb17702e8f", "value": 30976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459819, "uuid": "c92dfed1-162a-489a-9359-5f2bcd37c070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459819, "uuid": "0b6e7247-a81b-45fb-b7bd-fc5df11af94c", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0edcaa9-cd37-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764430059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430059, "uuid": "00ef61b0-2d2a-410f-bc4b-310818ab17c2", "comment": "Malware payload", "value": "6a042188e15fc12dbab370ac13dea5c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430059, "uuid": "0dfb2fe0-3d6a-4acb-bb21-0c548d3009f5", "comment": "Malware payload", "value": "2b6802752dcc4521413723ef4d59ef4a49fbd96250b5145b2ffbf32be720000b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430059, "uuid": "e497017e-f810-4002-86f4-73ca4994b1ee", "comment": "Malware payload", "value": "dc28098e7381e92c67b6f8a60b808eedd5a42b9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430059, "uuid": "86fb808f-f1d3-45ec-9ee1-4294afe7a3ce", "comment": "Malware payload", "value": "44f9a6936be096a4dc980b62eb9d6eeccaac35d2bfbcc498b4f4fe319777dd4e00a8641b9fe94f46c5820180071d3a9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430059, "uuid": "060800b1-4a05-494d-8548-012f42e5df39", "value": "T105553309C371C17EE25391B2EBB6195DA89C7C51A3A309FB84F62387436D9C35F2942B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430059, "uuid": "a40914e3-171a-4546-a6b1-5eb8f57e1731", "value": "24576:c7d0mv45nyMNZLk9HaPtT4I2YIt+ETfH+JK70P+HrgZS43lp2Jsr3+Zo0/N:c7d0mm3O6PtsIgxvPY9S4VrroN/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764430059, "uuid": "007f18a2-3d1a-47bf-9cff-92c8f0e536b6", "value": 1353728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764430059, "uuid": "8c146659-1a9f-4a6e-bd32-7f389882490b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430059, "uuid": "21a9e34e-0d56-4739-9426-643e801612fc", "value": "SecuriteInfo.com.Win32.Agent-BDPB.88865645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284c3f3d-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393215, "uuid": "7d449a37-2d03-4ada-8217-e04f1c4e81b5", "comment": "Malware payload (Mirai)", "value": "4faf12eb1da9b76f3d146fdc6a0adf2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393215, "uuid": "11a3a248-73df-4b01-91c7-dcabdf4db296", "comment": "Malware payload (Mirai)", "value": "2c06e93e8ec255dc3b9fd6836b3df35d5e10dae39029d8ba057282af3192071e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393215, "uuid": "bcc677cc-7c15-4d0b-a4a1-987b8edae81f", "comment": "Malware payload (Mirai)", "value": "ca65b26a9b322814f1c8e00bc493b56fb2753b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393215, "uuid": "a141ab73-a778-4771-a058-bcae331e0204", "comment": "Malware payload (Mirai)", "value": "e933acb2b87fd37a30a01d6e3989a84887263d513ea9d5f0be1db42bab25ee097a6eca861cd67057137748aa0e31a391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393215, "uuid": "8bcefb25-126e-44c1-b51d-29bfdfc6f511", "value": "T12F13F1B4C166BE51E63B39E52EC8E24137603EB5FB7C1581E149DF622B070261A3EDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393215, "uuid": "bcea0cac-1e54-42ea-b0ba-b4234f7a76ff", "value": "768:LHyyCLamGpZ1NAbgQMbXPwvmWAOZPbwEcBAi7pBkfdtqTl7wnGQdy4uVcqgw09C:LHMaf1ObgQu+ZM7pBkfJXy4u+qgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393215, "uuid": "afcdc2dd-ca29-466d-a5ef-2b145f6819ed", "value": 44360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393215, "uuid": "26b2deb3-e9a2-404c-8d0a-1aea125f97f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393215, "uuid": "b81b16b4-201d-4703-a18e-eb77f1f9a165", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb84e99-cd0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410837, "uuid": "9a45a452-a39b-4c3d-9fbf-409ba7558445", "comment": "Malware payload (Mirai)", "value": "d2af7b2db2520084a1af8ab5a66a0ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410837, "uuid": "7b20ab04-e532-42bd-bb6f-5438d6aee98e", "comment": "Malware payload (Mirai)", "value": "2d1fccd5e7c6effee28c1e7bf0b03acdb3295ae8d083e20ea03f156bc41a065b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410837, "uuid": "33741d5c-9a6a-4ca9-be2b-a6b666524347", "comment": "Malware payload (Mirai)", "value": "af1d70ca20b4ac5354980ab9aed9471e8dfb4935", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410837, "uuid": "63c0a0d2-aed0-4cf0-ac7c-b010015f4374", "comment": "Malware payload (Mirai)", "value": "6e17c740e3b5b3002ad2530ed1827058e7160c81e3b2e34d22bc46fa53db80c7bf2fde93a44dbf3825fcc6f5d4435dea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410837, "uuid": "453bd1db-44d5-404b-b519-f6d42fef08a0", "value": "T10EE35B02772D4E43C1A21AB03F3F27E557AEE5C221F0B645265E9B1E81B5E77184AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410837, "uuid": "dc1de5ff-8705-4a1e-9e6e-925f84c984f4", "value": "3072:bmjKlM2ppgPRZlaYoHpRyEYzABKrp0dpt:bY0ulaYoHpgEcUap0dpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410837, "uuid": "ac36842a-79e0-4e3c-a58e-feff4cd511eb", "value": 153368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410837, "uuid": "4cd0017f-7189-4f02-8e57-f4d89b0c5e32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410837, "uuid": "b99368cd-6abd-4b61-a24a-c24524008734", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4c9892-cd2e-11f0-a129-42010a9c0007", "comment": "Malware payload (RapidStealer)", "timestamp": 1764425918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764425918, "uuid": "7be9c8b9-b2a2-4a00-a371-1cc54c207a81", "comment": "Malware payload (RapidStealer)", "value": "eda0159a28f22c9a07023591640695d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764425918, "uuid": "7e7dcbfa-bd14-46f7-9c2a-1cbedd28121f", "comment": "Malware payload (RapidStealer)", "value": "2daa85b39f3abd83588a142eff2d00476382336ab0f6d69bc68ad52b7302668e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764425918, "uuid": "d691e72d-097c-40fd-ba1f-88d34930c598", "comment": "Malware payload (RapidStealer)", "value": "c59dcadc6099e35f1f62511f3e24cd602e84966d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764425918, "uuid": "f3ecd701-bb69-4b9a-82fe-1fe09d59259d", "comment": "Malware payload (RapidStealer)", "value": "8f58bb469f6f67260948337cf1dee0cae9fed664cfd89f67767037ddbf22152578c842ced04794ad1e2439370926c1d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764425918, "uuid": "a62b44bf-8671-47c7-9b15-4e252fd771e2", "value": "T1B0283384C1622E7BE4B6FA3F9196DFA5024B39DC6B629A47E32F77B537B04512E13100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764425918, "uuid": "cea9314c-7c88-4289-aaf9-ec6837998c36", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764425918, "uuid": "d07ade99-b1d9-4ab3-9498-6f4ecaf0a827", "value": "1572864:Xu4lH6RQcY1Qj3Of7LqFdzLcBdyNyBmiA25FWeQSuS4614:+4N6R4PqFdncBdyNdmMeC6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764425918, "uuid": "a98f9096-f619-4d88-8473-e184f58b937b", "value": 96140704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764425918, "uuid": "917ef838-f7d5-44a7-a742-5892e22529ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764425918, "uuid": "f22cea7b-0d39-4457-80a2-5bffa92b499d", "value": "LunnyClient Setup 1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6775d195-cd70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764454310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454310, "uuid": "ae6cf881-21bb-4d6e-aa5c-a6239bba9b15", "comment": "Malware payload (Mirai)", "value": "b82bfc11a8be196191fe38eb573f223c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454310, "uuid": "01a1d0ba-4bb7-45ea-b0ca-827355e31e0d", "comment": "Malware payload (Mirai)", "value": "2dcba460f26d67d29ae5247a3912a7addf009cf34609f2b5705f894e34bb8bbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454310, "uuid": "2d2380bb-36d7-4bb1-a6c2-ffe0a90056b3", "comment": "Malware payload (Mirai)", "value": "64d348b24f54915b3e7962ca93978f32b9630763", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454310, "uuid": "8b2c3c43-cedd-49be-beb2-fa587f9acc94", "comment": "Malware payload (Mirai)", "value": "4c3d92def6525a6a29793f7de7ae9dd8d84cada1198d3e6ca516c6fb85a4511f85ad49778421970ef9afa8f0b9c551fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454310, "uuid": "587ac48d-ad61-46a1-95b9-72a4b65b526f", "value": "T18723F151B3445ED4D6A15D7C9A3243CD3D8603B9C07A2EA2291F14B87D1712EB0B9ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454310, "uuid": "cbe6977c-009c-4906-992e-e6e33b30174a", "value": "768:Zwq7sM0aAK3kn2nauTCr0YKbYxGlx1tq7H7YPkvlsjXGtbKOxXz5Ys3UozA:Z7sxaAKLBSG9tq7HsPkvejWnxjfzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454310, "uuid": "17eb2535-a226-4528-a0a1-1355ff291817", "value": 47368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454310, "uuid": "217182ed-888f-4afd-9171-b8239f8fc20f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454310, "uuid": "bfcbb1fa-154f-4c5d-a552-7de797910f42", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2feed87-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764392133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392133, "uuid": "7281d773-301b-404c-82e2-35cfa8dd8165", "comment": "Malware payload (Mirai)", "value": "f4a4824973b13a9a6afc64ad8e88ab1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392133, "uuid": "1834ddf4-55bd-409c-a0f0-988f96bbcc5a", "comment": "Malware payload (Mirai)", "value": "2f7fb71f64fdd94ee4f8e3e2435ad5359c565e1e35b0c0849534d5672208e9ef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392133, "uuid": "a6b01460-f473-4b5e-9a9c-63dbd80734b2", "comment": "Malware payload (Mirai)", "value": "d5aaf4039f0fbf89c2f676c05b8888925290ff45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392133, "uuid": "951a0374-581d-4214-906e-c6c2ec38ea57", "comment": "Malware payload (Mirai)", "value": "4547461ed8e1637246d60076dab4337a913aee44ea0e80ea6d5243d65d3a98223561b2f388a6dc020861fabdef073529", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392133, "uuid": "1a2810e9-0bff-44f0-abc6-964390055b05", "value": "T1914105ED6222487F2E51591AF1EA4E10BCD04D6258CC9E6B9ADC34F9404CFCC64FAAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392133, "uuid": "9fd2233f-49b0-49d6-a5b9-7c4b95783830", "value": "24:v/1eGs/yGE/6KFb/EJ/hsEhs6LsP/hShU4L/h6Khmaj0Pks/hshO2/ibi4/BzBBs:vw6S0GZs8s6LsPZGU4LZrLyJZkO2Amj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392133, "uuid": "fd2b8da7-12d0-4524-9ead-25f8fd2738c7", "value": 1900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392133, "uuid": "5a4f7b0a-78d0-427d-87f0-77bb8b52a464", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392133, "uuid": "5eb0bc35-01e6-4f6a-97bc-d397b71ddbfe", "value": "Oblivion121.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5ea008-ccd0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764385516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764385516, "uuid": "4952ed8e-957f-421a-9a06-94757acb49af", "comment": "Malware payload (Mirai)", "value": "d4c1f400b861a66c61bff66a550ca1e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764385516, "uuid": "503ed8ff-bb65-4d44-8e38-58eda3b60af6", "comment": "Malware payload (Mirai)", "value": "2f8e363d5ba476c8ac3bf16c6f3120a9f6cdb3f10d0f7fdccb27b713c3aa3aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764385516, "uuid": "46762100-8f5b-4be3-a85c-a04883c31305", "comment": "Malware payload (Mirai)", "value": "27e2d6529c667a4a04bf293774f0a6b178acb913", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764385516, "uuid": "bf58a2b8-79f4-4d31-abf8-674361944b7b", "comment": "Malware payload (Mirai)", "value": "79c3cc90594502e8f32eda3be054bc6bd4c21cb5bbddcbc79e3d2904fbf15cf195a8a44b6ffa51a106fcf25788f72d0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764385516, "uuid": "b4f2c454-3f90-480c-9592-71affe9518f3", "value": "T183E30945BC509E27C6D522BBFB5E42CD372A1798D2EE72039D216F24378B95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764385516, "uuid": "feb7a8c6-3f87-4de7-9eae-d494decc33fb", "value": "1536:1K5d2BndhS917kXkhMjcudHFhgH0Id182Agci4VlDPTDFUDH6ZOzwXZ5gVK67lkV:1KPaFjJgHBd18Wx4nPnFU7er0EKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764385516, "uuid": "45c91b98-161b-493a-8744-3176cb57865d", "value": 146080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764385516, "uuid": "46b06824-7afd-43a0-8d30-652e51161f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764385516, "uuid": "e4a667d2-2a91-41ad-9189-45fce699a6bd", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300ba62a-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764443050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443050, "uuid": "f7a5aaec-16a4-4788-acfb-5cc65e20820c", "comment": "Malware payload", "value": "0c2a9db77070ded6af2a76a09a23af1b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443050, "uuid": "c2a5110a-1982-477d-bb7b-e1400656c555", "comment": "Malware payload", "value": "3070e1ed406adec083a3c2b52b560c526c3324b41ead2b77e7749809d478b322", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443050, "uuid": "be8c6cef-097d-44b7-94b4-78a524da2236", "comment": "Malware payload", "value": "a245ea2f5924034230f7cf3a5af518c41872e0ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443050, "uuid": "3d7da861-ccae-4619-ae1a-d1b5950f960f", "comment": "Malware payload", "value": "a357710b7cd32eece3dcfa63ad2057ada04b59c24a94bf63bf567708cdc6c77954126ab77d9396f14f672276715b5718", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443050, "uuid": "f9be6ee2-b494-4676-80dc-8a0a2a9aa6d9", "value": "T1FE119A8E12647E5A0408CF093466869476F5CBD4F4F90E47998979BBF884B17B07CF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443050, "uuid": "d3524a70-8630-4398-854d-102edcc80b2b", "value": "24:3BE5xGEc2ENIZEtnUEVKTotEHlUEOEKSFS3E3eM/OEKPS7Ez35E19LuEkrxn:cK3bQ1SfS4EedPfM6rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443050, "uuid": "453e2c6f-29fa-49ce-9eee-36dbe3058dfa", "value": 1105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443050, "uuid": "499d331d-fad3-4c34-bd91-aa20324b5b49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443050, "uuid": "12acc5ba-2ff4-4a52-870c-a7c5ff34d757", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c284e7af-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764413231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413231, "uuid": "ccd23510-0a16-4b99-9c46-88483f41a63e", "comment": "Malware payload (Mirai)", "value": "c896956d7484dbcb9bab642f287d6539", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413231, "uuid": "2bdde4b6-5a2a-4941-8daa-c522ca214a2e", "comment": "Malware payload (Mirai)", "value": "311a245bbf1a01ae5cd739cc463521d89efa6eb3fc871b02f3eea9174d9866c7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413231, "uuid": "3a6c4279-1cfe-48a1-b830-f2ae0dacb5cc", "comment": "Malware payload (Mirai)", "value": "06353ff449a5cd3d65131f9456c632bbf201d368", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413231, "uuid": "c050dd0d-a17d-49c5-8ea7-221158d7ec8f", "comment": "Malware payload (Mirai)", "value": "098dbc55fe198f333fa0a73b6e2ba34ba6aba0ea8376adccb9c3ea167284bae890dcea02018f619c68c20f3077019180", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413231, "uuid": "b563437c-81b4-478d-b8c9-4fc6737b5def", "value": "T1B2015EEF229041B956C4AE2BFB532934F70659CE98CD0FCC998E1C711A8D5083025F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413231, "uuid": "0cb92a3e-3744-4648-b303-96e321a520b0", "value": "12:z8kZDD8tHWZ8rD8IHWZ8FsFIzvD8FsFIzMHWZ8FnIjDD8FnIMHWZ8FiDD8FDHWp:zxZXqWZsZWZmsFIz7msFIzGWZmnkmnhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764413231, "uuid": "dc58e0fa-ecb9-480f-9e5e-093a45b8686a", "value": 665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764413231, "uuid": "edf41e7f-ccb6-49b6-9eb4-81b92a5dcb72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413231, "uuid": "5269ce3c-1daa-44c5-b9ed-a3b0ed417556", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e21f4a2-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764443047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443047, "uuid": "d1f59152-b0f0-438a-a796-866e971f862e", "comment": "Malware payload (Gafgyt)", "value": "c3636a294f3b7948bbfe5506ff3ee313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443047, "uuid": "0661e26b-aff0-423a-95ce-f9bb8271ed0a", "comment": "Malware payload (Gafgyt)", "value": "316d9577e8d4b07a5d1d67bdbc96b97c1f8ab7dfb9c35db3bedc1c89be9e9b4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443047, "uuid": "1c5ce828-2bf3-4a6d-80c7-5b7e4bebc26c", "comment": "Malware payload (Gafgyt)", "value": "8e7c59a63041e1f41103acb56d4aa715296ebadb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443047, "uuid": "85cc86a2-90a8-46f2-b105-2e34d8f2f75f", "comment": "Malware payload (Gafgyt)", "value": "6d88a9ee31c0ff88e8811528f4f91679c32b3ffdcfec937907a4a0991f1ed59af3f3dd60756b50a781ac81bcd469539d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443047, "uuid": "cffe3f8c-39b8-4656-9ec9-93ea0a4a01cc", "value": "T15FA31892F801EF77F40B977604D34B207630BBA20A535622735B79A6AE762D43933F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443047, "uuid": "f9f00e22-885a-44d5-a281-8b852616482b", "value": "3072:+ts0lTz+eURhWpyF4ioe/uoe2mu2VMDrY8faJX:+jTz+e3yFAeW2mu2VMDrY8faJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443047, "uuid": "00ee09ab-c16e-4297-b4a1-feb264db7577", "value": 100089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443047, "uuid": "ce0d1b34-b3a9-4b80-ac11-a60f1d6dc7ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443047, "uuid": "782a999c-994c-42af-baad-d002dfc7a68a", "value": "Fantazy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb8a04c-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389143, "uuid": "862777a9-e032-4b9e-bc4b-741205b64a53", "comment": "Malware payload (Mirai)", "value": "4bcfe65f32859f34a3630878fee427d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389143, "uuid": "0f229ef9-e9ac-4ec8-b115-01e20f94ef70", "comment": "Malware payload (Mirai)", "value": "31c21d5080f6e516124f8e9d9ca4011e9c6133766fd58c2e6b0b4e222fe78a0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389143, "uuid": "79239598-ebcb-407c-8730-cc528a7f2e14", "comment": "Malware payload (Mirai)", "value": "5c9ff46ade345ee37dad2cfe2edec33affd09f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389143, "uuid": "f03c1810-fe77-4957-a8ee-7875ce1ee351", "comment": "Malware payload (Mirai)", "value": "0a204985d65cf0eabff152266248bb72ee0300778a03a6f3aa1c7106600013aef3559bf8322f3805c34187e1149cbfe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389143, "uuid": "d8e160c2-1038-4623-8dc2-0f61591bc0a0", "value": "T17F739E63DD685D98C65C82B975A4CE395323E900A6931FF6069BCA73D00BEECF5093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389143, "uuid": "35df57c9-751e-4050-bcef-37bad66c36ac", "value": "1536:5/Fsv9ozAPETFxZjJXwK1jJ/7Thtdk6C+8BrL+d:5tsvezAsfZjJXX19Jtdk6Wxad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389143, "uuid": "5ea20eb4-e023-45cf-8994-a4bb5ebba937", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389143, "uuid": "39e0eb45-134c-407a-b78f-cb204dc1dff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389143, "uuid": "3b1eb9af-68b8-4cc1-bfa6-7ca3328db9f5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f108de-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409856, "uuid": "4a0ca1fc-c6d4-4c9c-aae6-3fc482b49e12", "comment": "Malware payload (Mirai)", "value": "8c6f639321af9364ad96756ee6d90141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409856, "uuid": "b1eda544-5388-4fe1-b3d8-e10ca6e986b6", "comment": "Malware payload (Mirai)", "value": "32b418ae869e65527faff0e1dbcd1ed192fded2daebf0aa6a8edf2319b568897", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409856, "uuid": "513ca7e0-5e75-4267-875b-e4de241575bc", "comment": "Malware payload (Mirai)", "value": "91f053906dc91683e41aa66636a9bf87ca871ed1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409856, "uuid": "240cf79a-7244-4407-a6a8-59c108b16069", "comment": "Malware payload (Mirai)", "value": "1e700b121eeddb2fecbf90f4beb8aa178a0e8de1cf89be4bb963289b6ab2a1321938e304b5009c37a43e397c8d7cf264", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409856, "uuid": "c2312c96-4d18-4173-a261-ed606e70b4f8", "value": "T175B328C0F94B80FAC90788304067F73FDE31D6A94121D66EDF999E76DE73142920A6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409856, "uuid": "6eb6e2b3-9df3-4fc7-9368-6f380ac6a79f", "value": "3072:3wFxr5wyajFqfvvGt9Yn9RxdQx/85K5Y3D810Yd:3MxrGyajgfGja9rImoFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409856, "uuid": "91ea156f-cf61-41e0-ab5d-130f52ae224e", "value": 108176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409856, "uuid": "f55d3a31-8470-40c8-8a6e-fae25e57fdef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409856, "uuid": "0d4b15c0-ef0c-4db2-ab47-160ea64f6033", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e180ade-cd24-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764421652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421652, "uuid": "f7adc5ba-a511-42bd-b944-1b05464d9f2e", "comment": "Malware payload (AsyncRAT)", "value": "7e45e2f6e460239cac4b50c77e5b040b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421652, "uuid": "33626a0c-99ed-4a33-a64f-4d514ded7656", "comment": "Malware payload (AsyncRAT)", "value": "344570f8e53a13c56f8e74fba7adcfe0bf7fe0829a0b8b678ee762d345053b2d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421652, "uuid": "805d62ce-9806-4954-b22a-d93ce8b5eeb6", "comment": "Malware payload (AsyncRAT)", "value": "6876c075ea8038055e897c341ced4707f95b2b4b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421652, "uuid": "4715f367-6d61-4092-94a8-ff54d0364c6c", "comment": "Malware payload (AsyncRAT)", "value": "0ec480fdd54fa803da518f8e6f493e45e2f57a5cba243175a5fa021c50ffebafd210a25c0739995b2a104916957f1cec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421652, "uuid": "e25aadb9-f77e-4a7c-84d4-3d4c8220fef9", "value": "T13053E5167BF55858E5EE9A311CAA4DB4C5A37C320F15C60B3390362E2D73F92DC62366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421652, "uuid": "59afeff1-11cf-479b-a087-eafde836daae", "value": "637df1e8f3c074f2ce79b53c3e34cfcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421652, "uuid": "1c9e647e-976a-47fa-b635-0109ef7d2fcf", "value": "768:bqO6lIb2s2lnn+GcuX/j/Rdnel90PGAZg0QvHt+XNZV27J5o3VR:bqO6CbenZtX7/RM90+AZDQFqZV28R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764421652, "uuid": "482772c0-9f3d-4188-9967-16d923e4d7d3", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764421652, "uuid": "4e51924f-b091-4a74-98f3-33c36e12261d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421652, "uuid": "9ffe825a-71b4-42fe-810d-ad9e8e30d99a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69feae17-cd75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764456462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456462, "uuid": "0ba7a88b-90e1-4a9e-a54e-007b448c3984", "comment": "Malware payload (Mirai)", "value": "68483c319dde63ce691bcedb626da411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456462, "uuid": "383949fe-e628-4ab6-9513-721bfa85b654", "comment": "Malware payload (Mirai)", "value": "3478c62cde5809f4e2f05d67c2a5b2509a99ee43991619cd9bea3222be731af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456462, "uuid": "572417f6-9dd0-4c7c-aea4-6f0fda6e2537", "comment": "Malware payload (Mirai)", "value": "fce1cc263c8d30c828aa39bee823f3c50fbff455", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456462, "uuid": "ef374f78-9161-425e-806e-c6f9641732cd", "comment": "Malware payload (Mirai)", "value": "3f71b2610c158e4c0a1f95c48dbb6b77a6f922dab5b831b6321b34b8791be2015d6f5baad9745d08620c1e7d2868376b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456462, "uuid": "9f9795af-b95a-4ecc-9731-724d046fa961", "value": "T14BE35C46EA808E03C4D61776BAAF424933239754D3DB73068D28AFB43F87B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456462, "uuid": "7c0baef0-818e-48a8-8efa-5a528c075945", "value": "3072:zv77j7mI47aSDV2u4AUDjNLPMvEn3ExYM/9QzjTf:73Oj7aSDV2uJUDpQEn3EmM/9QvTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764456462, "uuid": "1153701c-3384-4cd9-ac28-edb6bee0fd8b", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764456462, "uuid": "d73b6a3e-49f1-4941-a563-629ab921f1a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456462, "uuid": "fa9b50e3-8a25-4e0b-bf4d-42594ffcf1d2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f7a049-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409771, "uuid": "2db9600c-5920-4f50-9a68-362e5ef7089a", "comment": "Malware payload (Mirai)", "value": "e01704569aae68b55a9c3ac8a9da62f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409771, "uuid": "ecaf8578-e5c4-44a2-acd5-9929cf023393", "comment": "Malware payload (Mirai)", "value": "35fdf5aa1ba255bdcd32bf04b5c0fe2706bf96f0447150da63d710fd5e631b4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409771, "uuid": "2dacf1fa-b740-486f-ac7b-7aff247c2ace", "comment": "Malware payload (Mirai)", "value": "7aaa24fcc4710cc716057311a9638345c82165d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409771, "uuid": "50ffbcd5-61f4-491c-8e60-46f21ad9aa31", "comment": "Malware payload (Mirai)", "value": "33fe745935fa80755520e97d42ead4d44aa57c93cf0d3879dbb44da2af17f60b9fe95ffc0e584b0b95691de1da120cd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409771, "uuid": "a530bf97-09be-446c-a02c-9cfb852fb5ab", "value": "T1636302A1B88F6AE3D9D23CFCFC5A26865DF00237D1FCB1D490C45A107E5A91A58B990B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409771, "uuid": "6b14aed3-b40e-44f9-bf67-78180a68e7a5", "value": "1536:dZcsmVEOmRfb01nalKRBtmBRiz6LWneH1QD66L04OJ:dZzm8Fbcn0KRBOR+6LeUa65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409771, "uuid": "6dd57c38-64e6-469f-92c5-8acaf515762b", "value": 71608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409771, "uuid": "db9e1a3f-a283-44dc-bbf4-ee87a7104d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409771, "uuid": "810bc186-7a63-4954-a474-1236720b992d", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d41aa3a-cd17-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764416148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416148, "uuid": "006057c6-4205-4457-afb7-41c6d025370f", "comment": "Malware payload (Mirai)", "value": "0f87a2ad4e9bd007ca01a8470ebd7072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416148, "uuid": "0a291884-1e95-47f8-a570-df4652ea2447", "comment": "Malware payload (Mirai)", "value": "36b5cc0a6f578fbf34cc2c5e8209e78ba8675be86c9a87ef3c51d96ba267e5b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416148, "uuid": "37784868-8580-4bfb-b99b-2b2655ff20c7", "comment": "Malware payload (Mirai)", "value": "0331abd531445a960ebc7b9560b73cb956157426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416148, "uuid": "04ea5a2f-a5a9-42a1-8fe5-33a53147ba27", "comment": "Malware payload (Mirai)", "value": "fbb7bd0e95998fdf646a2cd788a48fae74c0f1fa1e67bed4438645422e80e6f6e1d890ca1683cc0957bdd608187f2e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416148, "uuid": "acf3883c-2ee5-446b-823e-b173ea3f7732", "value": "T107C2D051988A4471E9E05670D91E8FD9E39F6B3CE0F53963184983B4B1CD50B78BE4B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416148, "uuid": "8db7cbee-0853-4814-931b-cc661543b2e6", "value": "384:uIGZW4Hrf3zVMvV7ZOHKz4hAKycKAnqC83X6XY9GpTYia5EChKdAC2YL1dihymd3:3mHV6A4xKycD78aXY9Gp0ip7nis3UozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764416148, "uuid": "c113cb29-50c3-49e4-a3e4-1e7800afde9d", "value": 26780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764416148, "uuid": "096982b7-7e89-4849-b488-ecbeeb351cfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416148, "uuid": "3c82cc8c-f8b2-443c-8cd8-5c7c79ca4484", "value": "niggah.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bc6f81-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389379, "uuid": "be4a4afb-80ec-4228-aa7f-b6cf648c9858", "comment": "Malware payload (Mirai)", "value": "ff395cc6da513e18d15f59de77ed8e59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389379, "uuid": "70519b88-d874-4761-98c8-93c3cb14f838", "comment": "Malware payload (Mirai)", "value": "36d0aaf8a603fb92283d1fb9576ff9a57a320e1410c490260d1881bd1e2c939c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389379, "uuid": "789261c6-7e89-407d-b31b-965406b7d94c", "comment": "Malware payload (Mirai)", "value": "7c6581995761cf671b3d8e6e88f9620a4822a263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389379, "uuid": "ca47a898-ce32-4829-b1aa-2de1d30a7f13", "comment": "Malware payload (Mirai)", "value": "c02f7d6d159d1fe15a24c1f606710c471875c08438fa216fa2ab69e6bbcb66ac3b93fd9afc90297a97dc1ebe0768987a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389379, "uuid": "59ac174c-6206-4319-a2bf-d63b1debe917", "value": "T107137CA3CC3A2D28D1688571F1244B7D5BA3EA54D5475FAA8176C67AC203EDDF8083F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389379, "uuid": "3bad9537-592c-4fff-ad27-965932d32215", "value": "768:/8FokZ7nei9ACIV6Z9YPjtMH9nyQSKqxC87/ahhocwDTxChS/Vrfykr0I:Qo3i9AfVO9YrtyniKqxC87ihWcOxChHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389379, "uuid": "17e78521-2780-49b5-abf1-9215b9412880", "value": 44124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389379, "uuid": "1aeb2ea8-3724-4f68-b8fe-b18d17fd19d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389379, "uuid": "20bab340-b858-45a0-85b9-9b334db3014d", "value": "niggah.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3c8eb8-cd72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764455261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455261, "uuid": "10cb200f-0420-458d-91fd-880ac9e0aa9e", "comment": "Malware payload (Mirai)", "value": "e096095ee43883875051feb5a9e15570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455261, "uuid": "90a97ebb-0b85-4ec9-b4c4-b24990f08bfb", "comment": "Malware payload (Mirai)", "value": "377b4fb94f7e8772628fa67a73b779668f376f76264a2f812a178948eddb3227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455261, "uuid": "e284149a-a74f-4816-ae95-5724151757d0", "comment": "Malware payload (Mirai)", "value": "312731f25e60007484a1c3de60e7649c02c1176b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455261, "uuid": "d589e11e-7906-46e0-92f3-c5c98423f85a", "comment": "Malware payload (Mirai)", "value": "4d13d6c27cc1cbbfce50b39b1108d945703f0b58bc4c6511dd069bfc3ef2fe143fba0b2f6a62e777ecf3c04d8db651b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455261, "uuid": "7d488af7-fc60-4860-9ceb-95bfc1a97208", "value": "T138536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455261, "uuid": "51aa08d6-d922-45f1-8c6b-92a47dd14486", "value": "1536:Z7qARubgzY/bEJyRRcp680LDHhklv4JQC9DSW:NP+eY/bEJryXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764455261, "uuid": "41b73110-7728-49aa-a6a3-e3ee21d45236", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764455261, "uuid": "0b1ab04d-8816-4115-92d0-ba6e99637af9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455261, "uuid": "c44ab55c-0074-4be9-a59f-0c8790f4b148", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acd181a-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412950, "uuid": "e0162a1c-e6ee-49cd-af50-8e9b54c17ad6", "comment": "Malware payload", "value": "0b7eeadedee035b4d430ce70b9067330", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412950, "uuid": "d2467b5c-d0d3-4bd0-abd6-bf89c6136ea3", "comment": "Malware payload", "value": "3870f2f4a820274229a48c0e0cf9fb4d2b4e6a3a1787f67ede0c88b7e1492b54", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412950, "uuid": "51007ca7-5fae-414c-809c-7a7dfb438592", "comment": "Malware payload", "value": "ad81dea15837b0fa0750736603efa67625d9c8e6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412950, "uuid": "a76e794f-6677-4384-aca0-6ccb25ec9400", "comment": "Malware payload", "value": "955d9a4d116e5851ce4f8e17a8f320d612f3df4c46504d4a7c1c0e2247db3c09761ae0d89421618ff97fb5a7258527ae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412950, "uuid": "6f88297a-2349-442a-a487-4e751f92a1c2", "value": "T1A8762387FB54A65FC4F3D33219B966366027DC16C743E74BA52433B428BBAE44B822D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412950, "uuid": "1209fbc8-8b06-40e2-a1d0-d3feca329982", "value": "196608:iiyw9lNYJBSCOMleKKGz6s8npzS44EK8rYcUGKq5J:5D93YJBSCPAFGz6s8pu4lKjFq5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412950, "uuid": "27c2e187-769c-4302-af44-4f7cd1fe9651", "value": 7526939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412950, "uuid": "0f95fb3b-3b28-44b4-952c-6af4fdfd73f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412950, "uuid": "229246c9-3eb8-4be9-a40d-e4001ff5b942", "value": "NaftMan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ae4d85-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409772, "uuid": "205eff19-df3b-452e-a8a8-2edc3c919c44", "comment": "Malware payload (Mirai)", "value": "0ed0188ec2ef785113481437f42bb51c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409772, "uuid": "3a0daaab-fbcd-4cc0-bcf5-fe60e718f961", "comment": "Malware payload (Mirai)", "value": "3967131b58764bc4d3615be21f1aa2c26a24ce1d59b989b527d5529508943886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409772, "uuid": "d8343407-a511-466f-b951-8b7eac277225", "comment": "Malware payload (Mirai)", "value": "931007d89909766de6461468f1b40e7b7a840ce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409772, "uuid": "d53c3130-6363-4bd0-84de-7f73cbdbf76a", "comment": "Malware payload (Mirai)", "value": "c59bfc9770ebe279c15eec97a5b7a75480b4a377f2965f436ba6ac5462bb047dcf225afabfe1dd97724359a1669ea7e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409772, "uuid": "2338f150-dffc-42ce-a971-5c5efc13d734", "value": "T18EB35B22B835193BC4D158B712F74765F2F25BCA21A8C91B7EB20E4EAF256403553FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409772, "uuid": "62e5ddcd-756f-4d86-a392-504cff7ec513", "value": "1536:0x4LJwwfJNW7FDoHyt891prjjGsKxZuQPVeJ5ZGmG+cDgzw9ttcYo95r0LU3QutZ:4j6DXjGFh+NOXhoPrmAvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409772, "uuid": "90970938-966f-4802-9cf3-a5bbb64465f5", "value": 116568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409772, "uuid": "99a8e4a0-c217-4809-8a0b-8e7bed869680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409772, "uuid": "0ccaef58-796d-42e7-9428-77061d11ecdb", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaf4dd2-cd74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764456255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456255, "uuid": "a88ec642-2edd-46dd-b50f-6278a4f9405e", "comment": "Malware payload (Mirai)", "value": "be37cc374143c1b013db5a97ed5696db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456255, "uuid": "f734760a-2fbe-40d0-a5e4-4b7a95c12216", "comment": "Malware payload (Mirai)", "value": "3a9d182ce6d6bd2691de4ed3c3242c3956fba24c449447356f16491dcfcc4d28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456255, "uuid": "4b080ea3-213c-44ba-8a2c-c4a97450c402", "comment": "Malware payload (Mirai)", "value": "d8633666c17f803211b6908817bf23e9facd4bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456255, "uuid": "fd8132aa-9947-4e0d-8de8-3418aa620d9a", "comment": "Malware payload (Mirai)", "value": "b374df653d2d2ff18bfd65a57adffe6c8544d92a0b64612225ddcef0b3322f575d28fab1a0351a5e5a2460bbc0e20479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456255, "uuid": "ea7db3ab-03c5-4021-985e-cbfcade38a4e", "value": "T101A36CC6F643D8F9EC5601343132FB379F72E5BA1129DE83D7A89A627C63641C406A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456255, "uuid": "1d7dcb9f-4f53-4682-9fd2-4f569ba23805", "value": "1536:FnbhjFYbf1Ui5hKbc+sxKLb+mX1DFvSr1pAm3Jn5wR54yfZLimxXl:FbhWbT+c+sxK2mlDFvs1Z3vY5XimxXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764456255, "uuid": "9aa69c00-9e8a-46c3-9f12-a9573a8816a3", "value": 100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764456255, "uuid": "a4d89667-74c4-40cd-a6f1-b4fb46d93233", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456255, "uuid": "38d55161-8506-491b-b13f-da768da46f4d", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc81a79-cd0a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410542, "uuid": "a43059b8-afbb-4b17-9622-e6893bf2f842", "comment": "Malware payload (Mirai)", "value": "21ae8cbaeda61a74fa6ed3e53262d9f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410542, "uuid": "5c14e6dc-4d9a-44de-b1f5-b997af7ed4a3", "comment": "Malware payload (Mirai)", "value": "3cb64bfb612f62f9b47d0981067811afa1e9694f6314ec61f1ce949a798c1d02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410542, "uuid": "4b26ce11-30fa-47b1-80d5-897338d7d294", "comment": "Malware payload (Mirai)", "value": "e40b79f4018fd4efccd5d44f8f1fc02490d0191a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410542, "uuid": "41dea018-5d7b-46ef-821f-dd584568e4ed", "comment": "Malware payload (Mirai)", "value": "1b5d0102cf804f720d0419679ff2d55e191f7588323e2916f1ee5a0cc9df7d6e34f4af6bd33b74f41ec0814da4ab20c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410542, "uuid": "1c32ef5a-06a0-471a-b73f-a7872fc279ae", "value": "T1B6F35BC6F402DD7EF80FFEBA845B092AB9A097517143572A639BBD93AC320E14C16E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410542, "uuid": "02bf74b4-74f4-428c-abed-22e23dee3397", "value": "3072:6k9JfsXNfZ9OlaRrAKCEXGsrOnbmLvySuia1FzjUXsyj1YV4z:/fsdfZ9OlaRrAnSDyXiaTQsyjyV4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410542, "uuid": "b3bf409d-09b1-491e-a1ad-4397ecfa43c1", "value": 159356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410542, "uuid": "7ac53546-a357-4a44-b9f4-e30aee7538b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410542, "uuid": "3af4ac62-a799-4276-9bdf-b0bda0cc9b35", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3c0a70-cd0a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410539, "uuid": "e6454712-bc3a-4407-a5b8-2dfea795d84e", "comment": "Malware payload (Mirai)", "value": "3f577c5a95e0d67ebc243ee3ba4d5413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410539, "uuid": "f511d4e7-3a40-42dd-81a6-eb22cb9453e0", "comment": "Malware payload (Mirai)", "value": "3cf1d1b529bccef9141c0ab6741c16ce7e741dbada74ce45f0a983441a6946cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410539, "uuid": "ec103a1c-20f5-4e71-a60d-6b0110bb1e32", "comment": "Malware payload (Mirai)", "value": "7446e98b48ca74075219168b9affb55826e56c43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410539, "uuid": "e94b0c8a-2157-401b-9956-62da2a0db6c9", "comment": "Malware payload (Mirai)", "value": "8412d94c564461af6fc62862f9ec2ade611cc90918df1278838f27f2611fbe39cc065178aebf340a61911456d7ec41e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410539, "uuid": "c08f4933-1723-4187-b32b-4e91d80bc02b", "value": "T15D33F19BD5A58107E0B814B9688FB70B0E40E10EA9D974F7C8F5600FC6D6FB5564CBB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410539, "uuid": "524c3e93-3a79-4b20-8547-bb4e78a99d4b", "value": "1536:usMxq7wjX7Xv6Hp3fSrTKintCu5fP8FvnPfaXnouy8HyH:Yq7Yr/Vr2iwbJ3a3outE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410539, "uuid": "bc558131-d874-4c4b-a7b4-894aac7f82f4", "value": 54252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410539, "uuid": "50fc5799-9099-4f27-9565-b01007407e67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410539, "uuid": "29125dc0-6b4a-438b-aae4-700a912b3b79", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2100925-cd09-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410277, "uuid": "a31f8b0e-1079-44d5-8b82-9e010b35d193", "comment": "Malware payload (Mirai)", "value": "28ff788bdeb696b8782d716a1e8b1249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410277, "uuid": "acd343e1-7c25-4734-82d2-40a96f7134d7", "comment": "Malware payload (Mirai)", "value": "3d31d4c410ac9a896ec58d1dece1e980f126272723c9249f48c8fed7f3abca90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410277, "uuid": "97c5256a-7bfe-40d4-bbb3-24b61c790804", "comment": "Malware payload (Mirai)", "value": "76ebda6deae84e3a16f9f6dbb697ab2471c67b0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410277, "uuid": "b1f76a58-88ed-4205-a5c3-86900e2c57eb", "comment": "Malware payload (Mirai)", "value": "e53d53545d4ef924799d944fbbc997863a5d3168fe964625f73415489cb0dfe95e0e4c148bea5336b433b3963d4cdbeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410277, "uuid": "686c1c70-074c-48e7-90e6-8755c48b785d", "value": "T1EDC33A16B9519F11D4C735BAFA9E414933136FF8D3FA31019D20AF6123CAA9B0FBA512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410277, "uuid": "4c278892-1e50-496d-a709-7302f8bfd625", "value": "3072:D7T3qfCKgji/qYyNP2G/oiUafIc0ldBXkvgGlDczvSCfGH:D7Ta6KoeNGQiUafIc0ld+vgRzKCfGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410277, "uuid": "dc51fc44-7a48-4863-9e5c-8393a4b69847", "value": 127764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410277, "uuid": "765fa3dd-2866-45c2-8960-e26130f22738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410277, "uuid": "196e5bad-10aa-46c6-92ea-5d4018ee0d33", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875ff394-cd44-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764435466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764435466, "uuid": "134598a6-3b32-4102-beaf-2c6fce8f6127", "comment": "Malware payload", "value": "3d67ce5e55132b4feb76b41fec136d6a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764435466, "uuid": "6da72cec-fbe5-4b94-8a2b-bcb3c27edf6e", "comment": "Malware payload", "value": "3da6128a3696d72c3cf50b9a8bf081e862919f703e99661dcdbaad771bea75b5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764435466, "uuid": "ce2560a4-857e-463a-bdea-47fd59dc15aa", "comment": "Malware payload", "value": "d3267857e9598e415bb4775945f7969b771c46ae", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764435466, "uuid": "75ae3043-6e67-4481-a10f-5f4f24950a79", "comment": "Malware payload", "value": "612d8eff46a61c98f82d0c90b4fdcebd2a65eeec431d6fd5a539fe25ef3c4f8bae287858d093068c1df37f77fe135b71", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764435466, "uuid": "86d927f7-3597-4e18-8439-e2abc02413fa", "value": "T1887322C80ACF94F89A17745885EFCC05F7B98903221CE695BB4E7DA02F1193897F95E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764435466, "uuid": "add7f760-fa9e-4f99-8919-25a2c733f236", "value": "768:mBFHBm5ZS7Nh5c8J7xx1IK83VG+j0raSNHsKfnLWJsJfWhfqSYoCvQSQsr4aLVWK:18JAJ0VNfJdvQODdgn5KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764435466, "uuid": "19d7bb28-e85c-456f-9ddb-a05b26fdf85e", "value": 76339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764435466, "uuid": "4799418d-02d8-4579-a18c-af8314dd7907", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764435466, "uuid": "cbaccf51-061b-46d7-9d73-26a6f37c1ad3", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84d33ef-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1764409832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409832, "uuid": "1b6d1e5f-00a8-4d5c-9e81-d3eb11fb6bd0", "comment": "Malware payload (VShell)", "value": "14b4f7971302ac039d00f0c43cdf524a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409832, "uuid": "50f1f372-66e5-4ba9-a232-48752df8b57b", "comment": "Malware payload (VShell)", "value": "40569370f60f3ca9748724c58f92069e36c33313283cf95496ac587b5e561199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409832, "uuid": "dd298f9f-efb1-4d32-9c43-9c4ade454b4c", "comment": "Malware payload (VShell)", "value": "0fdad2761ed5c4074c8a45c68aca52e1986b7ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409832, "uuid": "ea94b01b-762f-4c09-a126-f0d95abc558a", "comment": "Malware payload (VShell)", "value": "94aca78e9f3419b876f0f8cf88a4a08f4fb6741658ffe47e3d1991ce886636acdd2f3a5deb9db6b43508c5187a7b8c56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409832, "uuid": "1a208882-5858-41b5-b914-b26de24e930e", "value": "T190070A03E8D51494D8B9D1B489258262FA70785C0B7923DB2BA1F7B42F32BF49E77790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409832, "uuid": "31d5bc06-cfcc-4a1b-9e54-920b640f962c", "value": "98304:99gzM5c7JJ4gUHre2fPOiSiw6KIgFmf3mVHxwsE1d7N73+ic2MmS:QYqtJELe2+iS/6jgFsiHyFZJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409832, "uuid": "00e37407-adf4-4506-af18-30522092e2f0", "value": 17285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409832, "uuid": "1d90552b-4fe4-49cb-b44d-b84c7972b70c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409832, "uuid": "8a7ad62c-9a64-46af-81f5-ec6775be67f3", "value": "systemd-check", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4a7d90-cd7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459281, "uuid": "95ee91aa-9210-4706-bdc7-ee8fe5074ae6", "comment": "Malware payload", "value": "044135f840081de0807b9de96e1786be", "object_relation": "md5", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459281, "uuid": "c396470e-fa56-41ab-8ac0-2d391a5c4df2", "comment": "Malware payload", "value": "4081a4c50d6591f1075a29df14b5399719d005457c844f9213a809a325e37b23", "object_relation": "sha256", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459281, "uuid": "b80baa4f-35ca-4646-8b41-b0704cf9b694", "comment": "Malware payload", "value": "f8718a733d5bc9ee02ac72fd729454e87c66c75b", "object_relation": "sha1", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459281, "uuid": "1dd1c309-be1a-4023-b15f-9baf1a0759cf", "comment": "Malware payload", "value": "8e37c5b88efe84ab141a8f32d73b202835ac97d5f81d287bcd0bd90c776dd18d2d3ce5be2c97fc940f164d5e1fc793d8", "object_relation": "sha3-384", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459281, "uuid": "e4153e22-db9a-4923-8809-540f83a2c19f", "value": "T1FBB6E5E3237C55A54BDF076382513D21573A22E131206909BA8BD09B72B79EDB7AF30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459281, "uuid": "c76a9a85-4ad4-4361-b5fc-2c62b7b3ccca", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459281, "uuid": "c967aed9-1ca7-4cb1-a8a4-b335c46667d8", "value": "24576:WbUEvTTLULZXwsRSQhCzRk39KRtpuL7/bG0sLRa2eHIon:c8LZgDakRD47/bG0sLRa2eoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459281, "uuid": "e9cbfe13-cfd3-4b9c-a04d-5340ab011104", "value": 10499456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459281, "uuid": "6231e392-9957-4ad3-a159-c6e621d4429b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459281, "uuid": "9814267c-25e6-48b0-8011-990e54a309ea", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcbd172-cce3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393684, "uuid": "ed5e32e2-62bf-4dd7-b289-cf7d7f7e40ec", "comment": "Malware payload (Mirai)", "value": "6844a1162555ee65f491aeada33dac45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393684, "uuid": "6e971191-5f72-4c8b-b861-fa9d42107f85", "comment": "Malware payload (Mirai)", "value": "40a2c534f28126f7e0d51a1114ccbdb3d4a9554c9ce7c8f06cb39c820d2b33e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393684, "uuid": "94c8f68a-6599-478b-9ba4-49488077591f", "comment": "Malware payload (Mirai)", "value": "c98b0129530bb668cefa7f2b7463fbbef6779446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393684, "uuid": "e993dc7e-9b0d-4982-a9f6-0a0304546697", "comment": "Malware payload (Mirai)", "value": "90eb3bae488dc1ec00c01afd263b6e8eecb7f4eb2b72982bcf2228977e9ac467e7b867589127b8e8a7e2c1ec13c8a1f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393684, "uuid": "668c989d-64f5-441c-ae8f-5e4fb5362333", "value": "T1F123F132E0B9CA8DD4E51774CFABBAA26801D26A9643CCC76654C02D5846BF477213FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393684, "uuid": "8c418ad2-423d-414e-a20d-8a71a75009f0", "value": "768:jltxhiwKNVY34BKYNy+Np0l7SCU+rk+mDO4FBm99KxsXnbcuyD7UHQRj9J:jvWzfY3uN9O7SCjrfmDOEQ99KsXnouyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393684, "uuid": "5975c3ac-e857-435e-9e02-856b6a47b74c", "value": 46856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393684, "uuid": "9ec16a7f-3f6c-4516-9b00-8c0058e0d233", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393684, "uuid": "f2d62de3-d3b4-4d99-bfde-cd5ad5ef804c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fade34-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389880, "uuid": "c517b674-de36-4b84-99fe-0c4b19c49b8c", "comment": "Malware payload (AsyncRAT)", "value": "7afdf7d74b5bd52a05c086071355c798", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389880, "uuid": "fdae41a6-e3d9-4cbc-92d5-3c9f5cdfc1f6", "comment": "Malware payload (AsyncRAT)", "value": "41cc18e955fc1796ece6932584c60e0e990e7983dd470a27ee678bdd62cea49c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389880, "uuid": "7773c495-0322-444f-b268-ea5155f844d0", "comment": "Malware payload (AsyncRAT)", "value": "56bc4848d9dba27fd6bf1bc5173394384ac98f5c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389880, "uuid": "2941dbef-331d-41f8-90d6-b79049850831", "comment": "Malware payload (AsyncRAT)", "value": "d17f6f560f350cdf2c84444d8de78462486a9e69bda79a6e16998b3ea9f84a1107e4c050055328439dd1b09e5a774382", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389880, "uuid": "08edf075-4407-43ff-83ab-d9de142488d0", "value": "T18445AE11F79044B9F4A785758AAB87169A39BC961F71DACF53C8032A1F327F08E38716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389880, "uuid": "71e90766-3c94-400f-85d0-fb57167513b1", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389880, "uuid": "d3cb9351-cf01-4d46-aff2-43b0874a5ecf", "value": "12288:pYyDi5eNiQ7uysMFZzN/E/msumGL12YyDi5eNiQ7uysMFZzN/E/msumGL13a0wI+:6bvgUGLbvgUGtafDd70iTWC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389880, "uuid": "655c45dc-4eea-437a-b99d-c167c5ac0083", "value": 1197552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389880, "uuid": "48273ad4-4348-4e9d-b41d-ba2e8bb60580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389880, "uuid": "5e745761-1a53-40fb-99eb-d11925d0a0d2", "value": "r3asw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1790bf-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764443043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443043, "uuid": "9b12ac9c-4dc7-427d-b600-74bddc4b40dd", "comment": "Malware payload (Gafgyt)", "value": "428b521f8d22da16e4071d63c93c31ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443043, "uuid": "be31f770-2f11-4663-a4db-37c7e8e28619", "comment": "Malware payload (Gafgyt)", "value": "41e4d207689732360f3b64167c5f6f9ad4446e7d5de7b280884c0d51c8054a7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443043, "uuid": "754a774b-c27c-4786-a142-cb00e0aba59c", "comment": "Malware payload (Gafgyt)", "value": "cbb5e5bd0ce30a80c1dcccad1e119e9c22bb751e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443043, "uuid": "249823f4-c7c9-41ad-923b-083b80975f8e", "comment": "Malware payload (Gafgyt)", "value": "d5fc0d448dcc7ebb99595ed7ba000aa735973f61c12c8fc823e61018c5c6a0fe453da30ec84dbfc1077db7ef8f62b176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443043, "uuid": "8d0fd58c-6242-4a89-bc5b-50d647dc738d", "value": "T1CBA33A41F841871BC3D327BAEB8E479D3B3956D467D733116A386EB42BC27C82E29521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443043, "uuid": "8f09619f-a8df-4624-9054-5202de6d7f13", "value": "3072:YhDJsL+PzGznLTzPmt9UmZRqQmDPRXXkQX:GAkzGzHzPBmZRqQmDPRXXkQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443043, "uuid": "c52aca56-66c0-4cea-ab45-579bed3e3a2a", "value": 101980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443043, "uuid": "0303173a-7b8f-43b6-8a1a-07f864e39ce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443043, "uuid": "569c2e87-0f50-4b79-91cb-771c7149e54f", "value": "Fantazy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8d4916-cd0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764412097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412097, "uuid": "85c4ae31-48b3-4402-92d6-8bfb19412466", "comment": "Malware payload (Mirai)", "value": "599206f83b78300862b7b4d9cbfd1676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412097, "uuid": "3862f2a7-eeaf-4390-80fa-394398f503bf", "comment": "Malware payload (Mirai)", "value": "428a0eda497daaf17b2c8ffdbab2d8c07a395718476713a4815636941e4eafd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412097, "uuid": "10cae2fe-7b7e-4499-aac8-e6c560e30041", "comment": "Malware payload (Mirai)", "value": "e667829934ce31a0ea5ff8a48d496296c78fd16b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412097, "uuid": "75d5774c-8e81-4818-a471-b9858878038f", "comment": "Malware payload (Mirai)", "value": "920c3913176ae4718d3379610c4e1e7c1ec88c356ab0a0d4c21e20bf3038948c4c2811c40a21d00d8276efda765ce685", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412097, "uuid": "fae245a9-7d9b-4281-b38d-8335a5b6106e", "value": "T1DE342A46EB804E13C0D627B9F69F42593333D794D3EB7306A9286BB43B8379A4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412097, "uuid": "782c0fe8-d95d-4daa-9aa1-e1e7d3eb696e", "value": "6144:dDgenRFRRu59AHaYn6Lhf4Q51XpqQoOt+9JrV/GiBh+YglZB:dDDFuXAHag6Lhf4QrQtOi/n+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412097, "uuid": "ac2a32ff-1941-438c-9ac7-029e58265102", "value": 252213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412097, "uuid": "7867e89c-5052-4e45-a870-bcb21c7bb7f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412097, "uuid": "50b6483b-a4d7-41ee-9e77-a4ef18f897ec", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2aa5d2-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764392039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392039, "uuid": "de613d2e-66bc-4904-b71f-567f392f3118", "comment": "Malware payload", "value": "8fb21441856e93664a4e542bf8b72641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392039, "uuid": "23f61aea-a303-449d-9f40-60d46c154973", "comment": "Malware payload", "value": "43c1e44c95b5b62f2cd65f4ceb209349820efa218956665c129e9aad64907264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392039, "uuid": "12d0f74e-bec6-44e2-9aac-9c2b11e9beee", "comment": "Malware payload", "value": "d2d8dd5939f81815984eb059b30f0dd2e1f87ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392039, "uuid": "d238502a-a4b7-4e11-9006-3533aad4a139", "comment": "Malware payload", "value": "ad9096dd24f296c01578f5426f54b00ac23e41d3268cef174014d78eb40a7fd9b0e3089cde1b015796a175d91ec957e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392039, "uuid": "96e02f9c-5914-46f3-a782-adf3345c7a52", "value": "T14C5507B96551D255FE3880B940F6865EB220713286712BFB0160D263EF1B6F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392039, "uuid": "bca5681d-47b0-4e78-af79-112e9f8e29af", "value": "5e3631c569a217cf469245edaaa125d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392039, "uuid": "bb8cb4fd-3fd2-4589-a4bb-2eb6bf5f9411", "value": "24576:0diCGvBxNvYYh3TBv29aajsGNwans6JuYdGo/migY3FY0Bmdy3SEII4kPKCw48vm:0QAe3TBvnSaYdx3LQyFC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392039, "uuid": "64fd44a6-c686-40e6-9988-b65c2faf075f", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392039, "uuid": "386d68ef-d381-4a57-802f-b466d8b79a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392039, "uuid": "05070f62-697c-4d4d-b67d-be638e1cbc00", "value": "zkvz14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb55b180-cd0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764411582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411582, "uuid": "49f00e0f-1c36-4b99-9177-b2679e3119c8", "comment": "Malware payload (Mirai)", "value": "6d4762a7288ae48a81948a52864278e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411582, "uuid": "748d150c-0c81-4bdd-9579-46fcd2e66b1b", "comment": "Malware payload (Mirai)", "value": "44475d182097bf5f452d0fd941663f8028a241a4be7ad82a590c671ff08a2cce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411582, "uuid": "40bab9ed-f6d5-4a6a-b6d4-50134af36a42", "comment": "Malware payload (Mirai)", "value": "3811f97dccd74b67936c2ef8ec9e4e6940367130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411582, "uuid": "16929fa4-34ee-4d75-a620-ae1a8ec13bf0", "comment": "Malware payload (Mirai)", "value": "f1b92fd1b92c1426b842184e88ead4d8e871aa1e46c175becc60bceabe1aa91b038ca4e18a5d9f99dd31e28a214d9790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411582, "uuid": "c83cae73-a94a-4c53-9b42-77bca2ee6c2d", "value": "T1D3D20822147D2E16E1E0B57902B70741A2E13F9EA794C74FBD260D4FBD76394286A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411582, "uuid": "050d1efa-8124-48ac-9309-22c9bd685b26", "value": "768:XaK8oFRtX3WVpDhTjcTPNGIt0GJjZVKwSG3:KK8cRtX3WVplTjcTPNGURPKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411582, "uuid": "b2edf87b-fd16-463b-9ae2-72bdb5a732c3", "value": 29424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411582, "uuid": "b62f8155-530a-48a5-939e-60687f3d0fe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411582, "uuid": "935501c2-507f-4275-8839-29361ac34716", "value": "yakuza.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c882ba5f-cd19-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764417107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417107, "uuid": "5680a140-b88f-43c3-94d8-302c25f6125e", "comment": "Malware payload (XWorm)", "value": "e0c20b1810d09bef142de73e1c4a7430", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417107, "uuid": "edd23255-c5b3-4ed1-949c-13de831e1a46", "comment": "Malware payload (XWorm)", "value": "445c84ddf3138bee315155f52a5c5cdcd1aff9d4e2dcc11d324d0cec215c9ecd", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417107, "uuid": "4a89331f-6562-4f3a-9437-7367f741adf4", "comment": "Malware payload (XWorm)", "value": "22e45b95a43fc7c22c8315b144f2f22a46e31723", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417107, "uuid": "43b782e0-bb77-469b-88a3-b5b284f59daa", "comment": "Malware payload (XWorm)", "value": "c74ee5071d3a73549a83c059e3d1e3ded328b428b67c1c40901fc8ca76f1f0b02ffddbef51397f1c7bfce17e758191cc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417107, "uuid": "453b421d-ac14-405b-849e-79c0fc27ca69", "value": "T1AC41CBBAF9D7E2404A399AF1F40E3448A3560252138154A57CEE60C30B1AAC30E89FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417107, "uuid": "5036c665-8c44-424e-a1ef-c33cc539d75e", "value": "48:3QYSC5d1/pF+oUrMV0KWaZ0QjzvJKeJ8kKQfxSJxV0U1yVXGeaK:3f5L+rM2KWa0wJ9J8k9gJx23Geh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764417107, "uuid": "5220b3ca-9d2e-48a3-a536-02230301bbc4", "value": 2074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764417107, "uuid": "49660904-8396-448c-b846-8f5b1079e387", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417107, "uuid": "46b0d15b-7f3c-4fa9-bde9-14a7d3850b3f", "value": "romulo.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a8f99e-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459320, "uuid": "78431820-31a3-4378-aba4-e3bdc0c401a5", "comment": "Malware payload", "value": "2ef4c2ba8471022bdcdb52e9d2fadf77", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-6615", "colour": "#584386", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459320, "uuid": "ce62e7b9-c972-4b3f-a1d8-6bf2c3c09f48", "comment": "Malware payload", "value": "44c84e5fa43d4529fb5aec99d7580e834fd62827ca3af8c57403f061f85b7386", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-6615", "colour": "#584386", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459320, "uuid": "80a2e035-cb98-48d8-b309-79de954db808", "comment": "Malware payload", "value": "cbe4ec8fa51ff05ab340b52aae14926f0db20b8a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-6615", "colour": "#584386", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459320, "uuid": "bcc9936f-5e31-4da2-8bda-f943d47784bc", "comment": "Malware payload", "value": "399ba3b9b794868b58cd49c76f66695c4c0bb34cc976801c1d4609a7ddc97aba8e8b5c8ff319d7e570f70f998f5f80f0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-6615", "colour": "#584386", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459320, "uuid": "182a1ef4-a18a-45b5-9e67-be2554b36a18", "value": "T158D63398C9869D1771AF3CDA9E9FF24AC08B4759375F5A7BA8DF2038132974D6302213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459320, "uuid": "2b2fbfda-e2ee-416d-91e0-79375af14f16", "value": "196608:0Hf0iioCyNZ5LZQAk2Mx1NGyixbPXC6A1hwfpakikJDqqZcNJlgJ34IHdLK:Cf0ENZ5LZQAk2WbV3ssNkJmqEbglndm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459320, "uuid": "c3e8871c-6d46-4fd9-815b-969cc04fffed", "value": 12814759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459320, "uuid": "a55720f6-4c7a-4242-8350-d6071734a90f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459320, "uuid": "eab572bd-3e5e-4eee-a7f0-780a62dfe803", "value": "\u267b\ufe0f \u27ff \ud835\ude73\ud835\ude7e\ud835\ude86\ud835\ude7d\ud835\ude7b\ud835\ude7e\ud835\ude70\ud835\ude73 \u27ff \u272a \ud835\ude49\ud835\ude40\ud835\ude52 \u272a \u27ff \ud835\ude82\ud835\ude74\ud835\ude83\ud835\ude84\ud835\ude7f \ud83d\ude806615.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea01c82-cd23-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1764421492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421492, "uuid": "e5a77f60-2ae4-4571-a33a-d61453386b53", "comment": "Malware payload (N-able)", "value": "3964297b2f2b232dff83a53247de7e4d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421492, "uuid": "fbc5e7be-c538-48c5-86f4-c50f4c6556ff", "comment": "Malware payload (N-able)", "value": "4507774f0c03a7413f492eb22ee26b6478fa17a7e3b96e7f5ea7e6c9dc486ea2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421492, "uuid": "86839a72-2b61-44e7-99c9-8e9b7122df44", "comment": "Malware payload (N-able)", "value": "41e6e1e383bd7368cdc71fef34ccf2ad168d34d9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421492, "uuid": "998a86ca-c701-4d0c-a111-216b1acce85a", "comment": "Malware payload (N-able)", "value": "59fbe5a157513c515e13a34f735de98ddd6c4b4d5623f9fcabcb31f4b89f2a9db5d90c094ba86e0f23dccee71ad9c8b3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421492, "uuid": "b0a02e7f-bd93-42b5-a8db-95b9d07722b0", "value": "T135E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421492, "uuid": "ca4576b4-e5f9-4c2b-b25c-a3a4d7a054e6", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421492, "uuid": "c1acdb33-392f-4787-aaee-24d88949de79", "value": "393216:EOF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1W:RrRxvoC/7a0jUxX7h1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764421492, "uuid": "1fd080aa-5fd5-4f89-a1fd-72e43ec0db3a", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764421492, "uuid": "b5dc4d40-722a-40a3-8a44-eeec6a4948d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421492, "uuid": "a96d3ee9-ff19-4806-8ef3-856588314bc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b20d0b-cce4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764394370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394370, "uuid": "e9fdf4ef-0b81-4ea1-b8f7-5e4a2ed255ec", "comment": "Malware payload (Mirai)", "value": "6704f8bd455fcb77a1541aa0b14f7e24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394370, "uuid": "4673908f-0b0e-46b2-a5ad-916e05c4ab14", "comment": "Malware payload (Mirai)", "value": "452327ed0488f68d579ff85a9df3dfd0656dc6ca24179e52ba54d11560d48b5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394370, "uuid": "f2b34fd9-18eb-4e95-b407-0de9dfd53c20", "comment": "Malware payload (Mirai)", "value": "713e1e096c929358159759502df50312eb68a337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394370, "uuid": "7fa9a32c-946d-4ca1-8229-eb9d138acda2", "comment": "Malware payload (Mirai)", "value": "ae6364344bf03c9d3b0b03b58e96ae832c524ca10c0e66ebbc4a5a2f27abd53b8cd1f1fe31b6695f086b9dd1d3e4cbd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394370, "uuid": "6f2b31b2-0ad0-45fa-843e-77977d51c52e", "value": "T197C3C61E7E314F6DF2A8823447B38F35E79933C622E1D685E6ACE5141E6038D541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394370, "uuid": "a1e62a5d-7abd-4af6-a897-79d339dbb1fa", "value": "3072:6uRTMWjNHeUUXDWAAlR0wO56r+5E3awEy:0WhlR0wZKEpEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764394370, "uuid": "b076d5de-9ac9-4e3b-ac08-6a94136c7bf1", "value": 127288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764394370, "uuid": "ba92103d-6a30-447b-9f57-89c26b75b139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394370, "uuid": "f3adcbe4-1b53-4032-8e98-a002e37f53af", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c0235b-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409780, "uuid": "8620a1e8-252b-4ff5-97e5-f882aa9afdd7", "comment": "Malware payload (Mirai)", "value": "2fa6dcfc767fde80a08f6c3e021837ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409780, "uuid": "5f99fce3-0176-41ee-a4e8-d43cf61d618a", "comment": "Malware payload (Mirai)", "value": "45601802d92223a9d3afe82b538d7f52b16e243d24fe0a735a867e88e325c192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409780, "uuid": "b7d1e20e-f14e-4856-9264-bec601eefd40", "comment": "Malware payload (Mirai)", "value": "ad34283d25ab973a44ad2e246ee62f570ce710f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409780, "uuid": "acd4dc2b-dbf6-4741-8751-9b8778590211", "comment": "Malware payload (Mirai)", "value": "9c973aca98be2aa90a5b263203319c27bb561986eb27dfb5b4746a9f9dd918f8aa47cd18a4cbe403f800a4fe73f65582", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409780, "uuid": "c68f713b-4b8a-4d4a-a86e-46b10ca51798", "value": "T1962301D7232BC334C06F1DF09921DA90E48639D2978A835F158A13FA9DBD522BE39B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409780, "uuid": "2a46de69-da3c-4161-a144-f9fe1133fa28", "value": "768:DcDufvK/rZjPZPcsxJLysQhBfrlyu5zCissaQJ3w5/a82iriCplnOXzI6jH0eFxA:RvKt1kyJLyS2zPs3QJ3a/priSlnOXzIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409780, "uuid": "cfb91bcc-567e-43b1-8ac1-c8284cb2b3b3", "value": 46172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409780, "uuid": "642ff0d6-a849-44d4-97ab-cf3e95542768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409780, "uuid": "314cab4f-477e-42e5-8870-7c9011618c02", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d533f071-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389211, "uuid": "d61840d5-64b8-4655-87b3-bd49b071a1b7", "comment": "Malware payload (Mirai)", "value": "9365bbdab376185f2500d789d5fbf939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389211, "uuid": "adcbf3e1-3edf-4675-aeda-b13a54173b2d", "comment": "Malware payload (Mirai)", "value": "460e39482486b18d3ac83c81da4bb2f719c6f72bc514da0ef1e728d0f8a0a951", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389211, "uuid": "77cba063-ff97-4797-a8b9-ddd6c89905da", "comment": "Malware payload (Mirai)", "value": "12d1162d57033b28c135e678f5f673938be90c8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389211, "uuid": "cf922086-1a38-4b5a-9bcb-e0407a7eeb24", "comment": "Malware payload (Mirai)", "value": "3a3e6f6f49cd9966a1f4b259adcc4f6f9ed4470256766054fe17080ade4f26bd013e751b6bffbb0144631c607990d0bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389211, "uuid": "2ac908fc-e5ce-42d5-ba84-3eab59628c94", "value": "T122331841FCD2996EC6C4137AA77E258F3311B3A8D2CF3607CD586F21768661F4DAAA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389211, "uuid": "a57b5ad5-c3c5-496b-9788-562d63f34023", "value": "768:9ZyyN71CsoMLyqEmh+CV9fIrh5FwuMfbj89mNBqcjoAHVPnY2LHBNKnoKmzaK:9pjoqEuPGFwuMfbIcDFnY4OK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389211, "uuid": "7d2b4bd4-82e5-4afa-9483-7423cf077bf7", "value": 51108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389211, "uuid": "318b82d8-6f0e-4e2f-9f98-433f721cd4cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389211, "uuid": "a53ebac6-481b-403e-893b-d367ee6ee286", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23e6ac4-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389206, "uuid": "5d7257c1-2271-4178-8d28-ffd0216d0f2e", "comment": "Malware payload (Mirai)", "value": "bee39849b451b4ed928314afea38dd14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389206, "uuid": "b9960a92-3f6c-4a34-a33d-f5e291dc9d3b", "comment": "Malware payload (Mirai)", "value": "46910c1e19cf77b39a320c8a05d4e0fca4ef9d2fd046eebcc9342bef642c88f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389206, "uuid": "e09d97ec-ff76-4ca9-8c85-6c12d864b0ec", "comment": "Malware payload (Mirai)", "value": "6992b1514ad01ea86d2f57f2e7cc724473d55e7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389206, "uuid": "f180a843-373f-4339-96c3-61e1932f829c", "comment": "Malware payload (Mirai)", "value": "55acb8a900dd4065f51d01e24ace67fdc4ca68ceac9d4f32269e469d4af1c40174225d21b908455882cc2166932c8466", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389206, "uuid": "73fe1e65-d781-40be-a6a4-7b5351510a7f", "value": "T1A8932A45BD828F13C5C622F7F7AE058D37167BA8D1EB3203DD25BFA1338659A0D6A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389206, "uuid": "e53af8de-40c9-49b1-aede-f123384b5a67", "value": "1536:QdhD4RzXSLqccHET0DnykOHhmyVJX6s0col0vHy6C:QdhD42qbHRW3HhLJ6WHy6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389206, "uuid": "ad1eed86-afd7-4373-9cc8-655660a1bf8c", "value": 90680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389206, "uuid": "adea3dad-6ecf-4ae6-a13d-d6f687bea055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389206, "uuid": "5ce94703-84f0-47f4-8274-6970429b8c2d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178002be-ccd7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764388463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764388463, "uuid": "3fd169bb-1588-49dd-b7bd-9bf5d595845f", "comment": "Malware payload (Mirai)", "value": "7429a47ccfefcbb1c9d6ec128ad289ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764388463, "uuid": "b5b452d7-e33a-4c5a-a1c0-28cc910eb87c", "comment": "Malware payload (Mirai)", "value": "4696de37b0e736b8694319452a9d49c11dc9d72fa186060708e795fd9a3043cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764388463, "uuid": "6d105720-b8ac-448c-b6d7-acfccd8143e4", "comment": "Malware payload (Mirai)", "value": "4aba979c34b58b90453a21f6f257dfaacf6b208d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764388463, "uuid": "b0db0fd1-ad2f-4acb-954b-bf8043d52c0d", "comment": "Malware payload (Mirai)", "value": "062e8a6b46186a20d7d42bf29ef8afec49ede9f0edf8bb9f10a1014aa22952a5ea45c802a4179f4c2e7e22f2159e2c4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764388463, "uuid": "3f861378-a2e4-497d-acd2-703b5e2f4fda", "value": "T156619FFB0349063B6CB289D732BE44457294859B54CE6F76ABDC28A40E8EECD7C42652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764388463, "uuid": "f5d4ce64-e19d-4a97-b9ad-ef22b487ced3", "value": "48:iw999vw9Q9lw9n9Dw9491w9+9Jw9m9Bw95V951w9Z9Hw9e91Lw9l9NJw909dw9Q6:iyrcnl1aqhLsXl0UVBgJs9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764388463, "uuid": "dab1daf4-d988-4bf5-8274-6f55895cef26", "value": 3344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764388463, "uuid": "8ebd460b-82aa-43a0-86c4-ba50042e6b39", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764388463, "uuid": "9804ca51-5427-4ea3-aa35-5e63896e75b6", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5788fd78-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389859, "uuid": "85b7635d-af5c-4b43-a9af-244be2f5e42f", "comment": "Malware payload (AsyncRAT)", "value": "cb6a469c1ccf70afe4b1b0d162c2157f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389859, "uuid": "474143b3-9602-4b4d-b6c8-bd3a9aeeb345", "comment": "Malware payload (AsyncRAT)", "value": "47f39a319c73cb2fe2099b7daccdc053200a08d8ec2f5ec119d5c5b73acd30af", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389859, "uuid": "8241836d-5c3e-4867-a2fe-51ca1764cce6", "comment": "Malware payload (AsyncRAT)", "value": "7cd73e678427d5876e35109d1a483f4b7bdf342d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389859, "uuid": "74b4268b-b054-4df5-a677-05d01fb52b50", "comment": "Malware payload (AsyncRAT)", "value": "83c9394552738e1e8a37684812b26a37506c8c3fb1420ce470c5a668a605bd01058fa6ea79927952bb160db90f809930", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389859, "uuid": "02826b35-fc52-4a2f-b3e3-87c006d17ed5", "value": "T172059E10F7904039F4B359368ABF9729963DBC620F6596CF93C8062E1F726E0AE35716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389859, "uuid": "ae228a0f-0d3f-40a4-9094-1ca84f52a66e", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389859, "uuid": "74519e88-fb9f-41f5-bed1-d8cdaf7f7165", "value": "12288:va7Di5eNiQ7uysMFZzN/E/msuF31Za0wIk0BX3RKuemGd70ioGuVWW6oIv:vaEvgr7afDd70iTWCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389859, "uuid": "fe5f98b2-2d96-405b-b98a-1ce299e21138", "value": 811304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389859, "uuid": "ba2a0de4-5e1c-4a3c-ae1b-a78329602c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389859, "uuid": "bfc92437-fa2f-43c5-9598-c1b8945ceb3d", "value": "k1oscr5h9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c603207-cd20-11f0-a129-42010a9c0007", "comment": "Malware payload (Ligolo)", "timestamp": 1764420039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420039, "uuid": "f75a3c77-971d-4df8-93a9-1c53d002feee", "comment": "Malware payload (Ligolo)", "value": "1bc4c48a4252e73d41e70992dbbcf404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420039, "uuid": "ce4187cb-8fe8-40ef-a675-12b69e49f4e4", "comment": "Malware payload (Ligolo)", "value": "48868c98dfabd703031587cffdbe5ca26ac180a15e89a52e59915710f1836f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420039, "uuid": "6235cfc1-2e09-4d7c-8ff5-bbde51599f62", "comment": "Malware payload (Ligolo)", "value": "3bb4ca9dff55374b299fe2188a299cef6ac829a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420039, "uuid": "227b193e-85f5-48bb-b2fd-63fe5623b46c", "comment": "Malware payload (Ligolo)", "value": "177e6d3c7cb2d6955105f82a65ff67ca3312f3e28247403161d3f7fc86282aeb6ed2e180631e07ce7181cfb612ee17b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420039, "uuid": "f124f5da-2549-47bd-9bc4-38599a505de3", "value": "T1B4665B47EDA545E8C0EED63586229293BA327C584F3127D72F50F3292F76BD06AB9700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420039, "uuid": "4d82b809-b140-4cc1-8513-4f7aed52a825", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420039, "uuid": "b09e9e9d-abd9-45c9-b7c0-8df83c6b3fa5", "value": "49152:+ufpIxR5ouJw2PH85Por4Jk4y1GbqZ0oEjOYFfAhl+EO4TW4jt5EYpMUJ2Zykh7U:6RbENoEjGhssEmhIyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764420039, "uuid": "ca793d46-58f3-496e-a05a-6a269241257f", "value": 6694400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764420039, "uuid": "92be75d5-e57c-43b8-967d-59afc2dc3a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420039, "uuid": "7168202e-475d-44bd-a8e8-28217b5431d1", "value": "SecuriteInfo.com.Win64.Malware-gen.31734672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e6b52c-cced-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764398201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398201, "uuid": "01e96f2d-31d3-4fd6-9511-cf39798089d1", "comment": "Malware payload (Mirai)", "value": "2dfca6231f1b743c39652e3fcb9d8486", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398201, "uuid": "1810d925-2424-4690-9b6b-bfc40b189204", "comment": "Malware payload (Mirai)", "value": "48adbba35987c2b3584f40a77b09663db052cf9384e7b4f0a256aaf24fbc9b0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398201, "uuid": "3d10e5cf-05b8-4667-8fad-8e14292f70c5", "comment": "Malware payload (Mirai)", "value": "51941bcbe63e6c8bdd4c40eac3420d05ec311b95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398201, "uuid": "cae14712-8b4b-484f-aff9-92018347aa79", "comment": "Malware payload (Mirai)", "value": "aa0d4295a2a01e7b3c65373d1c0104922a24a5c617dfc690a1a2c26680df6b505e8e3584bdef2e28144bcf8f653248cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398201, "uuid": "88234fa7-3f36-4428-80dd-9c5c5b20490b", "value": "T11DD25C22243C2B16D4F0E277237B82B2F2F91A8915D4DA9EFC760E5F9F15620059B277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398201, "uuid": "dda74e5e-ea68-4bcc-b811-8ded0220e128", "value": "384:vTl7TLwJhsnqxlTlofLb5MnMUD0C2ed1zMBIyXPeqgunpxoTHQMre9cjKRjIuGmF:R7T+N3ofLb5MMUoCHiIPupxKcvxSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764398201, "uuid": "0d823ea1-b881-4f50-9ecd-e578ea651382", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764398201, "uuid": "70cfc7b2-1b91-42d2-8129-3b9e2bb058f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398201, "uuid": "2c1df914-4703-4481-aa60-19ae7f50580c", "value": "SecuriteInfo.com.Linux.Mirai.4704.22535.2382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502eec52-cd09-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410033, "uuid": "4a1eaa2b-317d-4fb2-b897-d7053cbcc297", "comment": "Malware payload (Mirai)", "value": "6e978fd220307215bfbad4aedcad036c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410033, "uuid": "5a99f16c-15bb-4322-9126-24880426dc67", "comment": "Malware payload (Mirai)", "value": "49f8220b6a28cd74cfcf53e6e34245c4c73e0e0ae0766497ad915191f2a370d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410033, "uuid": "a7d20878-152e-4a3e-b786-839c56a25539", "comment": "Malware payload (Mirai)", "value": "247e8f5cd2364180f5de811515e9d53421a9be50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410033, "uuid": "f143fa0f-9131-4612-b6d1-22d2350a475c", "comment": "Malware payload (Mirai)", "value": "acd3c18458739725829f90d713ccc64e798f0168ed0b7db71c40310d9fa00129816f04b0d21637f24815e17bcb43a1a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410033, "uuid": "8c4fb26d-5d35-4dee-8878-a826dc6f017f", "value": "T129D23A2B90D999E8C1E10675C9AB44390B57F515D7252FBB4ACDC4821C0BF6CBB3A3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410033, "uuid": "0c4240df-67d6-4d56-9d5f-4e256f59a870", "value": "768:0PXz2ZZY6VYzTPeeeueT/FuovrdxHECY1:aXiiMYzDvXGNukdtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410033, "uuid": "a8cabbae-3413-494f-9a84-5598abcc5e43", "value": 30112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410033, "uuid": "131b115d-77ff-4bd7-992d-d5d3fe5f92b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410033, "uuid": "ac8e3995-84f3-4a5d-aab9-1d5a3aecae44", "value": "yakuza.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cd9525-cd0b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764411089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411089, "uuid": "72c69497-67bb-4410-ba20-04116bc11b62", "comment": "Malware payload", "value": "46af1e43887e5597b4cab9d818fda4da", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411089, "uuid": "38b5917c-8b6e-4a2c-9bd3-f9346aacd920", "comment": "Malware payload", "value": "49f8f459aa8ffaa6c93a58a5234c1f94172d2d9b3737db129c43fab53c777ac7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411089, "uuid": "17ff46b8-9084-4f0a-901d-d6dbab251e54", "comment": "Malware payload", "value": "9e92bc36d77332b10ecda58ef9a19b10629f3f51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411089, "uuid": "5769f903-5d15-4ae6-90c1-edf5d003126f", "comment": "Malware payload", "value": "e9b11a76a45cdf55cecd3980302e9795e3d537225c612d1de35104f3ed354f522dbaf72757265c1491aeb52f2d1fef60", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411089, "uuid": "a2647d38-02e4-4ce9-9c66-f7a8317e80c3", "value": "T1962110DEB6A4A1138C8D4DD4B06988C6728D8AD0B1310BCCB74944F7D9CEB1D7249F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411089, "uuid": "67a29926-9101-4024-a7b7-a941d1c7e220", "value": "24:2RDNNI937FK8G56f27dN6x79rlH0JgTHR:2RKFhAH/Q9rlH0qTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411089, "uuid": "c7cdc236-2098-480d-8d45-dcc8d1a32db9", "value": 1114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411089, "uuid": "8ca71c39-f46b-4db7-9242-e966f88f51ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411089, "uuid": "637f0ec7-4526-40de-a58f-bd972a86245a", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d456b684-cd14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764414979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414979, "uuid": "cc4f9786-b786-482d-8f08-172c62dced9c", "comment": "Malware payload (Mirai)", "value": "abb78e445265f8c319aba90670f3b30a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414979, "uuid": "3fec590e-16a1-4c72-b252-c1f6e8380cfd", "comment": "Malware payload (Mirai)", "value": "4a01de785e614eb11c2df0db300c306e3b37a58207aeabe7f1afc4be8d1c4401", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414979, "uuid": "6bd63e71-3dca-49d7-ac48-0a9a18098688", "comment": "Malware payload (Mirai)", "value": "2ebaee8a525c7491e570e2ead7430fc8f00cad39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414979, "uuid": "f6af18ce-5f5b-4045-a5f1-0fce35f1908a", "comment": "Malware payload (Mirai)", "value": "540b29af50e6ccb3bb82c62c90d7baa2b672b8490114d041ebafec4917480ccdcdd35bf45773a6cadfedc6ab2b26855e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414979, "uuid": "ad525db9-bbb0-43d4-ad48-c06d23ed6fd7", "value": "T102B3C709BF611EF7E86FCC3709E91B0128CC692A21B97B757534D518F24A64F1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414979, "uuid": "0b938826-f7d1-4a22-bf72-1c5de8754e51", "value": "1536:UKHGTVO/dXfCAbQSdEWslAswt1jUj9mlwNiZ52jDuANF7e1BGYggbkR:UKiedXfCAbBEW6IlwNi6fbEDbkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764414979, "uuid": "f3bad253-1a40-489c-aaf8-a9cf287263ad", "value": 113856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764414979, "uuid": "48537b2b-5286-44d0-be13-3caf04c4be31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414979, "uuid": "fc4fdadf-80ed-471a-a26e-3d13a04d4ede", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d7ecbf-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389153, "uuid": "40517e25-f606-4101-b814-d64c842feef7", "comment": "Malware payload (Mirai)", "value": "c956d527788f5e2e427abc7005b9913a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389153, "uuid": "85f9a607-ec37-43ce-adfc-10e8d0d4a57f", "comment": "Malware payload (Mirai)", "value": "4a4b9455ce2a3e2ef604d0594bb805344491435b23f2f49aff89ff1113e0b31c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389153, "uuid": "8168cbe0-2c09-4b98-9f90-595ac5397a12", "comment": "Malware payload (Mirai)", "value": "10bdb8b50ac75a4938b3ddf67d4b8d30f2a8407f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389153, "uuid": "49b01490-1ebc-4739-9726-d74a1b384d5e", "comment": "Malware payload (Mirai)", "value": "a93a7610262080f0cead4d3f4d7babcfa0bd7327eb676cac61c1ad72246ac54d4beb3a4d3fca5e26e9fa99e070a26618", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389153, "uuid": "87c88ebb-eb16-4e4c-a6a0-3fc2b2c593f2", "value": "T1E823F1B0BB5634339B444830B45E6983613719F5B26F58D383A1CA787ADB6E52FF81C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389153, "uuid": "3168e480-eabc-4ccc-991f-dd6ec686b303", "value": "768:f9p4OQrbFJ6eQAHV6PbLKwhUF6GyrCiuBDJ6W4mnyLIPzP0cJx09q3UELp:f9BLex16P60Anyr/YYW08Pb0YTLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389153, "uuid": "d3ae70c0-7ab5-418a-969a-8df8f148a1bc", "value": 48080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389153, "uuid": "a39aca6c-2677-454e-a84a-d76f02a5876b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389153, "uuid": "7560de70-a8fe-448f-8e6f-a047c52bc2aa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6835b668-cce6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764395041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395041, "uuid": "35dc96ed-e525-432f-aa29-6f636a0c8c94", "comment": "Malware payload (Mirai)", "value": "abbc2c3a1770000a194b09a6b9674992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395041, "uuid": "b9fd3df3-c240-4fb5-87d5-96095caa8ce3", "comment": "Malware payload (Mirai)", "value": "4c3e4bea85a028601a1040390cef5439fe10b7658c429a0599600c3afdf33400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395041, "uuid": "e3e7d4e5-209a-489b-a1f8-a543309e62c2", "comment": "Malware payload (Mirai)", "value": "7219426d0507dc1f5cb0125d050c651724bdd1d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395041, "uuid": "9a5977b4-17d1-40f6-a834-58127659f01d", "comment": "Malware payload (Mirai)", "value": "7d1a2c685274e38ef7c8ea1382a45e508ac935896235a096cd9b9e290f83b9d7f5c1bf992d020f41e0c73148281eabd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395041, "uuid": "b2a31ed2-662e-443f-9757-983309cdf354", "value": "T1D9E33B05731C0947D1A32EF43A3F27E093EFEA8121E4FA44255FAB899271E365586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395041, "uuid": "116bb0fa-3eae-4585-8c2f-7b2f79117589", "value": "1536:DKZB2iz8Qd6VwrxMPQOZtzgxx88MNjOvANDHtY5fYqHvdyMrc3NZ6:TldixSKxGNzNjP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764395041, "uuid": "d0e60bbb-a730-42af-8fd1-4c387fc2b9b2", "value": 146228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764395041, "uuid": "1c125420-b70e-4010-8aa2-314c2910574c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395041, "uuid": "378aa06f-d6e0-4eb0-bd96-79effe175ec0", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238abfea-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412964, "uuid": "1c5b8eee-16f8-4f61-be34-595ea84c9645", "comment": "Malware payload", "value": "beb793929a50bf2e3dd206d78fda9be3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412964, "uuid": "5827825c-d0ab-4a1e-a4c8-42b9240f7686", "comment": "Malware payload", "value": "4cffbfb679c28842fc50967c84de7876778675e17187b7d6babe5fb2566a86cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412964, "uuid": "e57e9f87-c93a-493b-89c7-810a59f084ec", "comment": "Malware payload", "value": "8844c7b4b2796435383981fea492e2031822079f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412964, "uuid": "de1cbf6c-dcef-4d64-bd49-a274598f7d43", "comment": "Malware payload", "value": "f5dcef97c73d26d6e04b17d16402f8c831799a5fc4e6f0edd1c8112533b008b0c0429b278e4dfc251901c3949f0e4573", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412964, "uuid": "80298996-f9f4-4d69-b7f3-0cc8aa5cffdd", "value": "T110572317F2496CAFD8FBA3387C3A52661125AC25CB03E18B7C25733E28F75D56A5A1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412964, "uuid": "442d6cfd-2de5-444e-bed8-215224650bb3", "value": "786432:jdc0oIY/4xvKpFeTJFcWz9hKUE/iqwsyN:hc1F/4xvIF2JFcq9hKFqqyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412964, "uuid": "846911f6-7a55-4a29-b3e0-395f599c0cda", "value": 29648492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412964, "uuid": "5a44c88c-c9ae-4ed1-af7f-ce2803ae4420", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412964, "uuid": "b439a57a-f4f1-4941-b255-ba5427b70c55", "value": "TV-Garden_Ver_12.03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1063f36-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409766, "uuid": "4b40202e-d35c-462c-a81c-7ddf6b765ed2", "comment": "Malware payload (Mirai)", "value": "6550f7660a87e1afd3e4c54285b77e6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409766, "uuid": "5e97a9af-7df8-4fb4-82ba-aff91755ac60", "comment": "Malware payload (Mirai)", "value": "4d395836c919a525f3441f4013fe59462e4e1048371f533daefcd9c299e40225", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409766, "uuid": "3f9522d3-62a3-44cf-8fd2-b63f4330c66e", "comment": "Malware payload (Mirai)", "value": "57f6de3f48872867abf33f1612c261c64ec4c95e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409766, "uuid": "affbcb44-c385-41bc-95c3-d5cc4586ccc6", "comment": "Malware payload (Mirai)", "value": "036de78bca4650bdecc0975f70683bf6f30409007e4b41600fcfe8870d7fc6823a4e38ab0cbb22c6788cf54acfb2bf10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409766, "uuid": "9d9a1162-53f2-442c-82bc-3798b8244aaa", "value": "T199A3AF32DC2A6DA4D5428574B4E09F761B23E1C091232EFB1AEDC675A483E98F506FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409766, "uuid": "201114df-9a43-4461-bbd7-8edcc53b8408", "value": "1536:agk6SP1S6TnvqOZRhbaTK7sKUZL+mZXC6L0R46NAhA8r:aNP1tjhGW7jmZXdubm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409766, "uuid": "cef19cec-ff09-4b35-bacd-f401745f1ab4", "value": 100448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409766, "uuid": "f0a08acb-3637-4236-a24e-d669de94b3a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409766, "uuid": "fb54993a-31d1-4937-9b25-65069b8e1050", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b648bb7-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764443042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443042, "uuid": "e975f0ca-f3ec-424a-bb3c-0a9c30e93592", "comment": "Malware payload (Gafgyt)", "value": "657de7eabe99710f7636aff4f3a7dfee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443042, "uuid": "c9961094-be08-4883-9267-885a7f997647", "comment": "Malware payload (Gafgyt)", "value": "4df65fc7b61ad049919e088dc648552175871171ca49cf00862aea4c38534de9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443042, "uuid": "7c9c6e2a-2300-4126-9f62-b2f4b0359a13", "comment": "Malware payload (Gafgyt)", "value": "44783e466e18f2f9de3aa3b03fad901556ba36e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443042, "uuid": "593c5d23-1d40-4d7c-aa73-895173777870", "comment": "Malware payload (Gafgyt)", "value": "6c2ca0ebbc8cd32791a61c66dd9a4b098669df2f691be9ada0449bf16207e45f0a2ff97cf63da158c5a85044bdca6d0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443042, "uuid": "eaf1f460-db06-496c-9e74-f9f0e40bcea8", "value": "T193F33A09F6408B57C1D2277AEA8F424A33339B94A3D733155A38ABF43FC2B995D32915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443042, "uuid": "826af2b7-5448-4df8-a5f9-2d8af8b195ef", "value": "3072:Bi3eg/SaaOfhANbakAsloo9unH5EM/9xEZcmgwZBxPQgVa:xg/SatfmNbaEB9unHqM/92cmgwZBxIgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443042, "uuid": "90597cab-78b7-4b3e-a4e4-6920470fa538", "value": 161376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443042, "uuid": "8e67026f-3787-4404-8f37-8a8f94e9b1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443042, "uuid": "e31733b6-ecc9-485f-aa59-1be8a85e369e", "value": "Fantazy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0eedbb5-cd17-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764416181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416181, "uuid": "cfe98e74-7529-4fe2-ace5-233acc8250d8", "comment": "Malware payload (Mirai)", "value": "95bca96d60c19c595a416bcf83f003df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416181, "uuid": "728b785e-4cae-4bb0-b25f-35e6957ab816", "comment": "Malware payload (Mirai)", "value": "4e3307ac675c60fef24e03a4da7e2491f20edfd32882093c50754aad99623558", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416181, "uuid": "68feed40-0ad1-472d-973b-ce24d6fe3786", "comment": "Malware payload (Mirai)", "value": "dfff5165faf240ec45138d3d3dd3cfa15c0850fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416181, "uuid": "503a3ee6-d105-4914-9a86-d7739a48d52b", "comment": "Malware payload (Mirai)", "value": "5c387a95ae21ae5221745fbeaba2864b7d2970d7e7b3e5cc4800a72403d967bf04b520578f0be92cd3918bd1b181492a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416181, "uuid": "ab84e7ca-f564-452d-9de8-2a5a33b7cb1d", "value": "T101331984B891AA13CAC116B7FF4E43CD7B161398E2DE7303DD2AAF11378B92B0967545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416181, "uuid": "2ab94a9f-bac3-4227-8234-63b66da3f088", "value": "768:yzhFYObA3wnVB+YVE9iEMMfvo6eYxM12SU2C5oDmBL/VVC094wWBivlE0I:EFYZEDV/xyvhY12vf4mR9wbBivlE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764416181, "uuid": "aabd3df8-52d1-4a2a-bc46-e22785cd33ae", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764416181, "uuid": "c01aa4c9-8014-4023-9596-a619e5de0248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416181, "uuid": "4176387e-35ca-4d10-b083-824ef1bc5e84", "value": "niggah.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a75faa6-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389488, "uuid": "73287d74-6b56-4ec1-8fe3-a63c8dc34ce2", "comment": "Malware payload (AsyncRAT)", "value": "53b0bf0c709f28ae24b6d0c11a4b8719", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389488, "uuid": "5f3f58ec-40ce-4799-b174-4bb15e4be3ec", "comment": "Malware payload (AsyncRAT)", "value": "4e97faf11101f3e0eddd3226a2bcae4839b777315068420d95e515b5d5a8e67e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389488, "uuid": "34e06531-82d4-43a5-b065-c26bff6d80ce", "comment": "Malware payload (AsyncRAT)", "value": "e8df69a500f69bdc0090f9a864298d392993c011", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389488, "uuid": "2e4db5f2-a7b1-4f54-8be5-1567d04d4daf", "comment": "Malware payload (AsyncRAT)", "value": "bbb5265d8d34238105eade7a187ecffb9f0f56d6076dbdd4d35423634634945e920f1ed3e2ef3435bb0fae24bef88d34", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389488, "uuid": "84cee9a0-3e59-4cc5-b576-6aad850b5c28", "value": "T18F948C16F75408FDD4ABC57489924546DA39BC8B1B72EAEF17C8422A2F237F08E39750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389488, "uuid": "eb0bd319-9d51-4d50-af75-7b144572da5d", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389488, "uuid": "2ded9953-94be-475c-8b61-0acc89f8801a", "value": "6144:G+GYnA0zeWsDi5eJziQ8kV3f+RysMFZzN/E/msHOtbMrHEfsNrwK:qYyDi5eNiQ7uysMFZzN/E/msum7L1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389488, "uuid": "ea2725be-4808-4f40-a1a8-36b6e28f561d", "value": 416140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389488, "uuid": "0d69e683-4bf5-498a-88b0-4fe568b759f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389488, "uuid": "05c6a660-ad99-486f-8cdc-b8bf8c73716a", "value": "svb4uc1w.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a038a8d-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764443040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443040, "uuid": "fa183abf-72b8-4afb-9fad-eb8964811f4b", "comment": "Malware payload (Gafgyt)", "value": "0aa2bdde6992dc2ff0ef44af844c6019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443040, "uuid": "bbd2a0e3-c6a7-4a87-8e12-23dd68f032e4", "comment": "Malware payload (Gafgyt)", "value": "4e9b3f060aec87b300bc99aa7ad611516d08e63068c9f02c761b58338a5ba0ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443040, "uuid": "4ae8459d-e891-468d-a2aa-bd18151c7ed9", "comment": "Malware payload (Gafgyt)", "value": "267535422fbeeafc80f486619b8e3040740a06d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443040, "uuid": "67bf35e4-f6b4-4e78-a5a6-8b4e052b0021", "comment": "Malware payload (Gafgyt)", "value": "a4afe5fe6469af751307bac30e9d1b488ff03a90efed8eff6976fce6821865024661003c4142831fc268ed22446c0d54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443040, "uuid": "ab82ef43-1f2a-4d6d-ba45-f8628c51e053", "value": "T1D8934B23A152C6BBC0C796B41BDBCA619823B4B91773724A33D87DB53F128D95E5CB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443040, "uuid": "4a32052d-eae9-466f-aae9-4a1dd86367b4", "value": "1536:o7V4QxQySE6NE3/i7CZ3Qwmr38QUdGvbRgJWAQNIKmA+BWYXFUjaZ3tX:O9QpE6NAFlQwK8zgtdLm/BWYXFYaZ3tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443040, "uuid": "04908b50-4dd1-4f18-97c1-a204122230bd", "value": 96413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443040, "uuid": "0fb495e6-7e8f-45b9-814f-3332033d05ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443040, "uuid": "903d51db-4718-4cb6-b78c-cb683b0b6e5d", "value": "Fantazy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d26de90-ccdb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764390163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390163, "uuid": "968ac1b5-668f-4f09-8be2-1c0e5385d14d", "comment": "Malware payload", "value": "889b6048395e5408b5c3d6c03cb1dc6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390163, "uuid": "82e65d43-ed5c-4478-86ff-7fe31c549337", "comment": "Malware payload", "value": "4f569272b9c294717521386493f9e5909df82bc978e5185d6645843827f3cc7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390163, "uuid": "03011a08-8faf-4061-a091-f27a2929ca4e", "comment": "Malware payload", "value": "b3f2a52bc9f69193d3569be2a9e9aace96515f82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390163, "uuid": "a1c2588c-f7b1-4361-81e2-0285bd63f46e", "comment": "Malware payload", "value": "dedb4db3921e2f8e847aedd6c6c116a4d65fb6e331dcda596e221bd66b2f3047c9b50b8d7610ddc47a1ee1ef85c6498f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390163, "uuid": "7b25ef0d-b1e2-4fb3-9428-5b5fc7147ee2", "value": "T10EC2CFED8A0611FDC16CD1B69BBA2B953C290ED3F9024D1AB176B593CC874E179272A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390163, "uuid": "140531a4-179a-4309-a573-9435b041430d", "value": "768:2FnT8ox1yOnYKOeJ5RwHAw+96LZzu61JgGlzDpbuR1JG:2xYIIobJQAw+MtzuMVJuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764390163, "uuid": "dfcf8d54-0600-4c68-ae48-8d115bef6bc3", "value": 28248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764390163, "uuid": "b9308622-94ed-401c-8500-0e72177d3106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390163, "uuid": "12f17aa0-0c8a-490d-820c-85043045c78e", "value": "SecuriteInfo.com.Linux.Siggen.9999.12939.22251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16289c1-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389150, "uuid": "c504f931-7228-47c6-b491-563d8941b4a5", "comment": "Malware payload (Mirai)", "value": "2f25fce108e38e7a3411a044928353c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389150, "uuid": "44bc7e31-e351-43ae-a28a-9f94c2de6f34", "comment": "Malware payload (Mirai)", "value": "4f589cdc9b1e8c1b062fb33bdc4d802fbfdfa1e4755847150d9f21a3ff6f1f54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389150, "uuid": "dc57b191-0e53-4c52-8832-7dad5b45a268", "comment": "Malware payload (Mirai)", "value": "b1631689f70342f8440b27218fadc466f9b02934", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389150, "uuid": "a2763ac5-ebb0-4fd0-bc79-5377ad10c41f", "comment": "Malware payload (Mirai)", "value": "9ca01786c2e0dc9dcac1462d303ee81fabb20f444534a102af1b787df9c3e65aaebf37e76b9f684fece95c21ab459cde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389150, "uuid": "704dce0e-de79-4c80-bd70-83400f9688a9", "value": "T12503F120B4F0D341C62F98781CEC355918A1A5BE5892C6FDF88C7C23A19B777AB19253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389150, "uuid": "aeaf5050-2f30-4a5c-ba97-1962118b7339", "value": "768:ZSbw8FwnvKqLSnL6xmKto8KaamXs5mLpYyJqw3d6JCJnbcuyD7UHQRjD:Abn4LIImKH9XsYWyJqiaCJnouy8HyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389150, "uuid": "26fe27d4-9268-4230-bd72-331d75240980", "value": 40028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389150, "uuid": "001c1553-ead8-4ad7-aa97-a07a7773d3bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389150, "uuid": "edbaeb4a-5fa4-49ae-950f-264954924a32", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27f392e-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409768, "uuid": "7863dc05-e7da-499c-8b02-37138bfef4d2", "comment": "Malware payload (Mirai)", "value": "c5ef25ac4bc3c6cecf90dee0dccd4d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409768, "uuid": "62d0d99b-186e-42e7-9ce8-6477950ea86e", "comment": "Malware payload (Mirai)", "value": "505d5ac65c369556c6f5e0a9347917e71b653bef4ce418ee41a6ce81d5fc44a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409768, "uuid": "35cb1147-45f8-46bf-a0c6-b2852eadcf3b", "comment": "Malware payload (Mirai)", "value": "de0cbb38d708022a652ceaaa88a6b49a116ca943", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409768, "uuid": "5c58f7dd-f3cf-4a46-aa6a-39a66657eda1", "comment": "Malware payload (Mirai)", "value": "4b4c46d8c30f201367eb5fe4963ca6049135f97ac8b5e817351a7c0fccf2328779e050d0a5e1496662eab8f0c410ec8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409768, "uuid": "d8d7edc6-2b04-476f-a27c-10f0661cb427", "value": "T1DF13F102BF0C0CF28B741871A7A881891B7B37F848DF74B99B8811A8906796770BD9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409768, "uuid": "e23c3458-6fe5-4398-b4dd-470e4b4b95f4", "value": "768:pRnvdCaFmRxiLhTySdVCD9CRF06NPz9Miv5UUCzvcoK27LUaZszv5wBt8s3Uoz0:vvdV8cwD9Cjj79Miv5Zq1KWDPz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409768, "uuid": "dd7fe0d1-e078-49e4-9e74-3e3b6996ed45", "value": 44888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409768, "uuid": "15048a01-cdf5-4c2d-ac16-c7644de2e9bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409768, "uuid": "980e077e-6e6e-475e-b52b-2123b535cb9e", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b061db75-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409765, "uuid": "68514842-1ada-4d3b-b099-04baf2871913", "comment": "Malware payload (Mirai)", "value": "8c1dec02374deac92ae2b6dc72b3d2b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409765, "uuid": "74737ee8-4f0f-428b-bc21-65a84213ccdf", "comment": "Malware payload (Mirai)", "value": "51328e4d83b012bfae2157da4dc84fc5d16aa3b41d771fe75de41cbb38d5d17a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409765, "uuid": "790b8a39-7d1a-4cda-8b41-8b78919443f3", "comment": "Malware payload (Mirai)", "value": "e2c15f12c02da74a796703b285d51022f2d45d76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409765, "uuid": "d0ebc00a-93fe-4a68-8533-6ecb4a5ad842", "comment": "Malware payload (Mirai)", "value": "c6bcc65cfdc4abd8b16aa19f8981cb69aa5a9a29802b74585dfd27b3c61999b104b9161037eb90ed2c14396dd1db3518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409765, "uuid": "f2db086d-43f8-416e-9dbe-9c28ccbe1a49", "value": "T1C5E20A526CC19A2BC6E0127AA5BF419E332077ECD2DF731BCC511B047A8999F0DA7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409765, "uuid": "fb17471a-5709-4518-ac7b-db84217dbf4e", "value": "768:WvSAgWcEeefXHESoUECEsYR18QOMJWZ/UXvR96bAFXuMRly1d:pEBEhCEsg18rMJW5UXvR96sFXuMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409765, "uuid": "127b289d-74f3-4971-8bf9-9ba0f3f36242", "value": 34008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409765, "uuid": "27719cf5-2eac-47eb-a888-2b1be318c3fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409765, "uuid": "a9d0e368-2a63-4c37-924b-33578e5ddef9", "value": "yakuza.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8cefef-cce4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764394160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394160, "uuid": "a163dfd0-01bc-4c14-a96c-ca0ee6410e32", "comment": "Malware payload (Mirai)", "value": "3f6d8be79b016f9c5306539c8c0c571f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394160, "uuid": "fe0620fe-b250-4eb8-8706-c4de38d119ad", "comment": "Malware payload (Mirai)", "value": "51469f14777318d752bef695d87a5c59761a9915855cd28412797a20d9c7aae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394160, "uuid": "85c73941-8387-4615-9971-11c517f062ae", "comment": "Malware payload (Mirai)", "value": "99776c9f945fe82ab857459cb165587f7f7746c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394160, "uuid": "744b591e-8aa0-4dce-aec6-a959d04c22c3", "comment": "Malware payload (Mirai)", "value": "c96074ca1dc0f9a1f99ff54baa1970854162a572e71c39636b0a4c6da9a32cfaa3b0806bd8554e5d7faa071c59eeb8fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394160, "uuid": "67f60ac1-8f3d-4671-855b-651f373aa844", "value": "T113A33903B9C18EFDC059C23443BEB536DD62F0EE0339B29F27D4AE262D9DE611A19951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394160, "uuid": "c3ad8d01-bb1d-4dbb-8118-928f0a96afd2", "value": "3072:vnduEfHKpjAsmhWyQbu0T5R7/wXaopwf:vnsEfqpjAsmhhwR/U+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764394160, "uuid": "df92cb76-3364-4280-a5f2-303022cf45a7", "value": 105296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764394160, "uuid": "492133f0-9d1e-4fb8-aea0-c2c6b098f0e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394160, "uuid": "08467f9f-15f8-4f28-a000-3158e42922d8", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc411b9-cd34-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764428578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428578, "uuid": "e63c9180-f619-45ab-a9b0-166755534a27", "comment": "Malware payload (QuasarRAT)", "value": "02e91e9d5f7911e3176bdbc00d496c93", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428578, "uuid": "733ede56-5f01-49be-86e7-c25971d172d3", "comment": "Malware payload (QuasarRAT)", "value": "5183a83563c0569ac61eafa420a434d4bee4ccc436e2e75f59c7167d86e251b6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428578, "uuid": "f901deca-3c98-4c0c-b31c-b930a9136387", "comment": "Malware payload (QuasarRAT)", "value": "ccd3acef9e4a0ab920b56fc5eda53e2a31a29a7b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428578, "uuid": "58de66b5-2deb-402e-9f88-23ec4924e7e2", "comment": "Malware payload (QuasarRAT)", "value": "66c5e2117decd4d3e618b4567f9beb8a3505dda14354443aca349d5a7109a2821fdd1c2bf0f16f9bd8f7c3571f1ce8ae", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428578, "uuid": "01592d19-4a0f-48fd-b9ad-1fe4667506f5", "value": "T15CA5029487CFE25688FD9915D19EDD173BCA8B0F08AF85F6107A0DD7C18B271A81A07D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428578, "uuid": "fd0f24e4-5f1e-4468-9a09-a32aa2867e8a", "value": "24576:QcZglKN1wEsS4EWwUsNaOoC8xGZIihDxG0ZNus36M+Kr8LUP3+SBRn7/tywlDvUQ:pFd4pqZZDdzmKswllOVvBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764428578, "uuid": "2b22ee98-a399-4d9e-9e57-2d0ab89ccc75", "value": 2169767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764428578, "uuid": "25a5b964-f942-4da0-9b72-3400009b6a27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428578, "uuid": "ebd720e1-65e5-40be-8103-efada63845d0", "value": "crypted_942636.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e77e288-cd09-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1764409922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409922, "uuid": "cd7f3490-8f00-474b-92bd-7aa3e87e91d4", "comment": "Malware payload (VShell)", "value": "2f25552adace9d89cc261dc22c84dd39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409922, "uuid": "eba5c78a-293f-451f-ac8b-0bba69332237", "comment": "Malware payload (VShell)", "value": "52adc6234efa29d74addd083703c90c5198c37703733153d3dc9f0b8fb7a16c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409922, "uuid": "e0c5d274-758a-429a-a2e1-5bb6e313ec90", "comment": "Malware payload (VShell)", "value": "9ee9e6eb5e075900903081311ef72da3b1448837", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409922, "uuid": "a80542a2-d74c-4939-a79c-a5c7b9f2bb0a", "comment": "Malware payload (VShell)", "value": "728f1fb54db09aa1e612361362a8d0ef095e026f8dd2a7de7c2fb83cc516456821de4ce57f4286637a350659319c8798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409922, "uuid": "b22f4da7-5a59-4985-bd2f-f6a77759d202", "value": "T13F76F750FECB50B6E8031D3145ABA27F26315D098F24EBD3EA547F1AF93B6A2183251D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409922, "uuid": "a7f24ed6-8f5e-4986-afc2-7e6b1e0b204e", "value": "98304:4Z6PucVILfv25pNBUNried1jm4+2uTMbw+K:57tKxUME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409922, "uuid": "85f24919-aa2a-4856-9225-9d2cedecd8f9", "value": 7471104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409922, "uuid": "aedfd389-2eb9-49e9-b36f-a179b21ba708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409922, "uuid": "d7dc13b4-a505-4e2c-9983-b07ff81156ba", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4d8735-cd76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764457059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457059, "uuid": "10d57b19-7a90-4036-b658-7a57c41dbb83", "comment": "Malware payload (Mirai)", "value": "d1c76d20c820e7d28c76ca3cb4dcdaf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457059, "uuid": "e87f9a8d-3499-4280-93a2-a87e676a52c4", "comment": "Malware payload (Mirai)", "value": "52cab22af8c3957877bcff628877658946be13b2698bf6ba4399828491cb38bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457059, "uuid": "3a998b88-862e-4389-a48a-e23de845ae94", "comment": "Malware payload (Mirai)", "value": "30a5e977c7e181d846b46bca4b6b92d5b327befa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457059, "uuid": "6b2fa709-7a85-464e-8744-1263610f8dc6", "comment": "Malware payload (Mirai)", "value": "4575c8f02b33f95161aa6deecd29d165bfdfa3d08a78697e904bd85729859ccf4e287f9e65b5eb1b8c994b430c367e1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457059, "uuid": "8d39ba84-40bb-4278-9e7b-0b7d907d7ff3", "value": "T163634A01775C4E43D1A61EF8293F27E193EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457059, "uuid": "57e16e49-6ef7-45b2-8bf0-94f30202508c", "value": "1536:ZjVO2KsrO4zb5BdTqBpTaQnQSe1ECj5ds:CPsTHdTQNQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764457059, "uuid": "8b96e72f-5b60-4b8e-a647-f878d4159e99", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764457059, "uuid": "3880fe84-4eae-4dad-b0fc-c6cc381191a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457059, "uuid": "33ca82df-16de-4990-b128-ed4ceeb2dd04", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902e2498-cce6-11f0-a129-42010a9c0007", "comment": "Malware payload (Cybergate)", "timestamp": 1764395108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395108, "uuid": "bb7391f5-f46a-4122-98d9-388f4925ce6a", "comment": "Malware payload (Cybergate)", "value": "84a4e61789c0627c8fda8a3d0ff6ec80", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395108, "uuid": "8f4bc4b5-8e84-4c85-b665-7e6b6a46b461", "comment": "Malware payload (Cybergate)", "value": "52d6125bc34908c9d211d43b2f190fc6cd52f938beef3ee85ee8bdf83f4bde11", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395108, "uuid": "d7f48163-0f6a-40f8-8aed-feff890a0c2b", "comment": "Malware payload (Cybergate)", "value": "4e5aad468ba9cee17d0b708ed787b861834d768b", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395108, "uuid": "f7cf052f-97e0-4b26-8701-9fdbdcda400d", "comment": "Malware payload (Cybergate)", "value": "f33a80b794a16836028761a41dd0272474fa60323711203889e2369024ac7d18db6ad18c608153e351925170a102ea1f", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395108, "uuid": "241fdbf4-b523-42c5-a75f-61d152c02e3d", "value": "T1F474F1A2B6C0C6BAC1B40EF85C29C1E439AE7D352E674493F99D2F4F793D192690C097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395108, "uuid": "f36b83f7-b602-47ca-a73f-67e8af50ad77", "value": "e7f5df0b4a791b7e27630ca008501b01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395108, "uuid": "47fb6f89-e8c6-4ced-8386-1eb883b81f9f", "value": "6144:8mcD66R7qmvXYSmvXYp5JGmrpQsK3RD2u270jupCJsCxC:NcD66f8jZ2zkPaCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764395108, "uuid": "8273eb61-b38a-4b60-9361-1e24c6e09fc8", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764395108, "uuid": "c43300dc-8127-40cf-be43-e3ca51a9f09d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395108, "uuid": "3cbf77b1-7ec8-451b-8b58-a4620ce7f3b5", "value": "84A4E61789C0627C8FDA8A3D0FF6EC80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cfa0d3-cd33-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764428264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428264, "uuid": "a7ae1c02-0e17-4a72-a1f2-86098dbfbae0", "comment": "Malware payload", "value": "1a6137a80e46123644fe8fb9f33dd992", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428264, "uuid": "0f9f4d07-b1b7-43b9-8ef7-333ca04543af", "comment": "Malware payload", "value": "5332bc2125a1f5c960999fc829a68f5299ea0c381d026307d2ee5a972197a62f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428264, "uuid": "fe15e5c6-8415-425f-90bd-bdeb896bb978", "comment": "Malware payload", "value": "14d644f7110bac614334e8ac53618253c0d612ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428264, "uuid": "3ac94335-68df-44fe-84b1-f00d1caf047a", "comment": "Malware payload", "value": "e51393ecd47af4c7ff1b25d7a51b220a98b9e9007d69bffee9f28df02034ba041cd57d0536bcf4a443b0fd21a94d9651", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428264, "uuid": "1ef1888d-8768-455e-8a02-9567033f2d2e", "value": "T1EC1186D5154784E2D9EE9A2764638CB1D014E3C9F9C0793CECB9646B1C4572C344BDDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428264, "uuid": "d98b8f4c-61bc-4ee9-a192-db1df623da5c", "value": "24:HxkmkqkDkykakZkmkW8kPkwQq7yFxdhIqr:HxkmkqkDkykakZkmkDkPkwfOFxnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764428264, "uuid": "57af34ba-dd5e-4de6-87c8-f5cea522afad", "value": 855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764428264, "uuid": "41832367-bf49-42ba-af6c-10f1efaa5b45", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428264, "uuid": "162f9a37-2a2d-402f-8eb7-bfa09a867f6d", "value": "milan.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe263812-cd34-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764428793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428793, "uuid": "94aaf873-a1f5-491b-bddf-ff7c92737299", "comment": "Malware payload", "value": "a845bf809a781fc6c5161b842be0321f", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428793, "uuid": "e84321a6-b598-4312-8c05-db0213e463ad", "comment": "Malware payload", "value": "53692e71402019c2043f571b3f9d96cd4bdc0bb65d7bcca50f48bcd681f90c26", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428793, "uuid": "91b9935d-b3b9-41b8-a2db-4280b315edca", "comment": "Malware payload", "value": "c0e689058ed9ac32f4dc3a41cd8896b6f4a93fe8", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764428793, "uuid": "19e9ed32-4f85-430d-9339-c3a9851b26d7", "comment": "Malware payload", "value": "aebafa8f368301a89720d7dd99bcc9a93728c242988d913c67ac787cafa773aa730f69345d5afec0d5eeb592bf382c59", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428793, "uuid": "762e8559-ed53-4a62-bfd0-c472b7a32a2d", "value": "T1F2457D74F95AD89CF84AB135902D35798B9CB2F7B7C824A61C2C4FCDB409D14EA231A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428793, "uuid": "415e7b31-b453-4ce4-b744-9d1c79a25a72", "value": "12288:TaKYd7EN+YD8+LWRzn+FSHUfSu/ulmHpHq98Y7Je3cGsJoAQpLp18Eed6y4Mqm:Tk8On+F+UfNulms9K39sJq5peJARM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764428793, "uuid": "8a0d8230-0458-4590-90a8-329cde1dba7a", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764428793, "uuid": "c23be09d-568d-4892-8491-2a4e248ba1cf", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764428793, "uuid": "d9e387af-7e76-4108-94f3-a7766cc9fb4c", "value": "a845bf809a781fc6c5161b842be0321f.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38bbe5d-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389208, "uuid": "2fde2aff-e1ef-4c06-b7eb-503611eb7698", "comment": "Malware payload (Mirai)", "value": "991e309da09986592a696e32e08c9325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389208, "uuid": "464b6307-bda6-43b2-a3cb-59ab3d4e3245", "comment": "Malware payload (Mirai)", "value": "542a4be215389d69d072f21bf7cf5ea26f3efda69365992afffae933bb817263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389208, "uuid": "e38e150a-3063-4ed4-94d0-fb7b20cbe9e9", "comment": "Malware payload (Mirai)", "value": "9b0e7aa4c601cbeab4f3f000c361ad5b613bcfd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389208, "uuid": "feea8f54-d950-4e8f-99bb-682efb9abfd4", "comment": "Malware payload (Mirai)", "value": "00944e20f38820abfe8d2557d0d7f8855b399e182386683cee15b15a0df401dd4c23918efa26513b7368d535f9e1a7f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389208, "uuid": "cb4a61b4-cc55-461e-bedc-35e64a4569bf", "value": "T1DF736CC6F6C7C8F6EC130A3111767B2759B3E13E32A5CB83C3A9E636D812980E15665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389208, "uuid": "91e98bf0-b271-4b69-b26b-d835e80705d9", "value": "1536:zD+FnUYl4dUGbzmN2op8NW2Mzd+REYaGL3SGQAUBn:zD+Fh4dldoONVMBEEADQXBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389208, "uuid": "89f1e9ae-be55-4ac2-b0d5-c6ca858d0795", "value": 79796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389208, "uuid": "280714a7-2afa-4062-a696-8e5fa847f4a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389208, "uuid": "00c90c57-fe19-410d-9383-b3147dc6e3c3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b4937a-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393449, "uuid": "11ba8200-77a5-4473-9460-506caa14a486", "comment": "Malware payload (Mirai)", "value": "86f18ceec49fea69abd92fcd4d146a1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393449, "uuid": "8dc70f9d-2866-47a4-8dad-dfd3204cec33", "comment": "Malware payload (Mirai)", "value": "5555c88764897e7db620f209f7a54eb5bc1fdd0b6a28f3630e61adb72bcf930f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393449, "uuid": "16a3cd09-b864-4110-a6dd-068819111ddd", "comment": "Malware payload (Mirai)", "value": "7672fffffcab3bf2f9192d5389971fe61244e816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393449, "uuid": "7167929d-0682-4380-aad5-17a9db480535", "comment": "Malware payload (Mirai)", "value": "84fd08b441195d5d30c23453bf7dfe6f898c6c9cd31f6b56ff7be8261ad24bcad2a9b49fa157941ffebc3d993a946425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393449, "uuid": "adeb0506-8907-4513-9d22-bdb356fa7d70", "value": "T1E3A33C91BD51DA12C6D06277FB1E428D772713F8D3EB32038E259F31328A92A0E7B595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393449, "uuid": "5495226f-ed61-4b85-9533-7a64ab7619d1", "value": "1536:y2iXGoyymiooWRQktswwqS06RdknNa5up/KO72gDb4Evpv5Lemk:y2ijyzlQkt6q36RGNa5gd/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393449, "uuid": "f8ee50ab-e426-42e6-8b61-09ad66485608", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393449, "uuid": "0aa746b5-5caf-4408-a6d6-cbab45c7c0f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393449, "uuid": "f6ee38d8-70de-425a-af0b-bc3da4ee4dc9", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6517b1e-cd38-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764430417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430417, "uuid": "10dab902-05ca-4fb7-becd-f4645beb66e9", "comment": "Malware payload (Vidar)", "value": "aecc447b2b69af35e20c3ea91e21e853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430417, "uuid": "be69f526-1115-4611-9d62-c539d5936d55", "comment": "Malware payload (Vidar)", "value": "55a02d14de13134e77eb9cc787ac622791b38b74931d1588bb5750b06951c8c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430417, "uuid": "730e5b7f-fc5e-4589-9f6e-473a67682811", "comment": "Malware payload (Vidar)", "value": "29765840a9897f93ea3bf07ef59ffa8ae8cd5f14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430417, "uuid": "b27f74ce-bd68-42f8-a07b-8c7d5b94a68c", "comment": "Malware payload (Vidar)", "value": "e340b6c1fe7f59eb3880eac2c56ea8b2fd137a03429095640a7f03409c547ee1d4704866fd0e99d22cf34d78071aa84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430417, "uuid": "f0e2a76e-8c5f-4956-8977-60e2c1fd1a6d", "value": "T1BF757C121FF8818CE2AAC93943A5F233F033F49F6EF5A68B9150D646637275376087A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430417, "uuid": "a4caf1f2-429b-4424-818a-43e95845a1e4", "value": "e6e554cab38b7e31b3f9fe8438ffc61a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430417, "uuid": "0b8a5186-df2b-4a65-a6b8-4f84da5e0ba3", "value": "49152:+fw0t0GGpa2BhG7LbPVcJgUge/T/w6QPFkEObJV:NGGI7Cjb4Lto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764430417, "uuid": "8ab5d047-f78a-4a32-affa-014a29678048", "value": 1631744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764430417, "uuid": "5e623e99-29c5-49f7-9213-3dfb9d880601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430417, "uuid": "37b03185-e86f-47cc-90ba-b065618db18e", "value": "white.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676ad173-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389456, "uuid": "9d82c1fe-6a95-4f43-9730-7f2964f2aaba", "comment": "Malware payload (AsyncRAT)", "value": "f1e932a91ae6248fe628b5fc303b84e6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389456, "uuid": "13bc8455-0f61-4304-829c-1efd4ceae70b", "comment": "Malware payload (AsyncRAT)", "value": "58f75e02032fb21bbd4bcc72ed18edd24b986b206e51e7ec57003eabdf2883a4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389456, "uuid": "b34e4af5-e2df-47cc-819a-c1cdb3a5d275", "comment": "Malware payload (AsyncRAT)", "value": "35110411492f8121ed1877903b966051bd9f1525", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389456, "uuid": "1525c34e-2fc5-4c12-975c-aba7a8c3f289", "comment": "Malware payload (AsyncRAT)", "value": "70ff32c7d2df06830ab4362e263d0aae74603141add629211b4a13c79c27e2822dc38aec1f8a17c3230e525d6140715e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389456, "uuid": "436d5b41-c13f-41be-8f65-b8d599f5825f", "value": "T1F0537C1C77F1422AD6FF5FB528F36152D336E3239503972F28C4169A6617E888E413EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389456, "uuid": "fe06b8e2-3590-4eb0-89a8-52cb822fc30e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389456, "uuid": "5ac0e85b-51ae-41a1-80af-5171d23aa444", "value": "768:5qmsOpXjv6P1bv5eykDlfVMVoJVpIsSgzbYTyBd19KVuuJTF6eFOwhUvxBB:5FDydzYltMVoJVlzbY2HsJ56eFOwyBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389456, "uuid": "3c78d9d8-62aa-43cd-afa4-d6da09439907", "value": 65548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389456, "uuid": "c23dd37e-9a1d-4fbb-b285-3d564ac969f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389456, "uuid": "64630580-0795-4801-8542-05b3987db9da", "value": "amongus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8373da86-cd11-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764413555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413555, "uuid": "ea734dec-14da-41bc-a69d-d16c23629119", "comment": "Malware payload (Mirai)", "value": "645073781d0f191de532e83b6b5fd8aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413555, "uuid": "4bfdb406-49f5-4cb7-aefd-b2bcf617307a", "comment": "Malware payload (Mirai)", "value": "5931b574d728aecb780353af741cee822921847eaffaa22e7e2dc1230c0d808a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413555, "uuid": "627b41e8-c854-4401-97a3-0353cc92ef61", "comment": "Malware payload (Mirai)", "value": "f353a0f80f59e77da69e378f318d4a1e194fea80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413555, "uuid": "3795dbe1-e5d9-4d35-b30c-349593e7e078", "comment": "Malware payload (Mirai)", "value": "ee1a7101b8e1d9f5e9c4b80d849c3e6afd87a7634076a7815f20e25da2742d9b5bba7c077a55fe85dd04f133c7bdf98e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413555, "uuid": "82aa59a0-a5e7-4bcc-afe4-514f283d1477", "value": "T13BB30889FC828B2AC6D1537AB27E625D3361A7F1C2CE3213DD554B25378960F8D66EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413555, "uuid": "6dcece05-6e12-47b9-8e67-a7867e884702", "value": "1536:DWNFy2Bb3mlRfUbhndIsKTSzMHxNoSvUWug+i30BfTQkT04/:AFy2BbW0caWuqQfl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764413555, "uuid": "24dbe4ea-cb9b-40ae-9f31-653a82d81861", "value": 108308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764413555, "uuid": "9ee2ffa2-8b2c-425e-af21-37e2b3dbcd84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413555, "uuid": "d6357933-8559-414e-8eba-2e203fcdc52b", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fb73d0-cce4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764394369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394369, "uuid": "f7d131c4-9225-483d-90df-c4a11e7c047f", "comment": "Malware payload", "value": "d2cf235a38c1f40b59379fcf9d2ab3cf", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394369, "uuid": "517c1c86-101c-4175-841c-6cefefc98d4f", "comment": "Malware payload", "value": "59707a70be5a6f88ec5e4a404479ba69457d8b34358e58e9399d2f327a2e5005", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394369, "uuid": "3c0cc84b-92b9-438c-8ad2-4d31b0e61a5a", "comment": "Malware payload", "value": "c40f4810c85f4c64f5a11932d2e06570de0d87aa", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394369, "uuid": "cdc89b44-bca4-4ee9-a858-9f6364cadaa7", "comment": "Malware payload", "value": "5bb51c54513f21409e8caa6a2eb6323fdcf7bef762c4d2846df463c7856fcc2bb8916f73a6782969a6d48740553e37ce", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394369, "uuid": "8d774924-b94c-468b-acbc-f7e70f627610", "value": "T13651D753F816AD208D5F65F311324E1ABF9095236012AC57BA8C84989F497E4E0EE7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394369, "uuid": "9e0cf721-6cd8-4abd-a017-d2f73d5dcaa8", "value": "48:I/h+PTuIJcF7DUPBK6ttqKShq963OV/PeMez3ZZPBwvJED+EPBVoA6K9P6WXaNEV:I+u0cFXix8Kn63EXeMedPwvJLyyAZVJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764394369, "uuid": "bf3ee077-2a2d-4c77-8dd8-f06a6b32bfca", "value": 3067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764394369, "uuid": "2b4c230b-393a-4315-b783-6ae8fde7c42d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394369, "uuid": "166e8998-819b-4575-ab0b-08fd038fb99e", "value": "Q4_Report.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c81544-cd05-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1764408275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408275, "uuid": "d16b6e1d-76f1-4090-a68e-bc973ef3b680", "comment": "Malware payload (Ngioweb)", "value": "def54d2d758c6e3cc4789493412cc23b", "object_relation": "md5", "Tag": [ { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408275, "uuid": "06164e2f-0786-4b51-9b01-48a09396dd8b", "comment": "Malware payload (Ngioweb)", "value": "5ad2c36030bf6026b813d500a16f9c54b56d70933f6600428cbd19b8e69119fe", "object_relation": "sha256", "Tag": [ { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408275, "uuid": "10584b19-e901-4102-8c9e-67287781f62f", "comment": "Malware payload (Ngioweb)", "value": "70c9a10952a299e1ae59579b271e53eeb54010f2", "object_relation": "sha1", "Tag": [ { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408275, "uuid": "c047abf2-08a8-4bdc-97a6-aab825295dc1", "comment": "Malware payload (Ngioweb)", "value": "5c9020b27224cb6e6040c4b1e85b9fa7b07aeb726e783d94f8cf0654fa74a16106097d1402319811ed01a5cec2a695b0", "object_relation": "sha3-384", "Tag": [ { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408275, "uuid": "7b160308-afce-4608-97f4-40dfe191e25b", "value": "T134F027CD92A2DC325C934DEBB126961A9CC6C5C90AC64EC474CD00BBE08CD0470A6EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408275, "uuid": "05f04395-4686-44aa-9d7f-be4ed2cafbb5", "value": "6:ebw73w5/KDbA4PZ9wWLZA9shGo94RNAcs2rFLf+03B0bUeEZuKj6y1bmwb:3WKDbnPZ95ZMoOF7+MB0LEZuKGy1Kwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764408275, "uuid": "a3c1c717-a37b-402d-ac2e-36b4428a6016", "value": 459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764408275, "uuid": "342320f2-6768-4246-99ac-0a89ce9b7232", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408275, "uuid": "51389549-3e10-4911-9f53-fc8a8b96d857", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c57ffaf-cd19-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764416845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416845, "uuid": "c05bc77d-f819-46a4-ba6c-9fc15c6c4527", "comment": "Malware payload", "value": "22264642d66db431c42129e10577be1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416845, "uuid": "e46e06fc-ce3b-4d7f-9602-f22e5a68c70a", "comment": "Malware payload", "value": "5c6da77a80b2f46d0761363d1b037676a6ba794b570ec4b0cce57dd5183d3e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416845, "uuid": "ff2f14ec-8a31-4688-bbf6-8c8d8e69f72d", "comment": "Malware payload", "value": "efad0b946718c223b25eaf06ee03056b988505e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416845, "uuid": "2e0a4242-a7d9-4dde-a150-a2314a6a90d4", "comment": "Malware payload", "value": "e75e58da81f3bc62d0cda0dcc745c60cf20e9657efbae36261b70c0a26e8422901a3065a590e633fae2b0bab55a8fbad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416845, "uuid": "a1c033e8-6991-43fe-8486-4fef0588d7dd", "value": "T130565A07E2A600DDC16BC179865B9772EB71B8191330AAEF15A4CB312F13EE15B7E724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416845, "uuid": "d63d8a96-0814-4295-8542-78d6bbbe5799", "value": "e81dde106b986801369d84248adf5f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416845, "uuid": "6ba0c6c1-0486-4f47-b0a3-63273b7c6af4", "value": "98304:6Jnh2AxznKrhWSzGdVdVvaqfDu/xzMbzDISHm:6tqGd3Vv/feQ/ISHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764416845, "uuid": "7c6154f9-8d8d-48b2-b669-90cc5616bc3c", "value": 6156800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764416845, "uuid": "94d3c650-e79b-4184-87a9-2fbb1ddd3e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416845, "uuid": "2f13a5e4-0784-4c00-bbd4-48e4665b0bf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fae6f3-cd3c-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764432101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764432101, "uuid": "8131daf0-f46d-4b31-b09c-77ca048933fd", "comment": "Malware payload (LummaStealer)", "value": "e58ec09e5b51c936b3f9991a3fc20478", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764432101, "uuid": "caaa3386-06de-4a65-ba89-26fcafd02749", "comment": "Malware payload (LummaStealer)", "value": "5e40598990b71f8a41ccd908cbab2c25a4277edf7d8757155e538a1ab37e578f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764432101, "uuid": "e47532ae-48d5-4359-a967-fdea92cd615f", "comment": "Malware payload (LummaStealer)", "value": "3cd3d6132060681783e69afcec184be2123c6717", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764432101, "uuid": "06740cf7-bce0-4eda-a86b-79c10cfac2cb", "comment": "Malware payload (LummaStealer)", "value": "efb04cf8ca93944a5dfc522b47d663dffb420998f5f2f82cc57dc72b3891cc28f7820f3ba630a58269ceba05ac3b79d6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764432101, "uuid": "a8ba6650-a064-495a-953f-e4ba7f460cee", "value": "T1A0062843ADA2CBD6D08AC33AB9A221C1767A7C405B352BD30E5166752D3B7C81C76F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764432101, "uuid": "8eef5a57-6ae0-4d0a-99b5-cd0e72b93a4e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764432101, "uuid": "b46a23a0-8a90-4ebc-bab1-6b38ba30f54e", "value": "49152:JycaiQ2odDwzrztm6IhHO/UutFSGrppln9iR6HK9nGZd242hx+wc1nO9iLdOMw2V:JwTl4RpssGwufszVHjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764432101, "uuid": "39942cb1-97ab-432d-92d1-3abedb293ec8", "value": 3729048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764432101, "uuid": "f4ac3ac4-14d4-460c-a26e-fac0e8c64bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764432101, "uuid": "6eadf2f0-b44c-49a8-83c4-acadea64abad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43750de7-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393261, "uuid": "2c198575-0ee4-47d1-b648-4ebaeaabc2cb", "comment": "Malware payload (Mirai)", "value": "21a3aa655c84cd133878065a63b7bcf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393261, "uuid": "4ee3485b-a8d7-4f59-b1f4-3cb18a7c17df", "comment": "Malware payload (Mirai)", "value": "5e71b0b2caf3e84ebcde97bdefeb0ab19a1fe6d3fda5f714174d3d0e39f382cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393261, "uuid": "a85ecddf-5b50-46a3-bf67-df73cecb5203", "comment": "Malware payload (Mirai)", "value": "48483597b69ec9c68a53f4344f38d0a0f3cba577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393261, "uuid": "48f4e63c-203a-46c5-b914-e43a310d1f11", "comment": "Malware payload (Mirai)", "value": "824b98bce7711411e031eab627bd14a406616962fcf9a240c656a0519c4ffdffbd060fbc5dc0307b873d27a6d8a26ef5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393261, "uuid": "a9efa33a-f62c-4ca5-88ed-27f89be66ecc", "value": "T15A13748CF86A673EC3E276FFE78857CE327A07C8678BB626C635025537C9304A525914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393261, "uuid": "96308818-e6b0-4fec-9138-923afbf1f2bc", "value": "768:NOsRsKhc7Il21V32Al9OTq3nEQBn3Ovb4e63FxicBjkcoBHHHHHHHoTn0:gHMc7+sVlqejBn+0nDNSNBnnnoTn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393261, "uuid": "69efdeac-d050-4f6f-8ab5-b2396e884aa6", "value": 43287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393261, "uuid": "86dfc0c8-760e-42a7-b64a-a6faa6953327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393261, "uuid": "340e1bae-cac5-49d2-80c4-0ae5384735fd", "value": "niggah.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb0e03f-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409789, "uuid": "fd6b9e74-ecd8-4d9b-9301-fbe94b1dcf7c", "comment": "Malware payload (Mirai)", "value": "a7006b1e4df32c7b8d5395694b9c08e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409789, "uuid": "179e2741-d176-4355-a172-0add5f08c6dd", "comment": "Malware payload (Mirai)", "value": "5ead89dd99d75801b47285384e172bbbdd02685b44d0a247acf834ec3d5cbd5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409789, "uuid": "87f7338d-b37d-417a-96e8-241d9ec41094", "comment": "Malware payload (Mirai)", "value": "e0f653a9cd1a10aff58e62d1587d47d213670895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409789, "uuid": "fc2c2556-4feb-4fb1-b2fc-e5630d8e3003", "comment": "Malware payload (Mirai)", "value": "7728f18a3d56f8b56ff406dfffa674568fe6ccf11c12ecfbd13f16af17c055f1622a4a51c97e89352c39bfaa1e24afb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409789, "uuid": "b652b151-8750-4f28-9d8b-8bb973eb0f58", "value": "T12623F194EE467E2381E25D79DDF393A58940C3DEF8BB32675FB08490E08451059B8DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409789, "uuid": "2223c21d-db7e-4437-ae27-c60fd28b308c", "value": "768:XuTOvAZzfxOLY/2kKsOlflHSM5t/8tJtKeIJP1CToZuQXDRLeL9q3UEL+O:+CvANxO0nMzfytKeIJPE+xDLLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409789, "uuid": "dc1fc252-4d3d-4a94-92ef-c1561d518a06", "value": 47760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409789, "uuid": "dd1fd4bb-3b37-4983-b0cd-1ed866072ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409789, "uuid": "e72e9cfc-6a8e-4e3e-82c3-b9cb3ffc41fd", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717450e9-cd7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764458622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458622, "uuid": "734508c7-18b0-4e57-9e50-0eccb6144051", "comment": "Malware payload (Mirai)", "value": "5e50e78afc1b81402a521ea8055cee60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458622, "uuid": "25762dc9-e976-4b7a-ac0e-359378bfec0b", "comment": "Malware payload (Mirai)", "value": "5f25844972828b0fd557c3baf1442ae96fa0f6df9c47a18603bc7711d72c1593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458622, "uuid": "bedad7a8-fa9a-4315-bf9d-771d704f551d", "comment": "Malware payload (Mirai)", "value": "9e55e554c5dc5ffe71a276dfcec5bd7bf0610912", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458622, "uuid": "b25eacf6-2603-4e68-bf74-f666238af873", "comment": "Malware payload (Mirai)", "value": "30f9e9a7062594b1ecd75e24f6fe69fad29f557d714c49a457fd90d2b423584fa05c599c9bad75c08c02ffd263ef86ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458622, "uuid": "c41236d2-5c3b-4eec-91d3-53c98f2d02f8", "value": "T11C732ADAB800DEBCF40ADAB68557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458622, "uuid": "33201777-a370-424b-ac9b-1b0af056f58f", "value": "1536:awW0PKt9cwxjQ/PIXIdZzN3tD8Utia84GLf84Eo5WOK+7c4R6yN:awsghdZzNlFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764458622, "uuid": "dcc085f1-5333-429f-94de-1a5e50365ec5", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764458622, "uuid": "d206cbc1-60d4-4260-9acf-0f90c80d2298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458622, "uuid": "89e7894e-0daf-4b9d-9344-09a4e0322663", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fa5467-ccec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764397589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397589, "uuid": "1cbf3e83-281e-4b15-b633-69948cb0447b", "comment": "Malware payload (Mirai)", "value": "00f1b57c386d00e8d856c5b9307b2580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397589, "uuid": "72dd1f2e-ff28-44da-adc3-1737b5f57507", "comment": "Malware payload (Mirai)", "value": "5f30af1b0807d11fc8c8a2e8d0b8e22bacdac4b1d7abcba35f78b4ee99a832b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397589, "uuid": "40958bb2-8e1d-4581-a9a5-c1e5b96e0e55", "comment": "Malware payload (Mirai)", "value": "8b11b3f6c215d7f8e4b4d4f131290f17b9cb9a8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397589, "uuid": "a337285c-fb3b-45cf-a2ae-a57e7ded0541", "comment": "Malware payload (Mirai)", "value": "4c479113501364ce20251de4c384b21377114f937e5e9f63b0eec870545cd7c0d67433a70a9ce8c01d46eed98d603280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397589, "uuid": "d8dbbd13-f76b-40bc-8c00-28b731f68934", "value": "T1BB935BC4E683D4F6ED4209B56073F7339732E03A502AEA97D36DA873AC91950D60B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397589, "uuid": "a2e91b79-2e53-4681-8c3c-8308b966c3c7", "value": "1536:zlWmxDfKxjGidFdt3xz9OJLchaaJfA5aDBywWJIvSXMNm:z9xDfKxyidF/+JQkWAIhW6KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764397589, "uuid": "364ac910-f29b-4a0c-856c-811d88bd86cd", "value": 93412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764397589, "uuid": "3707c23c-f8b9-4688-bca5-596c0e9c5d76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397589, "uuid": "d36168a6-5ca7-4830-a3ca-1530146aa559", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78a6183-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409777, "uuid": "5a9b0774-530f-4e83-a881-aeb471ce605f", "comment": "Malware payload (Mirai)", "value": "f65daff67f883260aa08feea3d31d408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409777, "uuid": "85970b93-154b-40ed-a512-ece8ea88fded", "comment": "Malware payload (Mirai)", "value": "6056c165cf9981d27a4912a271476aad63322d2301fd57517b238e6863da66f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409777, "uuid": "521248ae-2e67-4469-bc60-1e1a371723b8", "comment": "Malware payload (Mirai)", "value": "fc65532a61cbaa65f7d9dbf154352c455480e9d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409777, "uuid": "ed8b50a1-ac51-4de8-8cfb-13ef06908eac", "comment": "Malware payload (Mirai)", "value": "f873b4e163ba71b829f47bba25ee340688dc20183dc3c32a5ac286a42563f38eda703b9683d5d72935c2c9b64dbbb353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409777, "uuid": "e5f59b1e-d6a9-4d7a-b0bd-cb72f4a2c42d", "value": "T1FAE2F7956CC64E29C5D8137BB5BE028D33116BE9D1DFBB16C8095B143B8AA2B0D73B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409777, "uuid": "0bb4111f-1a02-4205-8537-ec23dab7fb89", "value": "768:eefTlw0W65Qqte0N7uMsLsrwdKZ7lNDK6WUp/K1:/TlwA1te0lgQOArDGUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409777, "uuid": "123774e0-8ff1-4472-a6d4-b5613be3d611", "value": 31368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409777, "uuid": "5ede4344-77bf-4ba8-8d45-7046528c7478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409777, "uuid": "0be08acb-af73-4913-a68c-294d131101cd", "value": "yakuza.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f4bc57-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389430, "uuid": "125f010c-52d7-40f4-9f6d-ff00ac5701bf", "comment": "Malware payload (Mirai)", "value": "82c08819344da223e8b48af97d1ba3c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389430, "uuid": "7f5cc6a0-0695-4bef-9585-2945e996c365", "comment": "Malware payload (Mirai)", "value": "605704a6055014c202d3eaaa246bd3a246ac80b7e07403aa307b91987e6f13cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389430, "uuid": "8d5cd4e4-68c9-4d85-a8ac-2106882ea0c8", "comment": "Malware payload (Mirai)", "value": "a601376aed51a507ac74096db93c99436b218c69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389430, "uuid": "4871faf0-3618-4bc5-b766-b424253b8dd8", "comment": "Malware payload (Mirai)", "value": "a9726919526cce6f974ac0185468045cf71692960f0f44d41c77a54f737ff420bd4a34bff4dbdbf863856c5ffa7e0000", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389430, "uuid": "c21be91e-1ec7-4ea1-865b-fe446d192efd", "value": "T185330884B8819A13CAD506B7FB0E43CD7B16639CE2DE7303DD16AF51378B92B096B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389430, "uuid": "7c9cdc19-d644-4395-8b2c-d248301421af", "value": "768:V6vSLzuBHntB+wV89icULgGw8eZpM82r03qBo7mBL/VVC8V4w+JCvN0I:9Lz4NLVnpUGDp82ouQmR9wzJCvN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389430, "uuid": "2b15f8ef-393e-446f-933f-74034eed92f6", "value": 54672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389430, "uuid": "49dcbf34-4d0e-4c3d-b74e-402803ad16a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389430, "uuid": "c97bb924-7966-49a4-8e2d-6b06e3381268", "value": "niggah.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1d844c-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389147, "uuid": "2c2183fe-e2f9-41bf-bdf6-90f2ff63ab89", "comment": "Malware payload (Mirai)", "value": "7c269a4c701c16e4c21643312e9df141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389147, "uuid": "32351842-7c86-48a5-b3f2-3da989728c4e", "comment": "Malware payload (Mirai)", "value": "60d199dbf188fc4c029e9b970080a851d1f0b97f140855655e4e5eff5ce51d4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389147, "uuid": "ba6253da-7041-4330-be75-0c809babe13d", "comment": "Malware payload (Mirai)", "value": "ab0bb71048159d389eea579f9cbc1765fa8102ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389147, "uuid": "6ee14f2f-9945-40a0-9889-383119c796b8", "comment": "Malware payload (Mirai)", "value": "74da2e6c66d6eb093bbc3dd3b352337a7d29642d923677db4597c8d73a23430b36a7f6f9d1c17b6b4d4c5b2a32db51c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389147, "uuid": "88b6f5e4-e6f8-4de0-92cd-4654c1dd6d46", "value": "T115836C22B9391A2BC4E4A57722F34332F1F6438A24A8CB1F7D750E8EBF1559036476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389147, "uuid": "9f5316bd-20ba-48bf-98ba-9a6e1a6c46c0", "value": "1536:xTI32Lb5/wiIPupxDxhBatZ/Ym5/XJoAEntmz:0oEb/YO/5Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389147, "uuid": "2d8c0fc8-caf4-4aa3-9991-cf3930e64f7e", "value": 87168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389147, "uuid": "2ebfb87c-8f97-4eb4-9780-1f0bb638e186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389147, "uuid": "6a172ca1-2e69-4458-9c7b-71bb9fe91937", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4ec863-cce7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764395720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395720, "uuid": "1715e562-9a4e-4f03-a7e4-5de3c19fec14", "comment": "Malware payload (Mirai)", "value": "4f1d8f3ea13d28663bb1e4894e9963de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395720, "uuid": "39415657-e220-4fa0-b2be-320e157d1a82", "comment": "Malware payload (Mirai)", "value": "60f60e7a08e3242e515c985d19714edb0d2ef1796ddf6e26d35b109b04d304b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395720, "uuid": "6c78ff5e-14d3-408b-b6a6-633ed7fee1e9", "comment": "Malware payload (Mirai)", "value": "a335a4e7710e71b6550e5026656303147cca353b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395720, "uuid": "13054809-1361-49ed-b404-e46cd191a9db", "comment": "Malware payload (Mirai)", "value": "a0930031556d06a998b0f070fa58f473b031c791b82f51a728cd7c222aef8526ab4b483d34a5303fe3805ff576f9618e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395720, "uuid": "61af407e-d5aa-4947-a611-22dd90d76796", "value": "T1DF330984BC91AA17CAC15677FB0E83C97B166398E2DD3303DD26AF61378B92B0D67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395720, "uuid": "bd3f74ac-407c-4efc-893a-db79f21881e6", "value": "768:FwNAebA6wnFB+IV09iUsHPv4megdMxCCkGyGojmB0buB12oJwE8E0I:KNAEUzVPBvvVMxCPgYmO6BkC8E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764395720, "uuid": "c874dcb6-389b-4807-9c24-99eb0fb2979a", "value": 50552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764395720, "uuid": "f4db06fc-20d7-425b-88ea-52781c064a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395720, "uuid": "d5c601bc-ebe3-4f3c-b7b5-8a83c3694d01", "value": "niggah.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc834fdb-cce1-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764393142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393142, "uuid": "807c5cf5-3908-4de3-ac8e-e947b6f2213e", "comment": "Malware payload (Vidar)", "value": "f94dd55a4aecd7813dbc908c218cb94c", "object_relation": "md5", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393142, "uuid": "f304f301-b06d-44f8-8714-b541ddd4e2e1", "comment": "Malware payload (Vidar)", "value": "618515873dae8b8b5fe74477c424621eca4e4134ed3e68accc7bb565ed22bedc", "object_relation": "sha256", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393142, "uuid": "53bffbff-4b68-4efe-bf7c-8227ca0e5086", "comment": "Malware payload (Vidar)", "value": "d1647ef69b735ee6c81970af2e0387b08ddd3ec7", "object_relation": "sha1", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393142, "uuid": "fcde424e-74a1-49d3-8d35-ed881172773d", "comment": "Malware payload (Vidar)", "value": "6b737a77e87d4ab3a5d9703ff8f26a0e506e3d2fe6dae9f9550eba6a20719bd7ce85610a9816cffbbdc89711d97d1ff1", "object_relation": "sha3-384", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393142, "uuid": "390282b8-062f-4190-9912-1df46f6866e5", "value": "T1C8D5331E27C071B2D47283784AF21243EB73B9B157719A9F6598C6B88E173E04B7872D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393142, "uuid": "d161ec2a-d0ec-4705-9682-7b6983eb5deb", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393142, "uuid": "cbd003a7-069c-42b6-9367-aa4375629040", "value": "49152:qalurhqFPIn/ZLS2TzneDfPNMaJ42cz9nqfkZR2RNehSbUeI5uG2:qalusAnz83NJ4l9GkSRiATI52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393142, "uuid": "02f7aa0d-ba83-47fa-8d01-f4e2bd90bdb2", "value": 2798984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393142, "uuid": "11ed3245-5cee-426a-bad9-b23db2637d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393142, "uuid": "2b5e8985-ba65-46c2-85b6-ba37fcca4dc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544a549b-cd09-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764410040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410040, "uuid": "37597dff-fd82-487a-8d0d-078db8154e88", "comment": "Malware payload (QuasarRAT)", "value": "05e851cbb0d506836580cca4ab43ac93", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410040, "uuid": "784894e5-1a06-4d9d-b984-d9a0ba5e1e81", "comment": "Malware payload (QuasarRAT)", "value": "63674886121542e88979559c65062515e56da247d6d11f39e5de891743beb42c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410040, "uuid": "19122384-f218-4bf6-b835-623887676c33", "comment": "Malware payload (QuasarRAT)", "value": "bc7aed122c0b12f0fa3474d86809220a8a717b4a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410040, "uuid": "9901e2be-c30f-42d7-96b7-80b3b96b31bb", "comment": "Malware payload (QuasarRAT)", "value": "999a7b621fafec5c136848f2db68c295d4d384757b39fbd00610fd303b32a73eaefe01033394d258be5ddfbff5ac7273", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410040, "uuid": "6f117a31-691d-46af-882c-b545a866954e", "value": "T187A502D15034E548B2CBA516FF79D66F37A62F2A810F32C6C25D14FC8779E29E6C420A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410040, "uuid": "100c1094-eec7-4c81-b4e6-dbaaf5c28ec7", "value": "24576:7pm9pEYdBd70QJBXYTflmufSj4onBMsDIwIPKMxenz7KslByTHCSnI9ANCyNXg6i:7cPJzJpclmLksCPp/2M4oBVW0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410040, "uuid": "bdbbd9d8-9f12-4ace-ab6b-bd6b778779b3", "value": 2202645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410040, "uuid": "50d83819-125d-4ab2-a040-0915326a92d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410040, "uuid": "2888b292-732a-4111-8f43-24c3d598b326", "value": "crypted_948577.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845e3335-ccb6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764374472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374472, "uuid": "70031206-923d-4926-90a2-ff7af53a712a", "comment": "Malware payload (Mirai)", "value": "f6d6f7797c1fcfe999b39d272562d226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374472, "uuid": "2d2f2d5e-82dd-4edd-a513-a334d4f3690d", "comment": "Malware payload (Mirai)", "value": "63f0f7b5f69b56d07785c65a5447805fa9cd806e80b76b8ac5a67abefe7e95bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374472, "uuid": "f07cd1fe-83c4-4590-ad60-545cf55a1b96", "comment": "Malware payload (Mirai)", "value": "0da4ee9fd88e965bb089f467b7473d2224e68ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374472, "uuid": "54b8bb5e-2ef9-48d2-9139-61972c1f5a84", "comment": "Malware payload (Mirai)", "value": "89c94d441a579a93d4f49b97ba9146f4d30105797bd6d4bd1c367f1b8c2de550c53711a51573f583a9c41d4c02ffbd16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374472, "uuid": "9dc53fff-6ec6-47e8-8b49-7170e047995f", "value": "T10763E886B991CA26C5D412BEFA2E118D33131778E3DF7253DD106F157B8A82B0E7B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374472, "uuid": "f303b4fb-ab49-460e-9807-11b557a6d0a2", "value": "1536:wWnguTpvPeiQauE/Ha4qkCSmfyMvd+B3xMEimRIHbn0Atug7R:xTBPeREvahDSm6M0RIHbn0Atug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764374472, "uuid": "0d5801c5-9e65-40ef-8f01-391e7208dd2c", "value": 71820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764374472, "uuid": "1dbccf18-fc1b-46af-91c6-b96ff6d8df63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374472, "uuid": "1024edd7-d59e-4228-a08d-a2f7ad3db01e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf433bce-cced-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764398193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398193, "uuid": "df24bf7b-1e76-48cd-97e4-da3e532e57ee", "comment": "Malware payload", "value": "10d2c4eed87fd3cd97a1fa9c49aca09f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398193, "uuid": "f5540ddb-38d9-49ba-bc22-76ba8ae18197", "comment": "Malware payload", "value": "641d3bb6e92eb51bd2d3dc9c625ef1b47cfa842f137e598e9880c5bc48460f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398193, "uuid": "a0adf42e-0e38-4f86-a61a-cc8a55cfadfd", "comment": "Malware payload", "value": "30b3daed0290b02f95fd5a24b39762cb02c6af55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398193, "uuid": "7c8fe19e-91ff-4aa1-826b-227432111ce3", "comment": "Malware payload", "value": "3a82e306f574b39ec0ac38d705308e88e1361ff9c09f9001bdfcd2c7fc95976b09cc0a095e1f94c78ff462d61c10d04a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398193, "uuid": "c2e8819d-91ad-418f-9c7a-2c45cbe9e963", "value": "T18DA54B4BBCE508B9C4A9A232896295567A71BC550F3223C73B90B73C3F77BD05AB6740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398193, "uuid": "5faec0ea-5192-4f62-8ba3-fdf747354ebc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398193, "uuid": "90021cfb-fd51-4229-98db-83c292fab711", "value": "24576:eRcTWRcW4Fo4Fx8qJOMlf59jbZ2uRmqEcdkFnUSxjqbWP+d2Wq:eRcaRleo4FemjbZ8nUo4Wt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764398193, "uuid": "14374060-c723-4fbe-b093-4a77cc067ce1", "value": 2179312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764398193, "uuid": "f74d2677-aac1-4ff5-b221-17511ceab9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398193, "uuid": "73243627-3aeb-4cb0-8c8d-70fa3b74cc3c", "value": "SecuriteInfo.com.Win64.Evo-gen.92323374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa32f21-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409763, "uuid": "19eb3ea9-5cb5-47ce-91e1-e4ccef605b4a", "comment": "Malware payload (Mirai)", "value": "2708fad78e12324f2e63479492a9e626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409763, "uuid": "814c6f2d-49bb-43b5-812d-16abf6f2527e", "comment": "Malware payload (Mirai)", "value": "64bb7bcc59152db9f9263c098e2cdf8b90713a368efcff2b2cdb9c1a850f8504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409763, "uuid": "8e1667be-84f2-41c4-ba8c-d6dd48a80849", "comment": "Malware payload (Mirai)", "value": "386f4329ced4ad21c02e8cbd0fa3bbb39b6b2583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409763, "uuid": "6d0ca689-1465-4889-ac0d-0f2361ffa1b8", "comment": "Malware payload (Mirai)", "value": "9409a691483f23bb4991babca8590f781475b9d61d90726d27c0ba2a1cbc73d4c4e16bad0faa7cd669f54a2948a66235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409763, "uuid": "d951d1eb-5dac-4f10-b472-67e1f1d69f5b", "value": "T14EC2085E9C01251DDAD665BD25A3BF8C9E546310B0A30B0F97EAFEC23D363B86F11641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409763, "uuid": "cf15eb58-a68f-451b-b720-86ea890cd489", "value": "768:1V7jOe/oR8TzApQBmrexmRPnqfneJvocBw:1c6oSPKQBKEw/qfneJja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409763, "uuid": "6ae6ee00-5fa1-460c-b682-fb9c9ed7c707", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409763, "uuid": "b26b2222-1ad7-4347-80a3-8ffa9ea51fb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409763, "uuid": "5e18c52a-33b9-499f-b102-412a8dadd7af", "value": "yakuza.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8af569-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389139, "uuid": "45fded7c-8b39-46da-a11d-6a1c30eb6018", "comment": "Malware payload (Mirai)", "value": "ac0ed2c02a9177db8a831c96a38650c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389139, "uuid": "54acf921-e276-480e-bfba-4178581f9e7c", "comment": "Malware payload (Mirai)", "value": "65225f0c0c3ab73917183aa13c7fea945b729cc29abe8fd85f2e4ec4b761df8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389139, "uuid": "f0b4cab7-bb17-4b27-b68b-38b31d9b6d30", "comment": "Malware payload (Mirai)", "value": "7b49ae596c3d63989f49431418d7a9d1132a4700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389139, "uuid": "376f5fbd-5f91-42b8-8a58-f0f2bfbc751d", "comment": "Malware payload (Mirai)", "value": "fff8381351db374282abc686a0dc5ccc113d53a92db099dfdef5455d0f81d5983964b56896fd537542f92c55b28e7e80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389139, "uuid": "b4e3e2e4-85e5-4c44-a46b-d6c0b636c2bf", "value": "T1116301DB633E6930D0AF61B99DED80A4E342B543120BC797048DF6BF89E775CCA21A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389139, "uuid": "14a6087a-208d-4d06-875f-8ced599dda92", "value": "1536:Sawrs6FgLYE2bS4eMRuF9hHob5ycwhVcHVCWxJyln:RwYy+43RuF9hHob5khV0fJQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389139, "uuid": "206af205-feb0-47c4-96d3-1e690e8a8119", "value": 68296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389139, "uuid": "9f7bba2c-71a4-4275-93ab-2b55f99d7eea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389139, "uuid": "a7a39448-53db-4ad7-9d5f-14b42f266e8d", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498b60ca-cd0c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764411310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411310, "uuid": "b395daa2-cc35-4dd9-915b-551e11e8ab5c", "comment": "Malware payload", "value": "46c305eb8660e3bf3aca00fab96f3527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411310, "uuid": "ecfc1e29-7224-4e96-9e31-590895a63397", "comment": "Malware payload", "value": "65a1d8ca5284d70df6a0a5cbd9a69c11c87e8cf7c17483aa213c31fe544c9c9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411310, "uuid": "0bb1485f-3c8c-4f59-84d5-5b58a87416cf", "comment": "Malware payload", "value": "45fd6804e13be3ef4119fcea524cc78ae393f0bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411310, "uuid": "8ea070b2-aa0d-492b-8b5f-6e07d093d122", "comment": "Malware payload", "value": "a4a0e4e614df79359d2a0f49205ffceeafc015e886f67822aefa8b74c3e4c54c1b6be7bd1a86e3054f2bd50a6f52830e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411310, "uuid": "b5585fa5-c24e-49ce-b5cf-3da77fccf4c6", "value": "T1042733137C4B07D7F86B893FAB6463344518CFC786D7120601363849EFA27E666689BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411310, "uuid": "3e174f9d-b6f9-4ce3-838f-71d6727489da", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411310, "uuid": "54232792-5f73-4f76-9bfd-d85983e8643b", "value": "393216:jFuE2Y8PoOkWhb9y/MIbchIN/B41bjHLk1RJpNcWPJEVn5dggMgacaQ8vVHS:jFuHPoOf9y/fIMZwbjoTHNceJ8n5igMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411310, "uuid": "abe2badf-e59b-49b9-9742-8935330b2a1e", "value": 20658376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411310, "uuid": "11ac2b39-ecdb-4cd7-9e5e-a847a3f48bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411310, "uuid": "b03b0158-3c62-4753-9b9a-0178919e4f95", "value": "RV-tools_4.8.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36af15d9-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764412996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412996, "uuid": "6be7bd91-3267-4922-a0fd-73ad141ca09e", "comment": "Malware payload (Mirai)", "value": "6024a7b3231c99a6442e73daa34f96c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412996, "uuid": "097d9335-ed33-4916-a070-2ae10c501362", "comment": "Malware payload (Mirai)", "value": "65dbf6d14fd4d3daaad1f2a7e92ed78115dc7bddd2e288107d5b1aab74cf5237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412996, "uuid": "77c82427-859e-46e4-bf63-817e631b8c56", "comment": "Malware payload (Mirai)", "value": "035975da6ddc55bd9d4c729c542460d1ce1ea124", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412996, "uuid": "6f348198-7362-410e-b8fd-084bc22b5c94", "comment": "Malware payload (Mirai)", "value": "2543c924fd23d13941a65e8d07124a2acf4ef56afad92570d2defd834f9aeeb49db3f696eee23cb8903d93a31f195033", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412996, "uuid": "1feedde7-6000-491c-bff6-7a4995f6bb68", "value": "T18FD3AE63D8319898C1368178A539CEB61B33A5C143A31DF723EAC5395097E99F62E7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412996, "uuid": "a0bce50d-1413-4e90-844c-87069747cea2", "value": "1536:U/kvH4wpZ11STdFQ4OyCt0fos3V+Zl765B4agwGKzUv97IQmKM3jCVaBIrx9TKX8:UMvHX9cXQYoD+n7ow5zi1M3j1i4O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412996, "uuid": "5aaf87a4-8955-4ee3-a991-a537023852e2", "value": 137168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412996, "uuid": "99f08d06-129c-4070-b72c-43aaca18b8aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412996, "uuid": "a5cf9c95-1fac-4133-a74d-be343b2dd60b", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d076bd0-cd15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764415181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415181, "uuid": "4f05cade-838b-44c7-9527-551994783027", "comment": "Malware payload (Mirai)", "value": "f295c6672c9c4ad218d211280f6c649e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415181, "uuid": "f1f234e2-64e1-492c-bcbb-b754a24c0215", "comment": "Malware payload (Mirai)", "value": "660bcf97d32e44c3770ce604ed0cd77aca0b30062daa318fe06b5d62f29c20a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415181, "uuid": "691445ab-1292-488f-8f85-87a0aa4988bf", "comment": "Malware payload (Mirai)", "value": "5f8c8173ffc3bf35f53b81a8fdf38146e30e8579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415181, "uuid": "c63d2fc4-61d8-48df-ba6c-9d56832d445b", "comment": "Malware payload (Mirai)", "value": "0e1725edb89d49f0190fbe05b3998d2b2e8f1c45ead9811618d090395928a752a2f31e4f38c07bd1ee150d3ba064bf04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415181, "uuid": "9e07009d-a563-421e-8d10-e6a0fe22a474", "value": "T16C04BF8FBB8B2190C44701F4078F8FAE6A9361867EAFD1E7A95D753F04392D74921B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415181, "uuid": "100df247-51fe-4a0e-bd7c-211aab152d45", "value": "3072:83Mb0Zai+l15W34yxjazEsU5sXlPdvgPEZq:8O0ZsM3JSEsNlsEZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764415181, "uuid": "a66b060b-69e5-4a31-8a90-7b1611c592db", "value": 173684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764415181, "uuid": "62c46bb8-4304-4ffd-95fb-4733b4e6c18e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415181, "uuid": "eb7b3ef4-0883-4bba-bd49-d5652f1a2bc9", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de392744-cd6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764454080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454080, "uuid": "13010119-18ff-4727-b831-993cd66a440d", "comment": "Malware payload (Mirai)", "value": "6179f94ffb6e9631e411e2e7682402de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454080, "uuid": "e1d61730-027a-470e-8c69-ec1cf585487f", "comment": "Malware payload (Mirai)", "value": "666a143429ffe0bf74798438fdc3ff859f694892256a88b85f8d86684eb1e67a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454080, "uuid": "a18ccb94-08d2-442e-b52f-c35df502f827", "comment": "Malware payload (Mirai)", "value": "c468f0bad4c65080afaa4422447009ea8db780d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454080, "uuid": "52f702c8-e489-4bbb-9fe7-d40e913e75d5", "comment": "Malware payload (Mirai)", "value": "c54d557a2a7c258504f07354aa2144ed2c8e30f777a93939d02bfd789d2c61e9f1275fa64553e984a5565de318e04376", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454080, "uuid": "b1bf4ecf-f276-453e-8756-1d6eddc4cbed", "value": "T1CC63A64D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454080, "uuid": "b1705dfa-54ed-42c6-bddc-4ef0bad0cffd", "value": "768:RzZWyvL5MsRXxPx2pqV2UJz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UTGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454080, "uuid": "f9c637a0-708c-460c-9f40-5cab7bd90f94", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454080, "uuid": "ffab349b-3930-439b-8e70-ebbb971a1118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454080, "uuid": "3fe777d8-f144-4bc5-8e7b-ce4b61925e76", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d416fae-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764389841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389841, "uuid": "d222fd55-dfcc-4d2b-ac45-b1e181e86952", "comment": "Malware payload (XWorm)", "value": "f28596db638991e95bfd1e7bc0d9f24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389841, "uuid": "e3357d51-dcec-4a73-b3e3-55dfc5753f13", "comment": "Malware payload (XWorm)", "value": "66a023e82dd57f77e899d1a33f564da16b47293bfd1a5c90aea7948604c94128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389841, "uuid": "96b41710-a8a2-49c6-a25c-c15e7c6c2356", "comment": "Malware payload (XWorm)", "value": "451c6b0871ba01f80bc2b550c8ffea4b24518ef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389841, "uuid": "454c8c65-eaca-4cae-8fb6-6750fc34f695", "comment": "Malware payload (XWorm)", "value": "b0d863aa91dd2710761ae27b4a603382aa1984c95603eb0ae64b93fbcca8ed0455c2105dde98cac23d5e4160fa70ccf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389841, "uuid": "b202f5aa-f007-428b-9051-afe65aa65e18", "value": "T1F8947B16F74408FDD897C578CA964546EA397C8E0B71EAEF1798422A2F237F04E39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389841, "uuid": "a5a99865-4bfa-459e-9713-f77c2886c5f0", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389841, "uuid": "8bf7eb06-7dca-4000-aa29-dc2b2bd31f18", "value": "6144:G+GYnA0zeWiDi5eJwQ8kV3f+RysMFZzN/8tE8sNrwr:qYkDi5eiQ7uysMFZzN/qm1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389841, "uuid": "2031b03f-e3bc-4e4b-b61e-2d6899b3bd03", "value": 416140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389841, "uuid": "c54b99a4-a02e-4ccb-8f3e-3d0ba3c9df36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389841, "uuid": "682bdc8e-0788-4ab4-a169-3118a386c989", "value": "4jaj6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b0c009-cd1b-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764417716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417716, "uuid": "aad75c0b-90b8-46df-8256-997c1a1afbd7", "comment": "Malware payload (Stealc)", "value": "2a972793c835fa9e0ad1e91bd4179859", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417716, "uuid": "73160217-c160-444a-8a29-29d136695251", "comment": "Malware payload (Stealc)", "value": "66dc5a0ebbdff58ebddea4c9728a6122b74596e8691fd70034eba508579efcc6", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417716, "uuid": "760da657-47e1-4f68-9b2d-5b83e4f1f8f7", "comment": "Malware payload (Stealc)", "value": "b08c73d69c7e9bfe372dc34002d984fcae372a94", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417716, "uuid": "c36e9a5f-951b-4239-98f7-4de2694e0252", "comment": "Malware payload (Stealc)", "value": "a0785698fa5ae0e4e6ff56381da85898a058dadd43870fca96d6930c790663786f5af5161456bbe28a92995506e5b5bc", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417716, "uuid": "ef56a659-64a8-427f-af34-aee2f88d3bf1", "value": "T15005239B35F630E9D6A689B4CD414AE5EB3AF4705250D75F0BE406AA5F230D28E3EF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417716, "uuid": "ef69151b-1ede-42d8-b6aa-5d45127ab3e8", "value": "f35919722d8dcde279077a8460e70b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417716, "uuid": "583582ae-b7c8-4166-8082-3a6d88c825f5", "value": "12288:QX04BbAqNSNNUVPhaUHl+X0Q5nMrBp6zs1CMTVXEXKEcE0Rpqg5aHTTIe:QEFwcNUVMUHlrlCEEVc7LqzIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764417716, "uuid": "e4ebaf24-1bce-48f5-93dd-9b8487a374a2", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764417716, "uuid": "b5f16af7-66b9-46ac-9940-5f0d4bfa54db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417716, "uuid": "44b29891-3634-46c5-8796-0d106ddc6411", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece16e92-cce7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764395693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395693, "uuid": "e6d17926-7971-4e56-9702-10fb2bbb4bc7", "comment": "Malware payload (Mirai)", "value": "736cf14a036b621cf4591e5d003bb050", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395693, "uuid": "d41431c8-2810-4cc3-aa74-418e46c2c33b", "comment": "Malware payload (Mirai)", "value": "686b6e8953359d4bd4e8bab660840312ca8903c430b3eb50bf08ab4cdbdc424c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395693, "uuid": "3204b244-06c1-4d3a-8ea8-2bd0eb4f7341", "comment": "Malware payload (Mirai)", "value": "8b95e08842b34d20025ac768fdf832afa04e9ac7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395693, "uuid": "0f101ba2-e5a9-42c3-a380-4b036c245408", "comment": "Malware payload (Mirai)", "value": "4a8cfe568a428b8d78c5dd7db84f3cc1b97297cfc9f7cf1a018e1f7351d24b907b2fbfb3591063670adaba12c570539c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395693, "uuid": "d3f2ea7e-ec18-457a-abb7-ef9043584d9e", "value": "T18513F1CF84E4C7E4D26C2A3DA97EFF0704A0D68564682A51FFD8F28E7C73A580949186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395693, "uuid": "c078572a-f412-4470-9a23-6b439b09cbd2", "value": "768:gIW/1Cmvo0o2pwGZn/k7uiwG67hqjErT7rUMpJqNXxBSckwLcIHjAnbcuyD7UoQz:gP//ztn/9iwGNKLW3YckwIkjAnouy8om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764395693, "uuid": "ea3c5609-2156-4704-9053-780b3795015f", "value": 45192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764395693, "uuid": "13230473-24cf-4774-9d30-fd5be11aa432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395693, "uuid": "f37f0a90-7346-44f3-a04b-a447dbfdb2c8", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14fb18c-cd79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764458380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458380, "uuid": "fa55e50b-89a9-435e-a536-0425033db191", "comment": "Malware payload (Mirai)", "value": "849cf53db05a2b9c190a311d90a90b6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458380, "uuid": "e7252ed3-c3ca-4619-8f4b-3fa674f9e201", "comment": "Malware payload (Mirai)", "value": "688bad2d3f999fb11426904877ed2403ec26559eec5ef613df155fbf1c42c8f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458380, "uuid": "711e7105-3270-41ff-949d-24282bce9ecd", "comment": "Malware payload (Mirai)", "value": "a9aabaaaa6212dd2a615c3ef1a813b53dca19d99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458380, "uuid": "a6593da0-4487-45eb-a205-28951e92aa03", "comment": "Malware payload (Mirai)", "value": "85e93c0e27b4b36135fb79e16122d4df7b8d9c54f05bb2d5f7671106259f4a1ca4d5b5ba9718afece6977041fbba7d65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458380, "uuid": "033e4303-1f66-40c0-9baa-d1c3768a5fdc", "value": "T1B2539E63C4641DA4C1544AB0B9288FB61763E60087637FF5426ACBA99057EFCF60A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458380, "uuid": "e2599a8d-1ff1-4146-943f-bb9d2bcbbffc", "value": "1536:oagv1AOp/umClcqseKyYGsYh44SijKmR7GrxhCKkdV8:ox11KmqsxI4viGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764458380, "uuid": "86e18350-a3de-4291-8eaf-aebdb57b6eab", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764458380, "uuid": "f06e6b55-a7ff-4b3a-b52d-093165b0344e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458380, "uuid": "8c9e553f-ed55-4ca8-b303-2904f6c2ccdb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1faacad4-cd0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764412099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412099, "uuid": "8f408234-1357-4700-8c16-1f3e1fcfdad4", "comment": "Malware payload (Mirai)", "value": "90b3edede4d0a7a8060dd90ab1b23e05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412099, "uuid": "ab600aee-ee0a-416b-a3da-177a5bb7c01d", "comment": "Malware payload (Mirai)", "value": "6891cdcc2432907dc3ea0b942cab344eac2bcc223238a79d0a633fc0052b591c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412099, "uuid": "d8df246f-6bfd-46a9-9c70-8f5f749d9907", "comment": "Malware payload (Mirai)", "value": "e874dd1cb9b4fbb4843e4faebf31084d6bee351c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412099, "uuid": "24db9962-ace0-4f8e-82dd-a55105b42c5e", "comment": "Malware payload (Mirai)", "value": "a811afef77d3636ab6505e68d8da208d8b42a0ad9d39c9409977967c3428d118ea18efa8badecf568a967035733fb3a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412099, "uuid": "9015aae4-c02c-498d-a774-f00dc2327ddc", "value": "T180F33B99F8828A16C5C702BAB92D514E331207B8D3DF7213AE105F65B7CB91B0F7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412099, "uuid": "c6406ac9-b214-4050-ae04-9ae1a36dccf8", "value": "3072:Vb5y9y7oZOLageGbc373F6Xy2TmLImaV4+YgtUhfONZjZwxgnt:VNyg7oYagex56XfT0XaJZUlcZZwxgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412099, "uuid": "d025a3ba-e09e-4b94-a05e-f43b52e935dd", "value": 161436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412099, "uuid": "5a90a830-6857-4215-ac77-e542050cd15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412099, "uuid": "8c8e0969-908f-4882-a071-43eaefa9d6cb", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0e9aea-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389222, "uuid": "077fd3fa-e4d0-463a-a913-7f7fe206ea27", "comment": "Malware payload (Mirai)", "value": "c10bac70d8e98cda65333660d9b665d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389222, "uuid": "58811f65-7583-4a2f-b39d-b0c557665c02", "comment": "Malware payload (Mirai)", "value": "68acc1f102f29520c1c3445d8bda3f4824c2ed0b88769a76a7a508bac5458b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389222, "uuid": "b2f391de-835a-4834-881f-fb539f08114a", "comment": "Malware payload (Mirai)", "value": "897b1b8f57ad4b6b6f0069e021d9e39ae779b5c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389222, "uuid": "086872a6-22eb-4109-8b29-bcfb3789b958", "comment": "Malware payload (Mirai)", "value": "5d38867ad3d02eb9e967866aa98f048de5c1f3cf70f69dbe1d58a81d1c7c16c796e7e17e957ba9b9e46c9483bf78a805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389222, "uuid": "ca396415-67af-47cb-ac8d-4fd355aa96ce", "value": "T1F1834A02734C0D47D1A75EF42A3F27E593AFE99121E4FA89650FDB4681B2E33154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389222, "uuid": "117e82e0-5fd3-4655-a7fd-5f88c300a304", "value": "1536:0qiwvHp+OV2KQusg3O98+wu9qKbGE+KdCz:XiwvkOgs09KuW/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389222, "uuid": "926796e3-346c-43cf-b38f-f391327f8ff5", "value": 83528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389222, "uuid": "141a7675-7138-4d4f-9fbe-b99e47fa03a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389222, "uuid": "384a6c12-6cd2-45b1-a4bb-8d7d66717e72", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efb93c2-cd0a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410541, "uuid": "8304e307-a28b-4eb0-987a-76b271f67e0c", "comment": "Malware payload (Mirai)", "value": "43c8f3958bd99c4052bc0f81ff145241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410541, "uuid": "537048de-055d-4f40-b036-de547a6c9b27", "comment": "Malware payload (Mirai)", "value": "699c8f11c521f5847eddba7decee1cc532746577d3b2baea9e161f09c8addff5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410541, "uuid": "80e1cbad-bc26-461a-b6d1-63b3a4341d08", "comment": "Malware payload (Mirai)", "value": "eb10e6ed902ef118a065678eb9d102fcb451b403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410541, "uuid": "d1e951f2-1a98-4962-aef6-e42dfbb3e4df", "comment": "Malware payload (Mirai)", "value": "04ce6933810441d987bca11578d2409826000324deceba37aa57bd382679a773f0276d50a16c6963dbe8e3a7c38f78a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410541, "uuid": "bcdea2e0-a724-4611-bd8a-29c1b2bbe8c1", "value": "T12443F27AF31147C6DE43A3B886C60B608EC056F7A460F552EE1EDE578EC312D30976A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410541, "uuid": "aea38eca-89de-49b8-ab30-7d9da8bf7de2", "value": "1536:41XcjXAdQGHqNGfA6nKYMe0fDrFcMWhVJuI:ccbAdhaGfA6nKYv0iNhVQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410541, "uuid": "f0225578-489a-455d-9a5b-6a538605e5ff", "value": 59772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410541, "uuid": "00437106-d910-4f4c-8e27-24772e3bc3fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410541, "uuid": "7fad5ef6-6105-4e47-a22e-7129f5cb2e53", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083d21a3-cd0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764412059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412059, "uuid": "911fc384-647d-46e8-b3a7-be544abe66da", "comment": "Malware payload (Mirai)", "value": "cefc0f1ba415cfa6573b1917db3aeda3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412059, "uuid": "046f6a49-1531-4b99-8334-a1dbdb70729f", "comment": "Malware payload (Mirai)", "value": "69d6684cbcc84a3541bcb31d5e07c90e32fcfcace58a2bb536fe0973ebc44a23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412059, "uuid": "4976416e-0f13-4ef3-8b32-42595cc4ba79", "comment": "Malware payload (Mirai)", "value": "8ab4d26250fdefa1769a1187d18224dfa8ddf59a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412059, "uuid": "1afe77b8-9ddd-4282-847b-303ea1f2ba8f", "comment": "Malware payload (Mirai)", "value": "1cd46f73039e465007388001361778dc86cdd78f1549e5a38cdc9c3e4d9d9251648e10946e45d9ed0fa5f6bc67d1c769", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412059, "uuid": "3c3f5440-e581-4738-9c36-4602cc56b3cb", "value": "T1809312BB599E78F38EE86DF14D9D1E637DC01E98AC9F2132087880D4314DC5581E6E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412059, "uuid": "06e1cf5c-369e-4ddf-873a-db29619d04cd", "value": "1536:nkRMSPagOzPb2FPeD9c2dPUujl1m5UZKTLD3fqaFsTjJv+jkLQ1h+iV61Et1ZGd4:kC+OzPyFWD9zcujltKTLMXqkL48Qt1ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412059, "uuid": "5ff92959-4226-4364-8897-ec1d0ecf0e34", "value": 90992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412059, "uuid": "8ad13bbf-bd52-4bfb-afba-2d0f7dcf3617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412059, "uuid": "8b6b2f8e-de3b-41ec-911c-06a0ac04047e", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3695a58d-cd7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764460241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460241, "uuid": "ccb370f6-bd02-40e0-b872-7d27e021804c", "comment": "Malware payload", "value": "e34c37d664401ea565b9a76dcd3b49b2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460241, "uuid": "93f62f99-6a24-4709-8fee-72ef3ef12431", "comment": "Malware payload", "value": "69dff36c072eb0df851e1c12009fc0bb8b5334e597d684e42abf8385be59c32e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460241, "uuid": "34fd0e57-f8cd-41b7-bace-a7d2bed3aff2", "comment": "Malware payload", "value": "bd7a5793f04ca299468d6283acae94b92b0592a5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460241, "uuid": "1b923bb9-ad5e-48c4-bf9d-ce62751bfaab", "comment": "Malware payload", "value": "c29664350188982b32f088f55c5e7dc09b2bc655a07638d9bd6f88df23bc4fc0a515d83449f006519aa8fa371040c1b2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460241, "uuid": "3b05575a-1b0f-48a4-bf1b-fe0d46cbf23e", "value": "T1AA73548D59EF84FC96277C588ADF5D05F3EDC6031A2CD6E9BA8DA5902F4243892F48D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460241, "uuid": "05efb99b-e79e-4ec6-9673-168f5ee98ad8", "value": "768:yBrokygY3j3kXR4ex5J3rsfxt/eLnHusE8GEg6lC6JiARMVsCnH6WH7ePKcoPWO0:hfeaJOrE8vcOoPWOTY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764460241, "uuid": "2cd0d06f-c968-422a-af26-f023ce11c691", "value": 77457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764460241, "uuid": "d81d21b6-7dfa-4b01-b371-165e0e6f8089", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460241, "uuid": "fe7b6328-513d-4a64-9d79-bc1d879ec611", "value": "update1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f5376d-cd7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764460419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460419, "uuid": "ce8fa7a7-6335-4552-b359-f54753d1d57e", "comment": "Malware payload (Mirai)", "value": "180316338549972c7d875917d49bb8c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460419, "uuid": "3ec8c3d3-1886-415a-a25a-960d807aecf3", "comment": "Malware payload (Mirai)", "value": "6a8aaa30ceed81e1c2a8f80a6b7d909837bd500ac5a4cd0b42e15e38de50ffab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460419, "uuid": "dac81471-6eb6-4ea2-bc4b-b16e756489ca", "comment": "Malware payload (Mirai)", "value": "97e33b6e3477a17ade29dbd7967fadb9afc0eec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460419, "uuid": "422ac787-93dc-4b33-8f47-c7d563b4cbdf", "comment": "Malware payload (Mirai)", "value": "5583d9e12a04adf329ddfb149d82adf8f81417a2def07bf86db5fcf4079cee8c20532ec1ee22675aa8deeb3358b7898a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460419, "uuid": "77c3ad0f-b903-4715-9ab1-c6cfaa145131", "value": "T148A3BE32D82A5D98C18501B8A4E6DE365B23E5C413932EF717E6C7B69047EA4F40AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460419, "uuid": "1a7946d0-cd3c-453d-a539-ee653b7699ec", "value": "1536:H/k9A0n3bQK05LKGVwSkTACIKTFd07DIQmfICwweyzXcY:H89AkrqLK/TXvTAIQmfIw7zcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764460419, "uuid": "8853709a-e5bb-4415-aaaf-1a483669a175", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764460419, "uuid": "00f5de6e-4eb7-4d7c-bdce-5efe2290f176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460419, "uuid": "046f4df3-86e5-49f1-b988-1c0e62e4c5d9", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f30672-ccfa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764403821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764403821, "uuid": "886e6010-515e-4f63-a8bc-37b531f3245f", "comment": "Malware payload (Mirai)", "value": "e59ec91244bcf11e8a94010fcb98e702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764403821, "uuid": "d69f2d55-42ca-4ff8-a9b6-f4cd3597f9f5", "comment": "Malware payload (Mirai)", "value": "6ab188b71671a97ae5af6c3d018ba6bf0a576063e523cc2ced2e99ccb63b288c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764403821, "uuid": "d0ce5204-28e9-4429-b8e4-73e952611e5b", "comment": "Malware payload (Mirai)", "value": "4d87cbb18e41226f5624f3f33589281f177821ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764403821, "uuid": "3ff34c82-40c4-427e-861f-bdb130fbdd2e", "comment": "Malware payload (Mirai)", "value": "c5a89502311f828a7c7747aff1dd5640b485baada564d064557f27b89efb1fdbd7156452ae3e956c9622f931bb49f1c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764403821, "uuid": "7f408207-7ea4-42c2-a5af-58b7b79e2e87", "value": "T12CC3197BEC819611C5C31ABAFE6D909D33235768D3DF32164E2C5F2427CA52B0E7A909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764403821, "uuid": "f3ce32f9-6d8e-4f79-b662-f99093b38e7f", "value": "3072:ARH7GZkzCuhOaXDdp4+/4xkUXtHEYxiaGhymZ/4xs7mZ:ARH7GZMC+Nhpl/0dXtkEiaL84xom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764403821, "uuid": "b48e1a8b-981e-487b-8cdb-a9174381865f", "value": 127660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764403821, "uuid": "d1e2152a-a1c8-4889-8add-389b328ad148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764403821, "uuid": "dd08f754-829f-40e7-bf8c-c0274feb2a19", "value": "rondo.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda5e01d-cd74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764456253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456253, "uuid": "b4e179f5-2ea4-401f-8d4a-95065b4ead01", "comment": "Malware payload (Mirai)", "value": "524eec1fd096ef350eab9d04f857aaca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456253, "uuid": "8fbf14a7-480c-46f3-8230-9f64f85e53a1", "comment": "Malware payload (Mirai)", "value": "6c4c4f2ebab9761df4b9c18ea9c7c0e96847b6ad5e7fdc07e127deed19b8f0a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456253, "uuid": "8016b7fe-6dea-4c24-b4ce-3a29dac7f9ff", "comment": "Malware payload (Mirai)", "value": "3a45a6c5e6a6159110a765aacb5cdef326f75d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456253, "uuid": "d8164828-875f-4067-9c8e-b468c5612150", "comment": "Malware payload (Mirai)", "value": "c1b37d16cceff2295ec936e4dcc6e2d6cf20dd8f3013ab23bfa4e1f1d230f52cb52db18f918f2e59b5c74744af4308b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456253, "uuid": "93996cf5-b15c-434b-a5e9-d841274d3a47", "value": "T153B35AD9F643D0FAEC1605303176FB376D76D9BA2328DA83D3A89E726C22641D406B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456253, "uuid": "32be83a6-a078-4be7-a66e-19de64c5795d", "value": "3072:dkMrG5e2xKKULDnlZkhLtByEkpLbL7CUBT:dkMrGk2sMjyDdCUBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764456253, "uuid": "2b359b75-3279-4ece-97d4-ea52d3c6a85c", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764456253, "uuid": "2fe2beb8-c6ea-4dd9-8a31-3adfbd2896ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456253, "uuid": "14293b36-4f88-4dfb-a03c-e5532cbc9597", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc79ebc-cd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764443045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443045, "uuid": "122f979b-9abb-4cfb-9e65-cf7464bb0ec1", "comment": "Malware payload (Gafgyt)", "value": "67908cc568b99371ae8c80b7e9da2faf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443045, "uuid": "90106b0a-1262-44b8-8780-9b6da824bf60", "comment": "Malware payload (Gafgyt)", "value": "6cd07b180c64d7090e20c9d3098bf1ae25e563f03d0da5157674be7c843be2ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443045, "uuid": "855a5093-cb16-4d11-8d1f-b6e8817c5f7e", "comment": "Malware payload (Gafgyt)", "value": "9d8d1889112aec2ae426cbf79d9d083d52607565", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764443045, "uuid": "b9e7b060-ba34-4f42-b2a1-5f52f70144ac", "comment": "Malware payload (Gafgyt)", "value": "8964ae0fb69fc21bc941afd74cc553a2b13d63fc7628891ce44d903e0f705ea5be20ba1da55a27212d95b00a620553aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443045, "uuid": "196c2949-d186-4c0b-9fdf-1dd5c048f0d3", "value": "T1A0C32905E450875BC2D2237AEB9E465D37336BA893DB33115A34BBB42FC27D91E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443045, "uuid": "786c999c-9a43-463e-8a74-528ea9137ba1", "value": "3072:5a5QDpDeRWa25UOhR1DLRUL4+mwQYY5QXhga:o5QDYWacT1DI4+mwQYY5Ghga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764443045, "uuid": "c529edb3-e451-4182-9711-ca1dd3ea988a", "value": 123743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764443045, "uuid": "0c7a9958-b2bc-40f3-b014-d4acdac91fe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764443045, "uuid": "5fc5c088-75de-428d-a63b-84e1df012081", "value": "Fantazy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2511846f-ccdb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764390204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390204, "uuid": "d6358fc3-5645-4283-87be-a31cbac7c1a3", "comment": "Malware payload", "value": "9e13ba4edd44ea42ff120dd519448a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390204, "uuid": "7b45e015-64f1-4862-b3c4-516f4020a69f", "comment": "Malware payload", "value": "6cd6c228ebaf04b692dd3fe0f009203fd87ff0507bd44eb50c4a35dda9f8fa70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390204, "uuid": "c89cb007-b4e4-4bbf-897f-e87dc1d37f8e", "comment": "Malware payload", "value": "b1b58dd6b04b3b602043c50325c3848f319710f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390204, "uuid": "6ea22dd2-84ec-4a83-83a7-d1a7e8c73906", "comment": "Malware payload", "value": "8b0f41f1dabd346c0742bdd71520a976aaf35d1c92b59998af5e79c2ab52a63a0633bf45bf31b27a0459bf7ddbee4d33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390204, "uuid": "b5fc487d-5ad6-4df3-bfb4-c8e4652d545e", "value": "T1D463835E2E328FEDF66D863447B74E21A79923C626E1C784D2ACD1101F7034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390204, "uuid": "3c43c821-fef0-4ff1-8e6e-c8cfe4d73cd9", "value": "768:8kzn8wp85NyA7wxhGB1ksBh3vPmqLQqL4aK7L8zKF6ZcVMjpmXTz3+5RyOSIe1KR:8kwwIRksH3r9/LKggXcJe1Kd1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764390204, "uuid": "76263d04-bb63-44df-9642-ec58d5cbb751", "value": 72680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764390204, "uuid": "8b1451c8-33a6-4168-a409-9e383a2dd820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390204, "uuid": "4fcba9ac-57af-4a22-89d0-4c9194f19a2e", "value": "SecuriteInfo.com.Linux.Siggen.9999.12939.22251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7f258c-cce7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764395694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395694, "uuid": "e6726b1b-f35b-418b-9c00-c51ecfa7744c", "comment": "Malware payload (Mirai)", "value": "e4f85fb937497fb1048978a945025d37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395694, "uuid": "e94b2f0e-a7cb-4456-b4fc-155a9013bd90", "comment": "Malware payload (Mirai)", "value": "6d55e1fc57013e7d42bc45cc316d71470c6fcc9495269239dd833580eba9b3e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395694, "uuid": "5f0867a0-dad5-482f-8c78-474243c46ae9", "comment": "Malware payload (Mirai)", "value": "ea31fbb7523e74385f729987248d7716a434ba1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395694, "uuid": "a1e43b89-246f-4c61-9836-554d9175c637", "comment": "Malware payload (Mirai)", "value": "045d93e8468516b08252302d9ca0aa3d2db6f28aa67920ac5ab07242cb39615033e7420044a2ae18ed7fe87e51e0a8a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395694, "uuid": "0a25c690-46f4-42b1-9f12-16c5028ca094", "value": "T159B2C07626B6B8B1E4B0C47FC91DC24BB60076B5F9EA31B236840EAA9DCA10510BD5D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395694, "uuid": "45d06c64-7822-446d-9aa1-23041352642b", "value": "768:gBt0y06zkOVctkoZRuZABqqQlftBOH2b2Ps3UozN:g30SDorLBqRFBOHIrzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764395694, "uuid": "f3ad7340-96c9-4f55-9b1a-f1b76b579056", "value": 25288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764395694, "uuid": "87a76371-9a43-4620-9f81-f5c398013b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395694, "uuid": "5272f3a4-0657-4b78-8fd3-47d52728755d", "value": "niggah.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133980c6-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764412937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412937, "uuid": "92dd6bc2-489b-418d-a1aa-0d54f6ab0c0e", "comment": "Malware payload (RedLineStealer)", "value": "04ecfca04e08c021122a547d361f881b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412937, "uuid": "5bb53873-d7da-4303-960a-719d30d2448e", "comment": "Malware payload (RedLineStealer)", "value": "6d74da5cca3800265aadd42320906e16ae4951309614c3463999dd54f6bff878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412937, "uuid": "81956f78-6006-4692-b8ca-654087021682", "comment": "Malware payload (RedLineStealer)", "value": "2d384664a6f9b92163a54737ba2faf369b815d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412937, "uuid": "2abf4d96-32b9-4d66-9cf0-97afde270d48", "comment": "Malware payload (RedLineStealer)", "value": "a378caa47fdeeaf29c6326011e51b3cf562c85a5b1031f53b90396c169b0e2782548754e9eff4ffb610be49e550e951f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412937, "uuid": "a40af297-1199-4a26-9fc2-43d2405cfc1d", "value": "T1215733A00EE69AC5C3B0DF3295DA8F36302279B60285E417B8901F1EDED96BF2771564", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412937, "uuid": "9c2f82f2-d399-4c71-a60a-7fce3a547fdb", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412937, "uuid": "8449b5b5-27d9-4af1-ae6f-4e72658b4bfa", "value": "786432:cBJIpONQzuhOo+QPUg4Qm++NPXmkB5eIJ:8sONQKhOo+4Ug4QgNJ/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412937, "uuid": "9c7f8444-6f63-448c-a14f-f95425e64013", "value": 28092416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412937, "uuid": "b6040711-8583-45d8-892b-7c503f26d962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412937, "uuid": "1c159cde-ea18-4acd-a8d8-26cef2805964", "value": "NaLockNew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53aba6b9-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764392000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392000, "uuid": "ebe53206-42ab-4966-ac3d-b62e91b4cdb5", "comment": "Malware payload (Vidar)", "value": "3e358326eb1719a0a536864b7bbd3bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392000, "uuid": "1c77fc99-5425-4602-8708-2cc204e0b1dd", "comment": "Malware payload (Vidar)", "value": "71f1e84254e01f509823a1ee5aba7285b9122010f2fbc65f7a030d582ef9383c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392000, "uuid": "321dfbb0-78c7-4c72-892a-8321decbe2ed", "comment": "Malware payload (Vidar)", "value": "9d8034f3350f36b5d58bbbe94811299ef5f73cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392000, "uuid": "12bda747-d863-4ce3-8c92-918214387775", "comment": "Malware payload (Vidar)", "value": "bdb165d33d13de9bb64f7191984bf99437b29ca18c023a2dc245e2ffd5a78e22f742abd3035e6d980cc38e1360a714de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392000, "uuid": "e46710f0-0a18-43b7-8363-710a172d64d6", "value": "T1AB5507B96551D255FE3880B940F6865EB220713286712BFB0160D263EF1B6F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392000, "uuid": "f57717af-f3c9-4620-9f21-b3a3e264a29d", "value": "5e3631c569a217cf469245edaaa125d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392000, "uuid": "1cd89e7d-2186-47c9-b4d9-d067211ea0a7", "value": "24576:PdiCGvBxNvYYh3TBv29aajsGNwans6JuYdGo/migY3FY0Bmdy3SEII4kPKCw48vm:PQAe3TBvnSaYdx3LQyFC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392000, "uuid": "4417f728-4439-4b71-9be3-fad3fac6dc4a", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392000, "uuid": "b67c05ab-55eb-4a86-a7ea-b82d84e8b605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392000, "uuid": "b3c6b799-05da-40fd-b070-382d9b6ac5c0", "value": "p2ecnjt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65e3aa3-cce5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764394823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394823, "uuid": "0edfbb02-b93d-4842-bb5d-0d0459c04736", "comment": "Malware payload (Mirai)", "value": "82a7302934a477007f4eced992e9c665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394823, "uuid": "a19501c4-eec8-4c3c-b0e0-afd4d40d61da", "comment": "Malware payload (Mirai)", "value": "74f28772568490bbdb90de8d8faccd61be266af691d07c944e75b97c42819599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394823, "uuid": "d971f3c7-15f4-454e-861a-7b9a2726de8c", "comment": "Malware payload (Mirai)", "value": "061e417b4f57d5c051c4aaacbf3ab180af9b7c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394823, "uuid": "6b0be2f7-7ddd-4892-9bb4-0571a23eed1b", "comment": "Malware payload (Mirai)", "value": "78b317438564ed4052cb267db40af0ffba13306139ce046fe774993797c61d98f821543b3cf4e99aed90917b49021669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394823, "uuid": "c8f713d4-17d6-45c9-9f68-f2678e4fc96f", "value": "T19C837CC5A743C4F4FE6212746137B7368A72E6391129DB4BCBB4F835DC1A602A61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394823, "uuid": "4af2762b-77ee-422e-9526-c23e180e97ce", "value": "1536:troMfBaKB52kaChK1Ik/cRluC0WvSmnnmLktOPehZZ:DfB3Aka0K1IrR4N+1noehZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764394823, "uuid": "06f72b57-f060-4ead-8895-cae64d8dbe9b", "value": 87028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764394823, "uuid": "68a32231-f6e0-4435-8e27-7c9995f8d47c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394823, "uuid": "fc1e8cd6-56f3-4c10-9773-7b3583f60fc8", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb70048-cd78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764457780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457780, "uuid": "c6227ae3-44ec-4494-817a-c50e1a797ad3", "comment": "Malware payload (Mirai)", "value": "d3e69462da55551dcedd0180203f85a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457780, "uuid": "2f10b606-c9c7-4e20-a613-cad3513230e0", "comment": "Malware payload (Mirai)", "value": "75252bebb088d85e180a2a9aa722f77f9ac0f2799b6280d6962e48643880e501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457780, "uuid": "4750748e-893c-4259-8f53-2e5fbae8b689", "comment": "Malware payload (Mirai)", "value": "d9851def84ac71095c75f890005d0884c02503bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457780, "uuid": "525f05d3-119f-43ce-9553-2b94e59ee577", "comment": "Malware payload (Mirai)", "value": "b109dd49dafc224766928f96062f492970491c5e5252fb3dfb5f003a7deb996fefbe1726929f3e0c877de908a640c781", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457780, "uuid": "a1171da6-453c-4615-9631-86dc1489cc52", "value": "T10F33F1215B02F19ACDA34874E6A65F4BF62F53381A71302321D8495087E7F6BAB5EC47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457780, "uuid": "119d8cdc-c045-435e-99fd-8b2bf9a1b601", "value": "768:UElkC4ZtwTYsy+qsyEpIABkjhI2Z6r6aj1zBf9XtmkZZ1njkwFHEF7kfkMycchKV:hOC4nobqsyEpIpFj8RxZmuk9w8CWK6Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764457780, "uuid": "3136a632-e979-4f6c-8cea-d4eb1d96dabb", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764457780, "uuid": "006b1206-354e-4bab-bddb-8a01697554f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457780, "uuid": "a0b7c497-ea47-4f29-a483-6f80f6074a3f", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21bd569-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389152, "uuid": "c4a56ee9-3ecc-440a-8d69-3354bba8aefb", "comment": "Malware payload (Mirai)", "value": "6bdac919e879b75471d5a9da38138b67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389152, "uuid": "1c475c80-0541-48cb-9b27-4840df32d147", "comment": "Malware payload (Mirai)", "value": "759a5a9b47a96e17a62ead6c750a997a2d11e02b8582084f3287240a35e8761c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389152, "uuid": "6d93f698-597b-409f-9cdd-eeeb0e74bd6f", "comment": "Malware payload (Mirai)", "value": "e76d442925270f27b77cb2e1fe65da0a727d83dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389152, "uuid": "042e494d-3563-4a2a-a81d-d7e04db4b01a", "comment": "Malware payload (Mirai)", "value": "14970b04f1a98e3eaf6c98acd1d44d44354f25b69aa253ba6a29273e05d6ce6a1b66eab08315a3d542bb14b55b36ae97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389152, "uuid": "f6286126-f87f-4fe7-8544-ae158386b0bd", "value": "T1E9B2E0A4ABE468E1E174957AA795C3D466F7CFBAD0733261A1E0862DB8C740F07B8407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389152, "uuid": "ef1af2a9-bde2-4910-ac2c-e98ece79a0b4", "value": "384:6/QKh5l+d7bXu6IApaoRgp0ulYDLS20ToGGEjAa0IGHjacHhymdGUop5hA:xdleApa/p/SDLijGE03zZHs3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389152, "uuid": "7579670b-ccaa-4722-9642-45143403ccc3", "value": 23536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389152, "uuid": "e5615784-69c6-40b8-8e3f-c98f876c06a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389152, "uuid": "416fb310-3727-466e-baeb-dcbbdad90a06", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d53260-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409779, "uuid": "8976684f-5be1-47c2-be96-eb59ae1baea6", "comment": "Malware payload (Mirai)", "value": "fcaf292499067428a11217cb94ffca8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409779, "uuid": "53c68a28-dc17-4696-9a75-f7f5eb7461da", "comment": "Malware payload (Mirai)", "value": "759aac14167c4deb2eda88bb357c6a716b5f1a53c4210c70856baae2043fa6c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409779, "uuid": "2bd45a52-64b7-4855-82ec-1924ac431ae8", "comment": "Malware payload (Mirai)", "value": "be35f41fd72d392e62c77315b55edf2f5e4b3931", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409779, "uuid": "3a79d2ed-37f2-489b-a6fc-1611bb2f1fbc", "comment": "Malware payload (Mirai)", "value": "6ddf0e55f49a20d0e20a6494ae52fabfa7abf8adbae73f6c8c6b948bd37076647a98ce5f6bd2e801309b6b136353d9cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409779, "uuid": "ac1142bb-7d4c-4cfd-a79a-7d9b735911f1", "value": "T17203D71F2F299FBCF794CA38C6B78E21825437531791C845E0ACEF411D50389A89FBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409779, "uuid": "541b21ad-b15c-4cbc-8cd1-d7b8dfe15b40", "value": "768:3t4ZwT0vhkn+b2VXGin/nbnvpq0H6BeDSsvShpcfOzK1E:3t4qGgjGif7RrH6BlhpcWzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409779, "uuid": "21ec1724-bfbc-4266-a885-31cc340c8488", "value": 40248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409779, "uuid": "b7b85889-af35-4d0a-83d3-0d1d44e1ab6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409779, "uuid": "e5afd083-ea22-4657-8e75-7bd4b6e5d6aa", "value": "yakuza.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dad0768-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764413008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413008, "uuid": "50efaa1a-2fbb-40e9-ad55-f1e39cbde051", "comment": "Malware payload", "value": "154024f909b359f43d54bd71a5787f49", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413008, "uuid": "075db32c-9a30-4b7e-bf6b-fb8110ced17b", "comment": "Malware payload", "value": "76432818ec113b80ccf3fcca13d5a52a09c5099ee55f1346fa8f3a113180143b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413008, "uuid": "e5ecfc71-588e-40f6-a5d4-e4cd6e19f1c3", "comment": "Malware payload", "value": "8f86449c6da00d694d24033d143193ac44857cdb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413008, "uuid": "61a0c527-f5a8-4367-80ee-3273cf937232", "comment": "Malware payload", "value": "a1bef22be63852ba3f461cd729feef2d499d1313816d88b77dc2e14786108a33a12424d29b3a6044f54cf5766547841b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413008, "uuid": "1c63a06d-5b5a-4905-8de7-1dfe3617a8e3", "value": "T19E37335E6DDF463A90FC83A8D144A7E4C309E49986E34D9A73CD79E21FDB828402E47D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413008, "uuid": "ba338dc1-f749-4c2a-a2a5-4b3e9609fea5", "value": "393216:Wqpf7eLBgFhMWtfjfDBq7uMvCGFdrCD0CFYRPR+1cloDxFZqqX4KCN8kK+ZqcoEk:WzB0PFjfDIvCidrCg7RPfoTV498kKvEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764413008, "uuid": "cd56045e-3e42-4102-b433-f2179533ec1c", "value": 22757430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764413008, "uuid": "614f2202-88f1-4c9d-866e-1474af14261c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413008, "uuid": "165b7cbf-0182-4005-99fa-7c1a8b04c177", "value": "\u5144\u5f1f\u4f20\u5947\u3010\u590d\u53e4\u3011.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dc797a-cd48-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764437347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764437347, "uuid": "8b4749fe-7a14-45e9-b843-f05da3e4ce3f", "comment": "Malware payload", "value": "ded8e860f0460a1d9a826f75c40aab79", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764437347, "uuid": "8d83d251-3571-4afb-af0d-0de192a9e6c1", "comment": "Malware payload", "value": "76443bb9810febf5893a36b34d069572db6a409832aa6d39c4b3e47acb34ada0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764437347, "uuid": "4a3076de-1cdb-4c1f-bfb6-c82cf92cd38a", "comment": "Malware payload", "value": "8aee396f88bb33ce6a42364328b9c3c7816047f0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764437347, "uuid": "06abc8d0-4ad5-4b6c-a2d6-6240fc7acc56", "comment": "Malware payload", "value": "0370062683eba175e734c0d2f42c34dbc438a091bc97642321c2e91a8e4de897ad7681bcb61d138abae50aa606c8672e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764437347, "uuid": "89c41dee-1814-455e-8871-de41716cf27c", "value": "T16C5507B96551D255FE3880B940F6865EB220713286712BFB0160D263EF1B6F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764437347, "uuid": "33925a38-589a-4c6a-889c-d07dea943268", "value": "5e3631c569a217cf469245edaaa125d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764437347, "uuid": "677f27e5-04ab-4917-b901-a6affd08001b", "value": "24576:LdiCGvBxNvYYh3TBv29aajsGNwans6JuYdGo/migY3FY0Bmdy3SEII4kPKCw48vm:LQAe3TBvnSaYdx3LQyFC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764437347, "uuid": "69691e8f-f327-4cdf-9801-2503cfe0c4cd", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764437347, "uuid": "8d5d230d-d28f-4e26-a0b3-0cd6e80595fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764437347, "uuid": "8b55837b-da7e-4a5f-9883-7ac67c06c87c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce450c0c-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389199, "uuid": "051fd90b-05c5-48cc-9667-825238291d73", "comment": "Malware payload (Mirai)", "value": "43d2a22ea89f9feba808cb8b4c6eacb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389199, "uuid": "b9256566-6ff5-4958-a1db-ef2b938a4511", "comment": "Malware payload (Mirai)", "value": "765facbfb234525d97cda2ba078e96ea7cb915bbb3232d4bf664463d7efad22a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389199, "uuid": "3066df51-3dee-41b6-8068-913bc6419251", "comment": "Malware payload (Mirai)", "value": "08733d095d02bcf29198f35c61ecf65434c2b2b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389199, "uuid": "907192c8-255c-44e2-8e59-3b3c401780e6", "comment": "Malware payload (Mirai)", "value": "744d7a08571b1f5ffea4b2b99dded65380d78959ba5c65909418239ab0845c41f2d3c09797a52ad59cdfe8b8195bbcf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389199, "uuid": "1fc05c9e-ce0f-47a6-bbde-0320dd22893c", "value": "T185736CC5FA83D4F6E81205351277AB379AB3E53E2168CF83C379A676EC13502E91625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389199, "uuid": "f9b25672-6d6e-4ab1-ae1a-6c42e78d2b70", "value": "1536:+xWcbX4vYlTWOvtOOc4/72D2CYVNhXdCo0ZEa:+kckvhOvtOP4CDLMddna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389199, "uuid": "176bf994-ec8d-4e9b-8d6a-94200ced2aa1", "value": 75028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389199, "uuid": "292ecb59-e21b-4458-8869-eb4c6d577e58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389199, "uuid": "475c020b-0495-4eda-87db-702530d67d20", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d960331-cd11-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764413491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413491, "uuid": "9dbf3928-f059-4ab6-a70b-e820c1ce76b4", "comment": "Malware payload (Mirai)", "value": "6c18a58eecd51d4e7b16004b99fb94aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413491, "uuid": "e08c0a1d-8e3d-42c6-a9f1-2d379d0dffe8", "comment": "Malware payload (Mirai)", "value": "76709564665e96b0f6a8bc9c44f878f8b09f2de6ecc6c2b9ef6b4fcf8c9d184c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413491, "uuid": "5c4f8720-fbc8-4979-a1ff-ae945552f5f2", "comment": "Malware payload (Mirai)", "value": "b16823e11d070ff0cd3bd99bd50db45aa87ed44b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413491, "uuid": "4f91e4df-1d5d-49cc-a4c1-9981ded9780e", "comment": "Malware payload (Mirai)", "value": "84496c85c7a99bee2fff99c43cd4e36ff4aadf7fe0c915130aa8bd876a73a64b2d596191e905f9ee43da2682fb514a8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413491, "uuid": "d9e65b2d-d111-45b8-b08f-f837a9d4df58", "value": "T1D6F2F134DAE54A7A947024B8D26CCB82658F63B4E1D036D103E65BF434C196F1EBB6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413491, "uuid": "01465112-a075-4a89-8d1b-50946dfb7435", "value": "768:6KQQ3HE3us393anvtAxS7u9lXEHiJHLM745pB7ivkJDJs3UozR:fo3uryh9l0HilM8XBivkJDUzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764413491, "uuid": "edaa367d-091d-459b-ae1b-7dc55badfed5", "value": 36180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764413491, "uuid": "d4c748ba-eaba-4a2f-87ae-34d00c949870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413491, "uuid": "6b53eb48-53f5-45e1-9f17-6623cf9f6470", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5914bed-cd20-11f0-a129-42010a9c0007", "comment": "Malware payload (Metasploit)", "timestamp": 1764420135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420135, "uuid": "c222fe86-8e12-4d7e-b9f0-66dec9d5a83c", "comment": "Malware payload (Metasploit)", "value": "c1bee6cb18a7125995e675c787b95baf", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420135, "uuid": "7ab45b01-fe72-4a02-9b4f-b786871bbf06", "comment": "Malware payload (Metasploit)", "value": "77ffe8b7b3efa39fa35daaee1f70f560079c96c680f9d9d85997d658e2b367a9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420135, "uuid": "fa380d34-be54-47a0-bf22-3e4659d732d0", "comment": "Malware payload (Metasploit)", "value": "1f1768518de92846b15ebcdc4233942dc24af3f9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420135, "uuid": "bb88bcf0-2b36-4797-95ec-8fed3ef5cf3a", "comment": "Malware payload (Metasploit)", "value": "cbbc03c17d430768b60b15cec76bb8d5c189c66fc70ed3f318f1dde06c4188fc633315435094f46b9965abb0e5f6c9f8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420135, "uuid": "39c0e7ab-ce81-4ce8-bd60-ba7894e28c33", "value": "T1F822AF74E38A11B0F1917EBB816977A9883E36159AB96A4FE4443FD10E73F81071E298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420135, "uuid": "0a260c40-4843-4022-ac42-abf02d3985f8", "value": "192:ELt7+5NmmTTxRuk1NY1nD/SMhNF3tT+ogccNiqtBfiioSUfo3OAG8p:ELttmTbuiY1nrSkTd6og9N5B6ioSqo+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764420135, "uuid": "abcf7700-370f-4617-a0fd-29a523044f58", "value": 10230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764420135, "uuid": "ae063a5d-0ade-452b-af6d-506be8a88941", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420135, "uuid": "fa56f6e6-27a1-47cb-9acf-a1669955c5e9", "value": "test.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc240648-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764393571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393571, "uuid": "5b58996a-bad9-4b76-a09e-755e45098d47", "comment": "Malware payload (Joker)", "value": "bc7e0dac7fedd79d508bf4d01ae6bf2e", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393571, "uuid": "c08e5cf7-019d-433a-91ff-a683e08b8dd7", "comment": "Malware payload (Joker)", "value": "79cd8747c6eebe86e45054c0cc7d2dd942e951945a08549e69e418767a35a412", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393571, "uuid": "15dd2e7c-e801-4b09-a765-2535f8533135", "comment": "Malware payload (Joker)", "value": "d6c64f67d9f334ce2bbf1d7b359976008335f2f7", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393571, "uuid": "65c36062-1b8e-4faa-999f-4f34ea8e025a", "comment": "Malware payload (Joker)", "value": "2ba80917e92fd9b690341172cde44b0110e43da3da011933669251b98ac76dca4c9616a2eac8aefe9d7f01202d6cfef4", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393571, "uuid": "70272d1d-38e7-48f9-b6fb-70e6d6166510", "value": "T19B67F1A5F62C6C1EC8A2603CC855195399175CCC25E0837E586AB3BC6BB39EC7D35F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393571, "uuid": "2770aeb7-e4e9-4020-91c8-faf9c0d57407", "value": "393216:63NPj77bdoDnVIwnaMHfK0qzbobKGKh4R0Zuf3AVRzVVwIW8HNGhY3mTManfEpZ:63lj77shaAObaKfW0mAVz9Wgana", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393571, "uuid": "47a22bcb-f87d-4614-aa34-3c7f12db3447", "value": 30049662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393571, "uuid": "505b8b20-134c-42f0-bd2d-b55454114f1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393571, "uuid": "d026b260-3995-464c-a874-d85c3be9b57d", "value": "Sweep+Nexus+Clean_1.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5699f55-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409773, "uuid": "ec88a870-1e2d-4a81-85f8-9bb0539b4571", "comment": "Malware payload (Mirai)", "value": "598b28c4737408207552303223d377a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409773, "uuid": "419ef7dd-c40e-48ba-9eba-8e861785c22e", "comment": "Malware payload (Mirai)", "value": "7a1d8d2542a1dffe0b29b795c335f6425d75ebad7a82087ff469bd70b6e25b79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409773, "uuid": "5a34f8a3-361a-4d64-95a8-0193a1eba96a", "comment": "Malware payload (Mirai)", "value": "417798c190e09937062c9e614f2b1781687f3675", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409773, "uuid": "2ff2df84-c77e-4387-ab22-8c67fcf040af", "comment": "Malware payload (Mirai)", "value": "a1c5f4e24774f38173c9a89ade18fe072472e8bd9188fd4cfb79acc560134cfb2271642def98aae7c6161f7cd39a3f3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409773, "uuid": "331873e4-25cc-4a2e-a82a-486c076677bd", "value": "T1C1D39D97F35715A1C46306F047CB5BDE2E6322825F4BD9E36C29793B68BA0CB1802BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409773, "uuid": "2674f3df-47cc-49f2-a21a-b70dd7fac97a", "value": "1536:ePab5duI4tPymR/KdOExGwowWNgTwkeflWi1lZcDxMzggrFE5/LWr:3t59OKPVegMkefLlZcPgrYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409773, "uuid": "3c2a1cec-ba7c-4ce1-906a-2b07f1d73c6b", "value": 141084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409773, "uuid": "c06b1097-7f8a-4498-a23c-9704e6a63bb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409773, "uuid": "5107edc6-4d31-409f-af64-74778e06d406", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6765f008-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764392033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392033, "uuid": "bdbd0fb0-88ea-431a-82d3-235ecd110d06", "comment": "Malware payload (Vidar)", "value": "731ee300dc11d9378a4eeec915d2aebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392033, "uuid": "ef738d80-236c-4ccd-a943-5804fa9979d2", "comment": "Malware payload (Vidar)", "value": "7b6f7a6b5672d6d93087574589942023c64bcc550978fbc5c214774d1e7c7a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392033, "uuid": "e96648d4-f123-4db0-ac43-ca900798c531", "comment": "Malware payload (Vidar)", "value": "f8f6a0ef45a07a51568157355c83b137f20efe9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392033, "uuid": "87b29279-1c8c-471b-80e9-59583668564a", "comment": "Malware payload (Vidar)", "value": "dab6d2151d1a98b3d6e663a89a8674ed00cbeb65bc0c76bc415daabca34d9fccaa47d3c4ba0b05ca926bed78bdfa3ea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392033, "uuid": "9bd6d6c5-74c8-4426-a120-add470af60c3", "value": "T16046F62E69A29B19D09AD135BBD2B18177747C4407F167C71A80B6396FFE3C8163EB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392033, "uuid": "04cf8997-7620-4221-8bc3-f18d6e55fd1e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392033, "uuid": "9bdf602c-0927-43a7-a08e-e64dbd3d4dc5", "value": "49152:GfTwsEgn9TNo9PX23SvwrNFWkyGwM200praPZkx5egl+berhVTJLE+nKOVzVk4V0:G0gfo9PPrrKE5kR3HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392033, "uuid": "580a39e8-0f0d-4093-902f-4fd9d2a7921e", "value": 5385872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392033, "uuid": "c2454420-0ec3-41ed-8f9a-972317ec181b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392033, "uuid": "ac887cab-dd36-4e89-accb-6ad68346b4dc", "value": "z5xw5af5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e85e58e-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412929, "uuid": "662abb63-139a-41a8-ae84-d0458c7e11e5", "comment": "Malware payload", "value": "619b5e4de31de1a6aca1c1f5f9e498ab", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412929, "uuid": "ed3d587f-64e6-4ee5-bbe9-6b80b7a73366", "comment": "Malware payload", "value": "7bb8109ee9b333a946198e120ba255255e8faf5afc766549b8e9aee8653516a9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412929, "uuid": "8e5e6968-dded-4e89-bb72-84b3e8cf2991", "comment": "Malware payload", "value": "6d8047a28f5c943b181f9378f553b65239024a7e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412929, "uuid": "3ea27de0-1485-446b-aaab-03ebf05f58d6", "comment": "Malware payload", "value": "d3e8a6d06746f1f19a554991cc3c04a6ff1b32e7c0c9de571038c9dadae40e16d15588f8fed6fee9412f5c33a728a6df", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412929, "uuid": "25a473a9-29e5-4611-a353-d6c0f451a853", "value": "T15565D052F2EAF816C4F6C33261B86633617A8E18CB07FA551508B7BC68F7CD88F45694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412929, "uuid": "44018849-9e96-4df4-9a8d-acf5508b454f", "value": "24576:a6Tb2h7pDn/SnrYSqnQi86W48Egr9nIZBJ5qvSpePC1YUhGlKMgxm4X:fb2/D6n0nhWXEEIZ3pePCC6GQx5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412929, "uuid": "bffa12ca-cfba-4aa5-8dfb-89cff44f8480", "value": 1486334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412929, "uuid": "1f632219-b15a-4640-b507-3b7982a34a62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412929, "uuid": "76d739b1-d712-4973-a0c2-90470e8a2999", "value": "3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d64c09-cd7d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459829, "uuid": "c0f4b2a5-44a9-47c2-9b60-1e4f07530072", "comment": "Malware payload", "value": "578835117fd5891d5947f080fea91e64", "object_relation": "md5", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459829, "uuid": "dcf50a98-c6ae-43ef-9322-7660a7927b3d", "comment": "Malware payload", "value": "7c2103835be9d5494a05a47da32576c049cc8aa2cacd82bb541606bb98d80a5e", "object_relation": "sha256", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459829, "uuid": "4a42ab4b-2d09-40c0-b0c5-c3bf029e8eb5", "comment": "Malware payload", "value": "31077d8c82724164a0df984fe7865d09145174e3", "object_relation": "sha1", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459829, "uuid": "8ad4db88-1a91-4512-b439-91ea56110613", "comment": "Malware payload", "value": "a1c8692569ab03e3338614b3e309b14f4b8aa2654de8baaf9e0642cd59eec763e39c492bdb82d09a45e5f1792ac86c0e", "object_relation": "sha3-384", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459829, "uuid": "bb72abfa-7797-4860-a689-cb397e909458", "value": "T1D43523AA66F52176F4F993B484F603039AB2BCA05B7C49AF2149F5785F233E0A431753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459829, "uuid": "79938493-11e1-48bf-961f-2612deb883ea", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459829, "uuid": "79fcdbfc-2eb9-479e-95db-330ef6e4052c", "value": "24576:uZbWiPIJvRmnGHMulELvI6ALwD8bmHXWaF28tF:2/O5YGdsxA04S3BR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459829, "uuid": "126b0e34-0e6d-408e-b19c-cd5fd6066bdc", "value": 1109752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459829, "uuid": "20c4953a-a80f-4ec6-a023-577c4810895d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459829, "uuid": "149186b2-bfa6-4b21-a94a-05c2dbbf2f28", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b615c3f2-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409774, "uuid": "e95e3959-aecd-4cd2-b751-304c059ecbea", "comment": "Malware payload (Mirai)", "value": "dd4fd85252e30942cd0eeb4f6a70d25a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409774, "uuid": "c9fd154e-3a47-4927-b046-8fead5930839", "comment": "Malware payload (Mirai)", "value": "7d16ba8a896c822c224fdb1f17dcef5988c290373a4eceb0a24487a0e5276547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409774, "uuid": "26bd6867-2512-451c-81a0-41245dbf9cb1", "comment": "Malware payload (Mirai)", "value": "874f287e1f200533bb7ad132bf2d41cef2cc650b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409774, "uuid": "7b52542f-3091-48e0-8c31-e481c7ec0f29", "comment": "Malware payload (Mirai)", "value": "de77dbe000f79c5f74a8c80b55f83e66ad2695b5bfef57b930cbe0c440c66774dd5545df452d9c35d3ef5a1691049532", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409774, "uuid": "050acaea-627e-458a-a128-b5caf93bc7a3", "value": "T1E7B33C8AB402CD7DF50FD67684574909B971A3E11A834F2722ABFDA3BD321943D23E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409774, "uuid": "e9986df2-3cf8-4196-ae0c-6eda7659184c", "value": "3072:V4Q2n17sRxz/bD5rPq5/k7eNYqSuf6CMcNCjm80xja9FAsfFX3fkBZ2ZZQrEGeX:qQ2n17sRxz/bD5rPq5/k7eNYqSuf6CMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409774, "uuid": "bc39c62b-f8ba-40e7-bfde-af689089e941", "value": 117200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409774, "uuid": "9dfd5f29-6e94-4d4f-aa31-9ad38bdb5507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409774, "uuid": "d1ab0d9d-814a-4255-802a-b1de4a556f45", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6391c29-cd7b-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764459193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459193, "uuid": "00d25e97-1476-4830-b13c-043f5d84fb80", "comment": "Malware payload (MaskGramStealer)", "value": "69d4126f5b8048a1381ef6d55cba550a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459193, "uuid": "e28a6132-9bff-4917-ace2-5ff2fdaf70dc", "comment": "Malware payload (MaskGramStealer)", "value": "7d63ba15a61258d1b459aa937417215786d78d5e0a5e22457943562beac4f757", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459193, "uuid": "30c70df9-0f54-4922-96e8-33edbad5fcf0", "comment": "Malware payload (MaskGramStealer)", "value": "bd5b8ff09f1e02e5752818ea723f0f5263ac1c01", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459193, "uuid": "93ed9f8f-ffd6-4b61-99c1-05005bc3d1dd", "comment": "Malware payload (MaskGramStealer)", "value": "4e45c5171cb8e9f98d985ec6e09fcbcf6aa8737cf79b974cf42e54a2d91d17749997f1e6ca128ffa230377960235d447", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459193, "uuid": "76592da6-f38b-4bb6-913e-81973dc0e671", "value": "T190A50215121BA120CE2B07B36A69CE1960066FF2AF78E5BDA08C75D3543BF592027DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459193, "uuid": "cc057116-ecf6-416a-b6b9-1043e446deb2", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459193, "uuid": "c6c169d6-8a50-4461-b2e2-0cfb576cd083", "value": "49152:EiHSdPe4YmlaJMTZogAh08dynbYZtXAM:zHSYVmlTZ98cUZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459193, "uuid": "dd893b46-b547-4546-8607-835278b35b2f", "value": 2252800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459193, "uuid": "835ce6b2-5a2d-46ad-8436-375d50d209c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459193, "uuid": "899ac275-9d78-4d14-a0c0-e4accf4edea4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bf6ba7-cd1e-11f0-a129-42010a9c0007", "comment": "Malware payload (Fuery)", "timestamp": 1764419110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419110, "uuid": "d40f1433-c152-48d5-b7b4-b5139911a567", "comment": "Malware payload (Fuery)", "value": "0f0430c4d36ba14b3ceaf175f9f76d97", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419110, "uuid": "9b91a4bc-1bde-4ebc-aba2-160c7734e971", "comment": "Malware payload (Fuery)", "value": "7d95bd5475477571e8588b02001f683977cc56dbb1f3d075b5c66643f25e665b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419110, "uuid": "a5240779-b920-4816-b804-554bb767b544", "comment": "Malware payload (Fuery)", "value": "ab32151a41525bd342e5550eec672d5decfb3931", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419110, "uuid": "e4738da7-cc9e-4053-a9f2-37abdca3ff89", "comment": "Malware payload (Fuery)", "value": "f06bca0331f82fa18babddd1f1f0abfc59e839a06e8fdffedc97c1a2dc005af6c89e8c681037254f4e787ec1a3a3a983", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419110, "uuid": "e6e05bbc-9d48-4ddc-afc8-59d96e8254a7", "value": "T1B074690267F91149F1F7AFB56ABA4511893ABCA6AB75CADF1082424F0D31FC099B0737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419110, "uuid": "e7bfd4a3-05df-4a6e-9687-abbcb9997f99", "value": "43843f737ba899f89b83bbc52773c3d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419110, "uuid": "49afe94d-cc26-40a0-b5eb-6df3a2f5a025", "value": "6144:gYrDDCnn1RXaZ7OTjd4uJftA4V/Dajj/Vn5V15uq+12x9N0I8tEqe/n:fr3CnzaZ7OTZD31DorV5V/z+1iN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764419110, "uuid": "22efccea-1e95-4bd9-b03c-895cd661b947", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764419110, "uuid": "ddffde55-112c-4fff-9740-ba1d17f55831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419110, "uuid": "5e4e7352-fe25-47ec-bb1e-1709d6adb8a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefb9f74-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409762, "uuid": "1c189aba-f8da-414d-becb-7c82ddeacb9b", "comment": "Malware payload (Mirai)", "value": "7b4ba2352375777d1b394e5c8262c314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409762, "uuid": "ca2771b0-c3cc-4193-a95b-75ee32f1fe09", "comment": "Malware payload (Mirai)", "value": "7f303fb380dd67526af83762e168c885003ff80a4aff19f47330a2906e94f3fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409762, "uuid": "4585ea34-0045-483a-8398-55c2885401c6", "comment": "Malware payload (Mirai)", "value": "2a4eb8bf4a0885d06173a5716417d27677a4355c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409762, "uuid": "fdc3ba05-fcba-4f67-b350-5f90249c74d5", "comment": "Malware payload (Mirai)", "value": "0f496d00994ba45673534c9129fed9db981fa2be7a14e92d519305c31ce211241236cb44d867d603bfe45fb0d96bd225", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409762, "uuid": "6c8123f1-ac34-49c3-a549-63cad3dbeb2d", "value": "T128130249C1F247C0D0D6A3F054EC1DCB2619D0AFD42850BA90D4A05AADAAF966F34F5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409762, "uuid": "8abf0d44-064b-4065-aba7-3671f50a91de", "value": "768:dRpcNe+daGvyO8i6UdlOnIIBtknlDpldba/fl2t24QRgpOj/SnbcuyD7UoQRjZ:2EKHKJi62UIIBCnZpldG/fs24Qz/SnoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409762, "uuid": "b7d61c0b-7233-40a5-aa5b-c1570aa3c9af", "value": 43652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409762, "uuid": "a938bdaa-1eee-4a5e-807d-4fd2f00542b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409762, "uuid": "0cfaf450-58a3-4c05-8696-7023c883aa2e", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5a26d5-cd30-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764426780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764426780, "uuid": "189e3578-3ad8-488c-871c-0a62d6eacce5", "comment": "Malware payload", "value": "43dd17a294d951abfa79726fe1f95c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764426780, "uuid": "726319f3-bc3e-4a93-8c49-13c4d596bb62", "comment": "Malware payload", "value": "806f3e980694e839b9563415b38a44fbf3e4832e67670233495962dcce367423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764426780, "uuid": "81aa2ca0-78b5-44f7-8551-3a89c1571a47", "comment": "Malware payload", "value": "547f6f0edb16a11d68229da52707c4ced9b4f658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764426780, "uuid": "ce2b7fa8-9190-42e0-8dd4-e6fbc1e6da14", "comment": "Malware payload", "value": "a370d2c406873ccaa076c77b155c66fd25d3cdf446f12bf311fd485f2c4693aed90c503abbe1f3306e36a1a2e948eb0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764426780, "uuid": "a81163e7-4421-4fba-b67a-3e8feab999d4", "value": "T10C547D1AB3A408F8EDA7823CCD424506E672BC164761E7CF13E5475A2F2B6E19D3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764426780, "uuid": "b8875266-236b-4471-abb5-207606e58253", "value": "eefbb5636d91628a08e96593383392d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764426780, "uuid": "b0000158-e1d7-4b5b-a314-7af556856a67", "value": "6144:XFXui7C9fooaAYDmqwvEVHZzYcRuzVGL6yosfB:VXuJiAYqPvEVHO5zVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764426780, "uuid": "6fde1688-890c-4453-9c1c-16c534113e0c", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764426780, "uuid": "c3ae6fa2-6b3e-46d6-a14c-364551a5f119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764426780, "uuid": "561e4d65-14d1-4791-920a-9139d761359a", "value": "Ransom-SACHIN-HMI-P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c69f47-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389847, "uuid": "d6f09eca-217b-4638-93e6-9cbb88095fb1", "comment": "Malware payload (AsyncRAT)", "value": "e1c20f8bf79bac30494b78ac9554a5e3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389847, "uuid": "2d992cb2-bf3d-4add-8866-e979f5843290", "comment": "Malware payload (AsyncRAT)", "value": "827ec5a2a6369c127d181d6757b5e01655f8854df691cf1bb821cd385ce4fa04", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389847, "uuid": "48fa24df-17a9-487c-a5d5-8fa38b098ec9", "comment": "Malware payload (AsyncRAT)", "value": "2360b37196b7006bef27141e09302b76dec6bfda", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389847, "uuid": "9db73255-3c15-4a47-b8ec-350f0357cb2f", "comment": "Malware payload (AsyncRAT)", "value": "a6d61b3537059996b0cab98ba0c0d7d660c799e631fdc150e3a608e82d0fc0fd5e7f73977e114174608f8766bfc15898", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389847, "uuid": "38633395-b2ff-407f-b516-7ebb10e43da7", "value": "T13D05AD11F7804039F4A359358ABF9725993DBCA61F759ACF53C8022E1E727E09E34B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389847, "uuid": "d495916b-345a-43e6-952a-84607e65a106", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389847, "uuid": "539fdd9c-c707-4198-a795-1ad69e649833", "value": "12288:pYyDi5eNiQ7uysMFZzN/E/msuF31Za0wIk0BX3RKuemGd70ioGuVWW6oI7:6bvgr7afDd70iTWC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389847, "uuid": "e5740b04-e79f-4452-9d1c-fb4858d53273", "value": 811504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389847, "uuid": "4b76ccf9-1a58-4e9b-b0ab-3bdce6c3a79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389847, "uuid": "5c10ef30-23db-4c7c-a773-c9c8d62b2dbd", "value": "5drfz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7277f7-cd79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764458263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458263, "uuid": "634ca7c1-1896-4807-aa45-f047a938318f", "comment": "Malware payload (Mirai)", "value": "d219ec93d9e0609bc972bffa09f280a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458263, "uuid": "337d55a0-f1c3-41f9-9cd1-e8054dac9fe3", "comment": "Malware payload (Mirai)", "value": "8398a0128b50826b70002e5e1bd46aacc002a9f00b9508a5e1564f32057d07d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458263, "uuid": "cf71af6a-de89-4353-ba57-715ab6c2de0d", "comment": "Malware payload (Mirai)", "value": "40b7c8be54b25afc929b4d788c7a37c9f4269bc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458263, "uuid": "52194e33-6a1a-42d8-be6d-cb37857f52e5", "comment": "Malware payload (Mirai)", "value": "16d386aa8880557b8a568b662e76a1bd1bec5262a129ac5d91d5c794ae92cb58a8ac98dc4e3265c4d847023c6db2e7a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458263, "uuid": "76b97988-2c5a-43da-8284-8b53c7bf76a7", "value": "T19B630212CCD850E1D0721FB6752DCE47F94ADBF9CACF81AB0E1A4439360125B65664BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458263, "uuid": "a9616782-d81b-468d-b40d-6b2fa525aeb1", "value": "1536:FY+JSryPuiGzMGS12m3oMK9/EDILL6qxXXDvNcqTD:FY+e4xGAYK+xLL6qxx5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764458263, "uuid": "307c2848-e7db-462e-9164-248f77153139", "value": 73252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764458263, "uuid": "8a0db194-0bcc-4673-b7c8-198d2a7632f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458263, "uuid": "0b6bebf0-4875-41f3-9f67-272d6cce6518", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2760db-cd71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764454907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454907, "uuid": "536a6e0b-edac-4746-941e-3eef1b64d2b8", "comment": "Malware payload (Mirai)", "value": "b34638844e7764ed2c42773287c61fee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454907, "uuid": "68214cde-6b56-40b4-b955-82fec318aebe", "comment": "Malware payload (Mirai)", "value": "84438d75d6e48cf16b538e27a6983f6ac342d723c05f6fe13cbd87da27972036", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454907, "uuid": "a65ead6e-c6e9-4ad2-ad97-d53a1b747958", "comment": "Malware payload (Mirai)", "value": "2bbcfbfb496494916096998be3450ff8a2bea3cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454907, "uuid": "88ee45cc-63c2-4347-bdcb-8b147da5094a", "comment": "Malware payload (Mirai)", "value": "fbc00c93722839aa4b55fcf08b75ada6e9bdd9dae1086928340be4d2df067910f5ba4033302452b0f4bf3c52dca11955", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454907, "uuid": "5aef226e-7b46-42cf-ba14-da8930aa319d", "value": "T1F523F183C366FA54E176DAF3A803F0A5DEA1BB031425132F29DF750F0DE8A846629B11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454907, "uuid": "b0922fa2-5eb9-4a3f-ad32-5ed0034c5f42", "value": "768:etB548w628WWpbLcWgytWgHQGWd+CzqCFX3HqzB9R+OU2VBkwv7NIa3ZBlx056:aBw62YcW5tWgHQGmme3sB9siVHB/3ZjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454907, "uuid": "c69aa117-628c-4101-8c7f-7f59d95349ab", "value": 47924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454907, "uuid": "0c580b53-3076-4393-8fac-ab54c4828de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454907, "uuid": "726337b6-2e9b-4dfc-b5b6-f5dab5ffc19a", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a80313-cce0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764392354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392354, "uuid": "e42d4ac4-c2ec-460c-a359-9ce30a3b3af2", "comment": "Malware payload (Mirai)", "value": "cbab1a1801ead6a55b831f03a813777a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392354, "uuid": "d10c615a-ed96-424e-8ada-d83dc96c974f", "comment": "Malware payload (Mirai)", "value": "85b6fc9e2e8e92c3a55ec41b64af14964cca67095c219f51873fc949ef69b336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392354, "uuid": "87ae9cb8-93a8-4c2d-8ecd-e76ee5541cac", "comment": "Malware payload (Mirai)", "value": "16bef1df0ce22001a3c1bd4da7cefe3371133228", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392354, "uuid": "bd983057-c8c0-4158-970c-d2a7dc56401f", "comment": "Malware payload (Mirai)", "value": "24afdcf1164792e8f8c7fa34af3f1fa80d3bfa7fa2aef398f2fedb0eaff395265eebd288a47c5199a4988d978eed250d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392354, "uuid": "af096c49-a5eb-41be-81f2-fec9b3ea15d5", "value": "T1C4B36D25F4391E27C5E1947B22F34721B6F257C911A4CA5E7EB10E8EFF212902607EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392354, "uuid": "41a42d22-aa08-4eb3-a49f-1327b78c763c", "value": "1536:Yk4XSalLd1G+wFOgEzTa4nK6rcFs9PEZJnJDCnSyQu4Byn+45t2t6PY+5ck+wRQy:sJLUjl/TnJDOSFry+4KsPYmcHN0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392354, "uuid": "cc02ac06-44a7-453a-833f-112134808fa9", "value": 111000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392354, "uuid": "0f36e345-725b-45a1-bfef-de373b4703e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392354, "uuid": "dc009aff-84b1-43ab-8192-8f8db5c6587d", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1040313e-cce0-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764392316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392316, "uuid": "8602244e-bc09-477e-9243-a0e7b96d0e25", "comment": "Malware payload (Vidar)", "value": "53e34714ba68111e0e3ee18dc80c57b2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392316, "uuid": "c7c58b96-b741-4d31-85eb-decef6f35ba6", "comment": "Malware payload (Vidar)", "value": "85ed668cf5257dc335f5e73322de0638aa12e1d1d8ab982736a93dcd36f71bec", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392316, "uuid": "71510c98-1b7e-4ea5-9219-11c7cffbb9f5", "comment": "Malware payload (Vidar)", "value": "fd63adb16cc354b24f45f4022870262e04885463", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392316, "uuid": "e5e89c46-bfd1-4bea-9576-e00f7ccc40dd", "comment": "Malware payload (Vidar)", "value": "bd1b1a87875c48aed32fec813e7ceeaf59b794490b791aab304e5670fb5c9f498e417b38935d1e2e721e51b89538b134", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392316, "uuid": "32e75c8e-3ec4-401f-8f7d-5cf59f216e73", "value": "T1A4F02B04DC22A2862B3324C0E1408B0ACEC3F46320BB5A243C00CC025F248AC362C6F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392316, "uuid": "821f53d2-aaca-41de-a84b-51474bb2aec2", "value": "6:j+RwQ9vDzFsJgg2gAC3NqhLx0HGFGhXCOBaiS0LSyjFaYZiXMvveEm/UC1ELD:K3vDzEcCYhLGHMXpjy4wiZUVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392316, "uuid": "681831c9-4de4-498d-8bff-27294eb98e22", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392316, "uuid": "f539c974-4799-4346-96a8-9d237fcf39da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392316, "uuid": "c5d0f779-40af-4cf4-b9ef-2176a6781eb6", "value": "ir.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e552e2e9-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459675, "uuid": "41e0063e-75bb-4a0a-966d-aee87839a08c", "comment": "Malware payload", "value": "cdd286a1bf594e10f30c13d3edae7b44", "object_relation": "md5", "Tag": [ { "name": "81-19-141-253", "colour": "#35DA44", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459675, "uuid": "0291b428-2344-46bf-9ee3-470178945231", "comment": "Malware payload", "value": "88f2ceecae19a4086ed51ad526d2ac7fda5f645ad15a5ff916066b1f46e52526", "object_relation": "sha256", "Tag": [ { "name": "81-19-141-253", "colour": "#35DA44", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459675, "uuid": "039724b4-6f5f-483f-af73-c1edaa2323e7", "comment": "Malware payload", "value": "e41adac370815dc0e62d8d9aa8cd070485e19a80", "object_relation": "sha1", "Tag": [ { "name": "81-19-141-253", "colour": "#35DA44", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459675, "uuid": "bfffe3c2-b2a8-41be-b7f5-711db95edceb", "comment": "Malware payload", "value": "bc74dd9457964ebc0261de663bf43ac563353fa4cf9a3b6ca7dc7dd488c6bd455504d042b2a4bc1ac2f2fe4f76d95efd", "object_relation": "sha3-384", "Tag": [ { "name": "81-19-141-253", "colour": "#35DA44", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459675, "uuid": "80d4f9fc-9a9a-40e8-83f3-f818c5b9c87b", "value": "T1D925220617E82963E8731778CCF201839676B9E15ABA64EF2254C1BD4F03BD0B579B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459675, "uuid": "a94bbe63-1719-4a5b-ad3a-a8446a41747a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459675, "uuid": "e580764b-9cec-4a75-a010-a7ccae419eda", "value": "24576:WSC074bXVD4P35+cV6tsHJ9bCRu2z5rIXDs1ka8y5FVJ:s/MP3Qc0tsHbbCRueRkav9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459675, "uuid": "134097ed-6135-47ba-9667-5375ecf20929", "value": 1054920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459675, "uuid": "a0441eab-90b5-41ba-a3ac-61f195828479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459675, "uuid": "2c5e7518-1015-4b53-9c7f-881631a12cda", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee4f34e-ccf3-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1764400474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764400474, "uuid": "174d49e3-cf1a-4f6e-848c-ebf9c3c6bdf7", "comment": "Malware payload (HijackLoader)", "value": "1e6126e2a7e041ff1c1fa4178ea0119e", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764400474, "uuid": "0fc638ec-c73d-4206-a4ba-7708eaf70383", "comment": "Malware payload (HijackLoader)", "value": "8986d305ceed84c8dbc430ae7caf31b645f22fe5c4c29bca869eaee9abc46585", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764400474, "uuid": "aa55028f-d3a6-4479-8a69-ce213e8c0e61", "comment": "Malware payload (HijackLoader)", "value": "87e3fe5a3ce4003f2663328fa17fc4397012d87d", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764400474, "uuid": "c41e5e00-cad2-4d0d-9a4f-80ce5d25ee6c", "comment": "Malware payload (HijackLoader)", "value": "a517e4fb1a0f3fe9dac4176fd94a853679353848baa87e7d1039499870b83d91601deadfaba35a8f20777edca2e5ef17", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764400474, "uuid": "83b1a5d2-570a-4320-b279-3a791037c155", "value": "T1ED963342E8E31A37FD6FFAFBC2DD5C882870CE29FA2585A43680F16215B3394754A4D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764400474, "uuid": "72d5427c-d5b9-49e3-ba56-4cf1eea9ef0e", "value": "196608:USYHQvyYHplWBKzdDZVaQspidYza+qOgNQVwds5Q915wG:USYwvyeAKdDZVaL8dYEkwz57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764400474, "uuid": "93d4448d-4858-4ec6-a086-bf62299e953b", "value": 8663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764400474, "uuid": "10507d91-1705-4e1d-aaba-9b517ac399be", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764400474, "uuid": "b49c74e2-274d-4bac-9e11-99196841f9b1", "value": "BMUAUFKZ.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05eafa33-cd71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764454576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454576, "uuid": "8b2f3e66-448e-4bae-8bfa-0d0431713ba1", "comment": "Malware payload (Mirai)", "value": "9159b6821922e3810abc0d132fcce206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454576, "uuid": "8e1258e1-7f37-40cc-addf-831b17e96871", "comment": "Malware payload (Mirai)", "value": "89c41b05269c94e81a26e4437e2b1eee390bae1e8fc658e7bef262a9c5252cf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454576, "uuid": "b9cc68b4-da92-48cc-9323-0acca12d0d15", "comment": "Malware payload (Mirai)", "value": "168af0e2a1771cfd9c165e19c37aeb19678fc1b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454576, "uuid": "73a374fe-f478-496b-80da-528a4c59b247", "comment": "Malware payload (Mirai)", "value": "eb449cfc62bfa0470ce72530ba08f72364665b18c9ca67f763588c44dc927f2b3d8ffc8f96b661870bb8585427e7ee85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454576, "uuid": "bbeb89a0-d3e2-4583-88ef-7650bbb1d103", "value": "T1B9B3494273180F57C19749B02E3F27F687BEE5E021E0BA89650EDB5A8675E37144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454576, "uuid": "94ddcb39-9abf-4a06-a498-43966381111f", "value": "1536:EHXylSpMEscMYse9k1B28pQaKL3czAD5KDs9f+JuMqV5B3V/10:YXygpusk1MnaRW9Ku9z10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454576, "uuid": "0b354f19-0ce5-4416-9425-bec1d62dc8f0", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454576, "uuid": "e68d640d-107e-4e95-89ff-092aff861d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454576, "uuid": "144bf207-5593-41bc-a647-f8d8a7eefc7a", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726f202b-cce7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764395487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395487, "uuid": "e71da65a-8b80-47af-981f-953dfd85f610", "comment": "Malware payload (Mirai)", "value": "71b8eca48b588383695a9b78862089cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395487, "uuid": "5629b57d-06f1-4de9-845a-d7fdc4466fea", "comment": "Malware payload (Mirai)", "value": "8ab3a5d161b49190abc0f19b3850f69b798a751d5e84ec9929e4bbb825e3ab9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395487, "uuid": "a8140c02-8e0b-4a8e-8e01-d0bcab207f31", "comment": "Malware payload (Mirai)", "value": "1250f93b90e02920aafd816e67a4473dc2f43b0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395487, "uuid": "731bf7fd-d58d-4210-903c-b59c4c453ae6", "comment": "Malware payload (Mirai)", "value": "e31da5467fe78980b4477d120c2e2b34be7e3170dfdcacb07e273fa353375879947dedc1540eb427883d534c935e4801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395487, "uuid": "46d96f9b-c275-4602-a9e1-020f30fbd8f8", "value": "T150D3F885FC509F13C6D522BBFB5E428D372A1798D2EE72079D216F25378A85B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395487, "uuid": "71e7cb8a-fd34-463c-bf4f-3ccfee029a7d", "value": "1536:vKlXv/RwJVpRr34nQmjVyUPFOhi12z454VMjQTdHU0F6ZOblRXJxC1LFaglc0dwY:vKlc9s0hi1T4KQZHUafXCJUiTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764395487, "uuid": "6fe41491-3c8d-4e16-86aa-252dda5c672e", "value": 141984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764395487, "uuid": "ecb1847c-c684-41c8-a3d0-f3fc14ab95c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395487, "uuid": "334aec77-615f-4472-95a0-d73b794c3c13", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e2467-cce4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764394111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394111, "uuid": "4b0d10e3-ce5e-44bc-a1c1-1909eb777f6a", "comment": "Malware payload (Mirai)", "value": "d56914d81f1465d8887bea20256c2703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394111, "uuid": "1ca6e933-1cf8-4d10-9ee2-0c3723fc31b1", "comment": "Malware payload (Mirai)", "value": "8b6a366d572f7001a5985a25cda7abe3bc5fd1b757cbeb74af753aab680b613f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394111, "uuid": "d94f9685-a9ed-46b4-8fa1-38dc62d4f9d5", "comment": "Malware payload (Mirai)", "value": "b1f76ee4d3c85881ea5e11f3243b6a0b18eb5490", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394111, "uuid": "6e2c6f5f-5be1-4142-ba7e-f06a2c479a7a", "comment": "Malware payload (Mirai)", "value": "1d5918aa339b7c69ad14c59a0152580f1d0d004703f899cebf72ce6f229a32473e17f4dccc06457ad2af1529bc44a691", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394111, "uuid": "b19f03b6-cfb1-4750-b0b3-c665e7a4021e", "value": "T1CB23F1E711B7E7F1D907DFFD405A65A4F6309DD28A028BB788C7319E60BADC814122A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394111, "uuid": "ee2e2e21-3147-4f68-9f3a-0220bc6266b0", "value": "768:qIwQPCVP9V+VAK1kkQ1m9YuhbOhoEkzWW8Cc2w5TK91yc1RJVEHx0Ys:JHaP9VIvi1kwKzLbo29151RJsxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764394111, "uuid": "a1ab9b07-d146-4e2b-bf0d-70f01b9ae6e7", "value": 46524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764394111, "uuid": "864a7f1a-a35c-4f59-b5e9-cf64efbe7db6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394111, "uuid": "64c2e76b-c0e4-4d82-97ef-3b106cec002c", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cbb230b-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Generic)", "timestamp": 1764413007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413007, "uuid": "60099b77-8283-488d-bf46-fa91f86122cb", "comment": "Malware payload (Adware.Generic)", "value": "630c1ebf7d4bba7c46f1fe0fcdcaae5d", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413007, "uuid": "9d3d9afb-e35c-46d8-8ca4-f96a27c38675", "comment": "Malware payload (Adware.Generic)", "value": "8c0e8a9cad678b459a863b7fdba7fbb0e0dd37fc07b298abee3dbdbafe7a2ad6", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413007, "uuid": "30a84db8-2691-4c04-86b9-1957503942dc", "comment": "Malware payload (Adware.Generic)", "value": "7e4c845b53b29f0ea29e264e0f1fa92efc91c5a7", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413007, "uuid": "68760fb3-e80d-4ed1-bea5-aba9e2b335e7", "comment": "Malware payload (Adware.Generic)", "value": "5808996a85679f1d5c0b598f323292b037bad357e5184b21b2482c5cf94b54439ddcf536898868ff5af9f902b7b28b48", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413007, "uuid": "de269aa8-823e-494d-be61-47ea16e805d7", "value": "T12BF7333BE15C753FC5A91576097242045E7A7A84381F8C0F5BEC78ACCFB66182A3A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413007, "uuid": "62a8bbab-f7c4-4fd2-b170-7c04b3b079db", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413007, "uuid": "164946ff-32f0-4e12-a2f9-a880b106ec3c", "value": "1572864:WxfWWQITrYX5E9X1v0rYF/JZJr5Yoej1Q0+NKrqTJTBUUY9:Wx+LX5+fF/Jfrm91mQr9UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764413007, "uuid": "cb694ca7-e55d-46bc-a194-a3a3c93d004c", "value": 76280536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764413007, "uuid": "8e1742c1-ae1d-4f59-9597-316778eed96b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413007, "uuid": "2da2983e-8fef-49f2-9cdd-6ce46e030c6c", "value": "np08w10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1063f0-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412952, "uuid": "fc562e7f-f0c2-4e52-bae3-96f8278a36b3", "comment": "Malware payload", "value": "f7d39cd590e173758106c76f445e35dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412952, "uuid": "14f13e18-a0a9-468d-96ff-921569d1fa52", "comment": "Malware payload", "value": "8c33aec23b2a9816d4b2d7087b9af5e03152e74a68e893c86fbed5fd20ed3fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412952, "uuid": "773df806-b6f3-4f85-969f-8273ec873a42", "comment": "Malware payload", "value": "345bd81eef5c9d5c053950cc857691b38e34d84d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412952, "uuid": "31fee77b-d60f-4a0e-81da-205971816361", "comment": "Malware payload", "value": "c58a358e138daaff6b91131611d6ce70426b87bb922db0b8c810b0da20892ceaf6104478d3d95ed56adebc8570152604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412952, "uuid": "5400fccb-ff37-4434-9ca0-1ac258cbb2dc", "value": "T19C059D2273DDD360CB769173BF6973056EBF78650630B89B2F881D78A950171262CBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412952, "uuid": "586d8620-ed0e-4708-934e-6b4abd91ef52", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412952, "uuid": "08ec811e-bdd2-4291-9110-73e27d8c7243", "value": "12288:2CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaQYpYQv:2Cdxte/80jYLT3U1jfsWaQYpYQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412952, "uuid": "b56c78f4-85a1-4869-a0d5-a3106a3b2501", "value": 865240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412952, "uuid": "da4a42f9-c861-4c20-b6c6-005763be95b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412952, "uuid": "976d5f1f-a251-4142-9a35-2b85a89c1886", "value": "GMSSetupX86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c75806-cd4b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764438580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764438580, "uuid": "4c744745-dd91-48a6-b826-524760ccd869", "comment": "Malware payload", "value": "6a64dbc3c3a2d0f6ac2539b1843fdf58", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764438580, "uuid": "01669269-98fc-4c94-8cf1-fe7dc8cdf05f", "comment": "Malware payload", "value": "8e1b44f1a7580fb06f5a61893edde1228b512422868f5a407e51232f6c337110", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764438580, "uuid": "bc279657-3287-4477-b943-f57ad16ae252", "comment": "Malware payload", "value": "da84e4306f61489a520eb31bb8887c9b8161ea32", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764438580, "uuid": "b916e536-c576-4796-860a-fe2cd90dc84c", "comment": "Malware payload", "value": "ec19d91257a605474760b1ad0926ef8b9a9ef4d1b95f840ebb8bf1e44b994637208b69e1a27adfb7d7296eff96e9dc70", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764438580, "uuid": "d57d08eb-1f76-4ffe-8310-84bd873ac50b", "value": "T13755334083F1857EE11A50F2E73628DD5C8C651263F106EBA4E6279B572FCC96A26C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764438580, "uuid": "68fccd0a-d128-4a4c-9138-ad538a62b436", "value": "24576:c7d0mv45nyMNZLk9HaPtT4I2YIt+ETfH+JK70P+HrgZS43NgOczSaHPhhxUw:c7d0mm3O6PtsIgxvPY9S49dcrvhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764438580, "uuid": "6c30414c-0202-406b-9bf6-4be4dbaf6a56", "value": 1354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764438580, "uuid": "fbf4bd57-9a5a-4a5e-84cd-1ab1f0a8d4c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764438580, "uuid": "9f114eb6-2499-401b-9870-cf69fda4d677", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38385a8a-cd05-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1764408275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408275, "uuid": "edb28fae-87be-4a58-97b2-3a0176363c87", "comment": "Malware payload (Ngioweb)", "value": "71df9104a855399dc76458d4caa1aa89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408275, "uuid": "c7cc3d57-d4c3-47c6-80d4-aa765694ecc5", "comment": "Malware payload (Ngioweb)", "value": "8ff7abbe5284e6da954a46ce5811e1948a7150739f6d9204023a01bcf484e2b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408275, "uuid": "c0874043-bf9d-4c7a-bf4b-cfba982389cb", "comment": "Malware payload (Ngioweb)", "value": "c770313ea785c0b0e6b6ee08d0f47917b6c8c49a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408275, "uuid": "3c39c4a8-76ce-4df5-b6df-5b1a5984217a", "comment": "Malware payload (Ngioweb)", "value": "10131902e3b193948dd8c2b2f7434d5b729f8c59e92a98af484eee83ed0ad8bf27dfed842284cc0627f4affa4ffcb778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408275, "uuid": "aaaccfb3-082f-4969-b9b8-bad8586d708e", "value": "T15D932A66F880DB16C6D4267AFB9E118C332217B8C2CE7106DD149E3577DBD5A0B7BA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408275, "uuid": "a180f89e-8885-4ef6-9c07-fa68893fd5db", "value": "1536:/vGfcaYYRVfSOnIUiF8e9Zt8P74vb34zux57M8OmifO7lpWcbaZD0b0yXvtpumNr:nocxkbhfe9Zt8P7Wbok57qU7lpdaNiXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764408275, "uuid": "20e1c0e3-8897-4659-b0c6-cec7f12dcfd4", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764408275, "uuid": "534adcb0-890c-48fc-8d6e-8576304de9bb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408275, "uuid": "9b1d4cfd-f735-4e26-93da-d7c8bf240340", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853a244f-cd3f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764433315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764433315, "uuid": "98de9cfc-2800-44c0-9a31-95a599abbbb2", "comment": "Malware payload", "value": "7d50d8e8870f8360d8df25c048834005", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764433315, "uuid": "a12c016b-324c-429b-b508-008d1c9a0af2", "comment": "Malware payload", "value": "906bb7311bd620f62bb8dab9cde741d2ded0d6440662d374bb481cb3b11e2d66", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764433315, "uuid": "6b50295c-6bb3-4ba8-bf46-ed8c62b6c366", "comment": "Malware payload", "value": "9833ff80c5fd22e8a2c3b3bfe4446e543e142c06", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764433315, "uuid": "d87d3803-e9af-4ff3-84e2-b693045ead57", "comment": "Malware payload", "value": "413feb1f589c5aec9fa59554254e77989b1139af3260f9320ab1c85d6952953d18b94e743319def4230671c42303f2a5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764433315, "uuid": "603e9071-c8ec-4a7c-8177-fc59b282bcb7", "value": "T1E573638829CB84F8AA77789449CF8C45E7A49A07161CE7D7BA4DE5A03F11438B3FC9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764433315, "uuid": "93dcd872-4b7a-4787-9d29-85ff2fefa2eb", "value": "1536:hiJIhMWVtUw4q/FdFkjpN3FkJy82sSjW001GH4lJQTJrlt5T:vrjHkjpN3FEy82sSjW001GHAJQT3t9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764433315, "uuid": "29ecc70d-a1cd-4027-a41d-42428ff672eb", "value": 75636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764433315, "uuid": "c81f85ac-340a-491a-9f03-3344e3c0f9a7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764433315, "uuid": "277ebf15-beec-4505-a9de-52b5b24e9e89", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62600193-cce3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393742, "uuid": "3a0cbd0e-7684-4025-9f1f-5d5ced67001d", "comment": "Malware payload (Mirai)", "value": "8e630acdf582cd9f9fa6a92dde2cd410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393742, "uuid": "c1e38aeb-1294-4218-a621-f3eaa696766a", "comment": "Malware payload (Mirai)", "value": "914cacc1746bae60cf643f1689daa0d10d58441b7bf8f5b3df089c2e5c967d19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393742, "uuid": "7658fbe5-3827-44a3-a18a-6e4f3e76064a", "comment": "Malware payload (Mirai)", "value": "5a4ed9c987e2e0860a025c96bf96c18cda0cd26a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393742, "uuid": "1ffe9917-c08c-4d99-9d3c-ff9300914d42", "comment": "Malware payload (Mirai)", "value": "5309fc4a81469ed34139cc045844fd7cb00ff77fd5987367e6e550478a3545a13b97c84bf8dad7bfb0b504dfe271fc05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393742, "uuid": "eaa6eb6d-2f97-46d7-aa4c-337f24faa849", "value": "T1BDA35DD5F643D0F6DC6205342172FF375EB2D5B92328CAC3D3B89A76A822941DC16A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393742, "uuid": "b69138c6-407b-412d-a746-aec75251ccaf", "value": "3072:WdoPfMX+NQm2jjowsKeXYxb10ES/LZCEBW:MoPfMX+6lxbSVCEBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393742, "uuid": "839e29a3-fbf1-4aea-abbf-c263116e8857", "value": 103700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393742, "uuid": "b5d511e6-37af-4aae-95c6-d1571c117ace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393742, "uuid": "d0dd2772-2d0b-4e6b-8526-d115e2fee4fd", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc8e8e2-cd78-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764457995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457995, "uuid": "db8ca292-1583-4789-af6a-6e21b89703fd", "comment": "Malware payload", "value": "13bfbf67e6e0e203af33f7a5dc627559", "object_relation": "md5", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457995, "uuid": "3e028cfd-cca0-49cb-bcd4-48014c474539", "comment": "Malware payload", "value": "917c60cf31739ddae9baedc199f3a2dd20afbee1682bca0ea5be7cd4c1ca5037", "object_relation": "sha256", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457995, "uuid": "528fd734-271e-438d-acf2-69474401334e", "comment": "Malware payload", "value": "0c3b30b451a78e7cda32c2f7cd1a50ed093b8437", "object_relation": "sha1", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457995, "uuid": "2551f6c8-0707-44c0-b5d8-edc4e90dd057", "comment": "Malware payload", "value": "2785a81db29197f8165e414a79c397069e7c2256987597f93e1b8dbc56f0f81dd16b3fc2ef5701b17ae5aca99c34d197", "object_relation": "sha3-384", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457995, "uuid": "5022f8b5-f4a5-478b-a8ea-ddef36e033cf", "value": "T19E363A16B9A2CB98D05AD27BA58172417B737C5017B53BC71AC4B9762D3E3C80D3BB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457995, "uuid": "0acca241-4f57-41be-8880-916eb2cdbab8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457995, "uuid": "b2ba69bb-ea3e-4546-9c7b-7b68e6c1f36e", "value": "49152:545s70ME3N/ClKqil2wzZuTclvkyJtoYCF0T+AvcULGDjVXu+j//Y8WiY7HkXwSo:5PcUKeoPj+P3FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764457995, "uuid": "d3204f3b-9df7-4156-9731-78873729f5ca", "value": 5055640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764457995, "uuid": "e7a2c530-cec8-4008-852e-755ecce14a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457995, "uuid": "8d98094f-2f49-40e3-bb8d-f0e59bb98373", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86770cf-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389216, "uuid": "77053bb5-8b42-4f6e-8447-1561c9d0170d", "comment": "Malware payload (Mirai)", "value": "1029ab77e65bdcbb1e59ad81981d0343", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389216, "uuid": "a025f61a-eb5e-411e-9190-785208ffd8ba", "comment": "Malware payload (Mirai)", "value": "917e77c574ab71aea68ce35202d5d1447b883ad5f353aaa756cac4d6df793bb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389216, "uuid": "73eef6e7-ed6a-4ed2-a02f-d39027e23cef", "comment": "Malware payload (Mirai)", "value": "395b99c16d79545b18e29c524fe7f5ec2841517d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389216, "uuid": "190515a6-56c9-4bf0-a402-b20a77b17c55", "comment": "Malware payload (Mirai)", "value": "62028f904f9eb4f3f8b550279cbf80cfd2a013e1dc784f203d5b2a4b4cc467fbd8e9c08b025f792c41a701bd43c5ddda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389216, "uuid": "774a8374-ea04-46a1-aaca-8f3fd65d957a", "value": "T1A2B3D64E7F329F7CFBA8C23447B35A21A65923D227E1DA85D19CD6011E7024E681FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389216, "uuid": "72be2cd6-bd87-4e45-b3e4-9c725a7a2d72", "value": "1536:SkUa7xt8FyhmfltOhNE6evz6qPt9/vEXSiy7APk2PK6e/BdHZBNZ:sa7xRwN2E6eL6qPt93EXSiy7OkAKBZBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389216, "uuid": "f06f6f1a-f41c-49a2-bd81-0312e9dcfe8f", "value": 109760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389216, "uuid": "55290bae-0661-47c2-ab43-ac2b462a36b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389216, "uuid": "bd3c3eb7-610d-4ff9-bbcf-b4dfb1f17d9e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17500e36-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412944, "uuid": "5a99c3b4-de43-4362-bac4-f4043a547685", "comment": "Malware payload", "value": "fa3881ab42be7892a061ac15d84368a4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412944, "uuid": "0953a2bb-5dce-40f4-b33c-c8bbf310c244", "comment": "Malware payload", "value": "91e97f78d1700980e634f67d2abd46c65f315c49edf28de76263a9227bb443c3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412944, "uuid": "48b8088b-3322-4bed-84f1-f6f1f0b98ceb", "comment": "Malware payload", "value": "3957cad2a6ab72126916f454e7305f89d5a34a93", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412944, "uuid": "05f06b7b-326f-47ed-828b-ecf0d56a01a4", "comment": "Malware payload", "value": "04e94919dc4ea194955683c196f5ab11436db98d1bcde716517c656235b9dc5560dde03e218c4315e84bef12f0f3ae5f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412944, "uuid": "d1637d1d-0150-48c9-9f04-7a6d04aa549d", "value": "T1E3172346F748E96AC0F3A33786B55676600B5C658F03E6973919B33C19B3AE05A09FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412944, "uuid": "a6200ea4-cd36-45b2-aea2-e1317818269f", "value": "393216:Qp5A21NdpafnK/VhdPsTT2BmQ3QykDILNqooW+TtpvFv624roe:QpB1RIK/VhdP7pAyhqo1+L624rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412944, "uuid": "155ef3f8-9493-49ce-8040-2382d7252b46", "value": 20028355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412944, "uuid": "f3a6304f-980d-41fe-b49e-94ecceea343c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412944, "uuid": "43638ae2-07ae-4477-aa8c-a0631c398c23", "value": "BIMS.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d52d8e-cd25-11f0-a129-42010a9c0007", "comment": "Malware payload (Poseidon)", "timestamp": 1764421983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421983, "uuid": "96ff282d-11e5-4d3d-af80-da168fd5ba06", "comment": "Malware payload (Poseidon)", "value": "b638fd5abac43b2d763ead28eac9ac06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421983, "uuid": "6e0750e6-e3ff-43f8-b400-d6c1536dfa22", "comment": "Malware payload (Poseidon)", "value": "92054967598e5fb72431383cfbb4b295d42abbde1a2a3ab157326d12ed065218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421983, "uuid": "a591b985-0126-412d-bb79-d230b89f94ab", "comment": "Malware payload (Poseidon)", "value": "62d9e632572755c749778ee4a3d40dc08c97aba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421983, "uuid": "959da525-e092-4dfc-beaa-1d7375c0859a", "comment": "Malware payload (Poseidon)", "value": "08fe112f7c554e8b817c3fa02b36c834b75d197615aff58166a3012a7481b734fb260794f26c695da0455bfcb36a2292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421983, "uuid": "683c5cb4-ae41-4149-af77-fdf0c97f4d45", "value": "T11F373B53E8E22998C4AAC170D679816BBB727C091B7C23EB17A0F7301F367D06A76751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421983, "uuid": "1af0b9dc-6122-49e2-88ff-23f0787f04b7", "value": "196608:7+tdQTfRBQ2X+f2MC/wDnKen5u1RosATfDV5Vmg7w7rg7777777777777777777n:7IderxC2MCc5go5fDVQNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764421983, "uuid": "c39bce15-a1d7-49b7-9410-cdeb56f9509b", "value": 22741368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764421983, "uuid": "d3957af6-ecea-4879-b932-acdade66302c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421983, "uuid": "39537fc8-1a9a-41b5-98d3-41e52a994e43", "value": "poseidon-amd64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f474e0-ccc2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764379743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764379743, "uuid": "a6cf8f84-6813-40a8-9225-914da9162aaf", "comment": "Malware payload", "value": "0412998a40473fe146ffa1ba76d43ca2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764379743, "uuid": "34b82b47-e3d6-4ff7-a3d9-6a0ee943e795", "comment": "Malware payload", "value": "934794cbbc5d034b15af18416c1f13a0f94b2734181570dc96b497a5271d7451", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764379743, "uuid": "1db1de93-45ea-427c-939a-e142ec13bcec", "comment": "Malware payload", "value": "5162985baacc4f3e1e2352e7f0ea7dd4e2539a5e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764379743, "uuid": "43bba791-2715-48bd-bbb7-a87f0b8316dd", "comment": "Malware payload", "value": "bdb26a461c6eca8287d615f865279f9eb5ddbdf07fdef934ba4c477bd84bd0050a4cce37eda65512346bd867793b85d5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764379743, "uuid": "a31ac5c9-d20a-4d9e-aea0-a3d5b3db7a89", "value": "T17C5533056271C27DC31B61F1EB3A595CD88C65A2B3B966CF84E72B85431E9CA052BC3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764379743, "uuid": "70f37ba4-a779-4fab-9d21-70136b0ad63b", "value": "24576:c7d0mv45nyMNZLk9HaPtT4I2YIt+ETfH+JK70P+HrgZS43sp2FZPeX7YNPB:c7d0mm3O6PtsIgxvPY9S4cQzO76B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764379743, "uuid": "1ab52972-af44-405e-b092-3e8fde7ff865", "value": 1354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764379743, "uuid": "16d7b649-3a24-471f-9acc-60eae4156549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764379743, "uuid": "c3e4784e-b47a-46bf-88b8-376a3ac4328b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a447bfa1-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764392135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392135, "uuid": "a7f021e5-703e-4f34-9932-868522f0f61e", "comment": "Malware payload (Mirai)", "value": "5ec73dd57602ea8b15703ab3afb48f13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392135, "uuid": "a53e59a6-5fc7-4651-b63d-3b1902f7e603", "comment": "Malware payload (Mirai)", "value": "93c0bfa413b09bc191e8ce6df40662d43f83341b9b8c8f9fd1a256190edf47cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392135, "uuid": "6906e5e1-56b8-4c9a-ada2-dfc6bf8edb37", "comment": "Malware payload (Mirai)", "value": "6ce033bb111ae1210fab69a9c48e5b86e1674e85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392135, "uuid": "647da8c3-a1ec-4aa6-baa2-d89a5d675107", "comment": "Malware payload (Mirai)", "value": "5f2b455f39fd0abf318f3681e2eb08faf7b4186a655b8c813a1565c69f6ef035e5fe7a3efa1fa7649c3c8eca42948250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392135, "uuid": "11abc619-11e3-4723-9715-20515886f641", "value": "T136D2C0DFA5903DABD98E1DB98ACA176D494DF4E112C93B1E83054CC8E8242DFF89D066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392135, "uuid": "dbb1212c-ed0f-4ce3-b485-88499a39fa3e", "value": "768:YASmgU+JE+orXWXyumo2RenMIOdDlRCqWZUr:YAx+opufBOd3cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392135, "uuid": "c4add881-4865-464f-8358-8c69d352679b", "value": 28940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392135, "uuid": "ac414024-bb5e-4917-a6ab-10ca855046e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392135, "uuid": "8527d010-a1dd-4317-b33f-7736e2f0b485", "value": "niggah.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e98ce3-cd0a-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764410715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410715, "uuid": "36488693-2636-4091-af5a-a518ef39f650", "comment": "Malware payload (RemcosRAT)", "value": "f3ac9aa2975f5e55ed86db0786f542bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410715, "uuid": "886e5708-9cfb-4e49-a83a-10288ff7f034", "comment": "Malware payload (RemcosRAT)", "value": "94072c521ed25cefa4643b8b1e741d3bd068fe23e3a73063082fa6f0f89df49a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410715, "uuid": "25bdb555-3327-4e8a-9c15-cf7383b9516a", "comment": "Malware payload (RemcosRAT)", "value": "af16142dc2b655f02bf56b03e0223e33b18b2a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410715, "uuid": "71251190-fcf4-43fc-bbca-28be19ab35e7", "comment": "Malware payload (RemcosRAT)", "value": "b62d094ab3e87b03e2aafd9d59bcf6e8ea70ab871ef5c97c8391953d240d333a52c92b8ed286559152baf66ecf2fa911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410715, "uuid": "cc58f644-3c1c-4dd7-a14d-b3618716ecb8", "value": "T14575E162A1F18836D063D9B99C16D39A583DBEA02E75A85937EC3F484F351743C3A1B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410715, "uuid": "cdefed4c-245d-41d5-9302-9dd3650330a1", "value": "efb33267e9d4caa30cbc2bf74b0230b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410715, "uuid": "17489d6b-756b-4280-b58a-1ab9984350bd", "value": "24576:xvxxPbdE3o92sCO9OcgCB7FqyJXk7T9KO+TuvbIIskh+:xv/dE3olPqyJXkvDNIIskh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410715, "uuid": "bd9ca61e-d1ad-4af9-b200-87e9d3d404f1", "value": 1608192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410715, "uuid": "6ec4f930-40ae-4f16-a9f5-170433da74cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410715, "uuid": "e64613c4-fd1c-401f-a7e8-a8a652f95e4f", "value": "F3AC9AA2975F5E55ED86DB0786F542BC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436c046a-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764391972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391972, "uuid": "8ad026a6-1a8e-4890-b0cb-76d883ffbdb0", "comment": "Malware payload (Vidar)", "value": "0c402eccc896ee9466b740ddb34f7db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391972, "uuid": "c061a731-8265-4c91-acff-ea28ba887ee7", "comment": "Malware payload (Vidar)", "value": "950b012a360b165eb971da5acf5b1a17520ac9179cb8b4f955af5a1806d1e85b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391972, "uuid": "289962a2-f958-4e43-81d6-bd1a641904b3", "comment": "Malware payload (Vidar)", "value": "090bf5270e795ae2615ae0624cd76e412b96b482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391972, "uuid": "89d435e8-e9ed-4a8e-8379-bdf3afe27b49", "comment": "Malware payload (Vidar)", "value": "c4fbed9765c3782ac9bb5fb105ca6a269001b9372d3123923b0f20a5e092ed265c8100dbd6a7235f9413d48dbe9e42b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391972, "uuid": "8a7cb5f6-97a8-4bc9-a284-30ae6e361988", "value": "T190365C166D52CE88D49FE239A4657181B6787C080B713BC3AA80B6756E7F3C90F77B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391972, "uuid": "3840533c-ef77-46ed-8692-0e40b4d9deb5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391972, "uuid": "17847dcc-d846-48c5-9752-80c06c142994", "value": "49152:/yG0Cy0lahCq+jKGTSUqnFXAUeIqWWedibfUi4nlZQEDkXNCypVkalek9l5zBGCD:/odF+5YOfJq3LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391972, "uuid": "14976a76-b684-4e40-8091-8b849575435e", "value": 4973720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391972, "uuid": "4fe20179-a952-4ac6-bc7d-db35abd72321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391972, "uuid": "62845860-c8c4-4648-83d4-86a3d9ec0be9", "value": "epicranial_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28c56d3-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459617, "uuid": "cfb933af-43ca-40c0-a57c-b33331aad788", "comment": "Malware payload", "value": "f64c3110aa2d35a6ee4f0d4f45ae795e", "object_relation": "md5", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459617, "uuid": "ec9a2527-a7d5-4199-a895-374ecf630379", "comment": "Malware payload", "value": "967391c17d266db64d302a6c560eb869f898c98b7fa09314747eee0f9bb9f170", "object_relation": "sha256", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459617, "uuid": "2329dc0c-0fa4-4bc4-afeb-56b3a203f873", "comment": "Malware payload", "value": "59d016c9d6603bed648419859a69d9799e9e825c", "object_relation": "sha1", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459617, "uuid": "fe1ea3d5-f678-4fa8-b229-3d1df696b87a", "comment": "Malware payload", "value": "ce9f526efd829f1961110955f7ba9d734685191cb3cbf4b0f1259d996864d0d5568806d46dd4fbb43b5b4283fce83e47", "object_relation": "sha3-384", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459617, "uuid": "7df2d8c7-1623-4db0-ac57-4204e7790a54", "value": "T1CF47330CCBB88524E0AFDEBC10CB672AF7642659D732D31B4A9E19505D937E907E231B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459617, "uuid": "957e5fcb-5e6f-4a03-ae39-766c6d6a9de7", "value": "786432:AL12BlR++Nf5lN0MwrMwueVIEqOnjTRQZrsTl++NCS:AL12zRNNxlNLNYVnjT+ZiNNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459617, "uuid": "21af8d82-002c-4d87-a242-c52687c6abc4", "value": 26188065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459617, "uuid": "99c3fc14-99c4-459b-bd01-617855940502", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459617, "uuid": "b31502b1-b7fc-4b52-9ff5-264cf1640a33", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235b8ffc-cd13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764414252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414252, "uuid": "15256ff5-9395-4617-a4ba-ea647ae89e67", "comment": "Malware payload (Mirai)", "value": "befe72d69c03c0c7e340eb4cb7daa77e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414252, "uuid": "c473352b-0f51-4d5f-82e3-ce8075ea05e1", "comment": "Malware payload (Mirai)", "value": "975cc70d0547b967900ee85ca18bed773b2202e8e3290720455563c943226589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414252, "uuid": "f9b6d789-908b-4c2b-b303-f1d70be659c2", "comment": "Malware payload (Mirai)", "value": "ca22dac68410fc2890a6ec8dec9b4d608cd68eef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414252, "uuid": "f1b3796a-b479-404d-95e1-0b846355bf33", "comment": "Malware payload (Mirai)", "value": "1043b38f43fdc83932601660f74c95989feef02a3d6a57dc8dbebe66dd5be37be3e3237d96c3ed521bf62f15d7132fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414252, "uuid": "8cf63782-1d6e-4797-af6b-3b1ebc914c60", "value": "T1EF63945E2E728FEDF669863447B74E21A79833C622E1D784D2ACD1101F7034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414252, "uuid": "7c78987f-9ebd-4caa-bf50-1ea22645d523", "value": "768:kPfnQwKeI5pqADw5K/QVEl5shfvnrqLsqLECKjO7RLeOK1OpSkMV/f5wA2KHOLeA:kgwQ355qf+5TXaOKBPp2roexLtEhMeux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764414252, "uuid": "440a729c-4ad0-47bc-8d32-da26e7c3f093", "value": 72664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764414252, "uuid": "698ed49c-37aa-4647-9d44-eab165533db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414252, "uuid": "158d4855-9c5f-467d-8864-7c0b1d335ed6", "value": "niggah.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596123e0-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389862, "uuid": "554da723-54d0-4962-add6-7e3a333a1c81", "comment": "Malware payload (Mirai)", "value": "9b07d014fadd3b91e2fb3b9b025b06e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389862, "uuid": "6e912a03-420a-4169-9d3a-485ac4e7ae44", "comment": "Malware payload (Mirai)", "value": "97aa861cf408cc8ad8a49443c2b7bd15705ce0c1ee72e0674b476e418cfeccbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389862, "uuid": "901b13de-5612-4736-91dd-5f5027de0d3a", "comment": "Malware payload (Mirai)", "value": "29e1119ab852dd3ffd045f28b3ffd6278a8eac2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389862, "uuid": "627ccf4a-6c34-4ca2-a3cd-97d300c55d26", "comment": "Malware payload (Mirai)", "value": "a11f812806d3387b634c495a5edc7b606451e769e80210f4ea7d8568f7c3b8ba21029b24b7b94f04a05490aedf52bc96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389862, "uuid": "20b63f1c-ab95-4d03-a567-f78c6b6885d6", "value": "T1644302138DD8438FFEBFA2734D41DE4E1D92D34916A6985246E421E709A1B740F267E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389862, "uuid": "78999187-d8e2-494b-a78c-092638292878", "value": "1536:E6RBNaQCANEdtCRKTKZ3XPNTWBhjW1PBnouy8ty4:XR2QCFDwKTK9/NTWXWVhoutZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389862, "uuid": "bae17bf5-19ac-4ef3-9a0d-45a9a1e5b672", "value": 56192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389862, "uuid": "da403a02-fd12-49b3-85be-2bc6faab3e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389862, "uuid": "e951a09b-ac35-4bdd-9da1-8bba2cd21767", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290df38d-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764393217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393217, "uuid": "8ce7f24e-cff0-4318-b5b1-6ee78534676d", "comment": "Malware payload", "value": "a95401c49b18def287efcac4e2d37382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393217, "uuid": "b52f607e-217f-4464-9fb4-ac4221e5fb0d", "comment": "Malware payload", "value": "98084a37b8b8830dc07c2bdb0edfee5030af4e94bc776359d2632bf884acdc7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393217, "uuid": "5c54fd48-75ee-4287-8182-82f666968fa2", "comment": "Malware payload", "value": "b96caef8a3acac2b2b49186fa1fb01a2026bc35b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393217, "uuid": "d53b0476-d8d6-4434-8dd1-f790c1addc55", "comment": "Malware payload", "value": "ccb8053dec84ab44bda7d59ad634c173bd8ee0a7d9ea6beaa3b25d41b965c78cc7a2cd265fcf7bb1727287dbe0cdeccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393217, "uuid": "224b4da1-1a12-4aa7-bfaa-524e76cf2f16", "value": "T178B2D138F0E60C99FFBEDE669E11C9C29B801A0EAB5ECA4797C05B165747C3EB5046D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393217, "uuid": "c7382cd6-b87d-4412-89ad-d417eea5adc1", "value": "768:4P0iBWmVEQzIs4Yr/6r923NeT4uVcqgw09I:4PDBWmBIster929K4u+qgw09I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393217, "uuid": "5fb00044-7689-41c1-ac3d-41e752bf28aa", "value": 25512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393217, "uuid": "88c7693f-1b28-4e86-9e83-b5d96b338f58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393217, "uuid": "d3cc7aa4-e37e-41d4-852c-f334ef45111f", "value": "niggah.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc153b47-cd15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764415421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415421, "uuid": "362540ef-23ca-47d8-9f9c-912563b2f76a", "comment": "Malware payload (Mirai)", "value": "6af249d710b7654cedc836d799fd5cbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415421, "uuid": "2ad1fb5f-0a8b-4fff-a911-6e7e3d0cfcb1", "comment": "Malware payload (Mirai)", "value": "982ec9e31b4fd6adb3b587d667e5b44c293fb619c408377b6eea039b4096078a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415421, "uuid": "ba312e0c-8d7e-4840-91a4-12252515e4fc", "comment": "Malware payload (Mirai)", "value": "00c16c41c6f17ffbc5426dbdde21e30defe7bdd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415421, "uuid": "7c9b384c-cec9-45a0-b19e-89c6357d0cc6", "comment": "Malware payload (Mirai)", "value": "ff3363ec99d03b79aa58c13c96f782d5eb522a1954bcca86455923bcd158bdb9e85a35392efd37a80abe886d6e62d701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415421, "uuid": "37866676-4861-475d-869e-7b4d5d737617", "value": "T131B2D1F0688C990ADD06D3BAC38B9F1B18325CB8D37E3F69760DD686C4511BC497C865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415421, "uuid": "fdbb004f-c28d-4d3c-a5e5-797dbc345ac6", "value": "384:MWWVNu9QbaF2ZgINPQwuzyFvPJVGQVoYDqYOs/j0lDxMzLoSfG9nLv1RG:5Wq9Q9gG9vznoYDqI7+DxMz6zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764415421, "uuid": "887b62f6-9cf1-432e-ace6-f0470e7cff11", "value": 24016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764415421, "uuid": "fc0b2138-70b7-4380-8708-ffadb6171563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415421, "uuid": "6647a266-c492-4b84-b75a-e66779f45e67", "value": "niggah.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2600b9-cd25-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764422156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764422156, "uuid": "69a4eded-6e28-4eb8-9f81-cee7767f3d98", "comment": "Malware payload", "value": "98f30fd3fec5a7adaae3eb3843ac7678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764422156, "uuid": "2fb93e74-e65a-4ee7-9c1e-ad97ec939f16", "comment": "Malware payload", "value": "983f4ed6232cceca7d778e958205808d68f36f3e9239bcdf72c9e5e8dba01bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764422156, "uuid": "adb6a256-6977-451d-9465-5f68131275a2", "comment": "Malware payload", "value": "61cc805d056dbc02aeab9127bc9274af9230f9b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764422156, "uuid": "fbe23ac5-64ed-43d7-a9e5-44fc9cc557d6", "comment": "Malware payload", "value": "ac27114b6b3533b74b107dd230369304728eab16daf45e2f044a484a913115eefdb8d0040b2499561433b3d4ea8c09ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764422156, "uuid": "3b2d6e42-fb20-4d0c-837d-860aef742160", "value": "T136321A6597D4C236D97B1E3268B243B00776FA098CA7DF3E1584A11A5CB33518EE2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764422156, "uuid": "c00fb2f9-ed43-42a1-b9e8-236c4d9b3c6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764422156, "uuid": "3fa8d25f-8598-4214-be02-ec99d61696ae", "value": "192:awP5Ma9T+kq23z8brCvytzOIW1Pn/rjUDqJZHAkRjlHFL2Tpo:LhMaJ+kqY8bGvytzQn/6q3HnRBQTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764422156, "uuid": "22a1cf28-54c1-4256-ac2a-97f5dd14e95c", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764422156, "uuid": "5caca7fe-9fd7-442d-83cf-b7c514811c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764422156, "uuid": "4d9b16b6-458b-4682-a195-1fbdbb9516dc", "value": "actu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb9dd39-cd73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764455743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455743, "uuid": "f785e59a-94d9-42b8-8226-211a0b7e18d6", "comment": "Malware payload (Mirai)", "value": "c43b3ea221d2c1e2aeb37cc3cdde2908", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455743, "uuid": "e1e020ce-f619-49e1-a55c-a3a4c162ea48", "comment": "Malware payload (Mirai)", "value": "98842f5570f66caadb8afeaa5809c5b5f069213826d124ca93b5b2147085fe54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455743, "uuid": "291179fa-a774-4c03-95df-83c19f89dcbd", "comment": "Malware payload (Mirai)", "value": "7afe3f9c9365a43c69603ecea7d57c05c57d27da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455743, "uuid": "73583ec8-bb01-4c78-b382-0578a5793ca6", "comment": "Malware payload (Mirai)", "value": "48796360b0fb685115bd3e39340629f11f68311d077ca7e4c3fb2d1f5d9ab207a22737835e93550a1f039552e38c6c3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455743, "uuid": "e6c4e43f-2730-4ea3-bd03-eb26e9472aaf", "value": "T14DB37D21B4381E27C4E1947B22F74766F1F657D920A8CA1F7E720E8EFF256502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455743, "uuid": "f1177e96-12ca-4fe1-a44b-66c3f62bdc49", "value": "1536:RHIO8eULmvhQRTn7bn98OTgebNc9hf6aC9g+ZFMgF+XSyHtyf3Ym574chJRtwJed:NIEroMHf6BzF+iwY/YO8BLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764455743, "uuid": "5e3a3cf6-3f3c-4887-9871-2b716d250c05", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764455743, "uuid": "0e1ef5d6-8db9-428c-bf41-d62bd98544da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455743, "uuid": "d680ac07-f1ce-42d8-8416-dc98b98a6950", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacd9af8-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389220, "uuid": "c5b2f221-2cde-4a2b-8ff8-d366c235aba2", "comment": "Malware payload (Mirai)", "value": "297a39d01b107885556d7df1ca92a443", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389220, "uuid": "aaa1bb86-a249-4192-aa48-10e7de4e7e7e", "comment": "Malware payload (Mirai)", "value": "99066f4810edb78ec25d0f34bea81a887e37b27860063e58a2949320d676683b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389220, "uuid": "6658b1d1-0ffa-4a5f-a281-566a21e2a17b", "comment": "Malware payload (Mirai)", "value": "d18cd9cd1ddd1f8eccb2205b2914e294e0258786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389220, "uuid": "6c83e492-765d-42fc-b98a-6c4bfa09ec99", "comment": "Malware payload (Mirai)", "value": "111b38abb3794d5d1013053432502b59e3ea823b9fc595cd99a2bec02008bb782fb02226f166f3d00feac59fcf995a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389220, "uuid": "2c917068-f31c-47dc-ae0b-c3ffb068dc37", "value": "T108833AC1FE8BC1F5E91B88304076F23FCA32E96950B2875DDF5AAF36DA335415212299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389220, "uuid": "87897ce5-80f6-4bef-bed8-107446e4b4d4", "value": "1536:KKz1LffGPJL/Hcg9qkEyQbW4cjJTaoLEAQkfsaLO:KKRGJjHakEMRjJTaYE2LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389220, "uuid": "ef4ac068-9a61-499b-b18e-e3cf39dd007d", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389220, "uuid": "f4a85e55-62c6-4f30-aa74-0fe196682de6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389220, "uuid": "ec253286-2fab-48fe-bdca-e61465751108", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40341f6b-cd17-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764416019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416019, "uuid": "7f38d716-2438-4638-b556-93c689c5577d", "comment": "Malware payload (QuasarRAT)", "value": "dc86b286e7955e7f722ba5aa929d4fbe", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416019, "uuid": "2cc70bb5-4998-491b-bdb5-a614e3f4caf1", "comment": "Malware payload (QuasarRAT)", "value": "996acf933d23a9c88c904d16521dbd977de5a8a8c361bdc7956b6948b73d537a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416019, "uuid": "02938ce3-3d91-4901-aeee-76f864c5d960", "comment": "Malware payload (QuasarRAT)", "value": "bc433aaeac6f3e147547566c19a81f5290cbc4e0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416019, "uuid": "2642488b-329f-4caa-9fd4-b4a78086feaa", "comment": "Malware payload (QuasarRAT)", "value": "2a5f86ec8c70f077dc8f9b3e4977accc6ab0a5dd8e8318303642f486dc121434cd596de5a71623de94184f35d1a2d577", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416019, "uuid": "ef60ade7-c0e2-4beb-8576-c4b4059b8e4e", "value": "T1AB963312DF6E8DAF867C31EC14AF2E0F68748D004415E8F537E278CEAA9EE15165B079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416019, "uuid": "b1d08f0c-67b2-49e6-965e-cf439164c481", "value": "49152:Qo5pNnzgw3QvXvr/3KGjRIwIuyA6OC3/rPZi83Pp1/+FIc1Obem8XONGzrDFwf1w:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764416019, "uuid": "0786a90d-25c5-4658-9a6a-7482c3b7576b", "value": 9380157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764416019, "uuid": "2d8d5b15-1dc8-426b-920a-148b577eaa35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416019, "uuid": "57bb3ddd-9fdf-4076-a72b-483054f71678", "value": "syn.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede55773-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409868, "uuid": "246a0910-b741-43d4-9d30-e800997e26f7", "comment": "Malware payload (Mirai)", "value": "85ee41a97cef1b08c7638caebf4d6d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409868, "uuid": "be3121ad-4748-444f-bbae-99b2598bdbd4", "comment": "Malware payload (Mirai)", "value": "99925c0a55ca750a76cc3a0bc789ae9a1020733b964b7396e15ec159df8082c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409868, "uuid": "8a3bb169-c127-4ae7-89f5-bb4ac5803a36", "comment": "Malware payload (Mirai)", "value": "a02eab21b8ae349a604a8705d9377c8aae6ec259", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409868, "uuid": "3c2aa51c-2adc-41ef-a5e3-c014eb6ddbe3", "comment": "Malware payload (Mirai)", "value": "14e1ff701500c2573e67e47d10654e36d952e1406e5f9bf00b2e68d20ea8d04abf08d80c7cb1f580590e762e97c0c3a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409868, "uuid": "9fdd1488-ac78-4365-a38b-5da44153b444", "value": "T1FD730881B8824B6BC5D017BEA6AE668D33A163F5C3DF3227CA2117223BC550F5D67E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409868, "uuid": "ca895261-b4ed-4b81-8434-6d9071d7b040", "value": "1536:gWKxBjlX1BohZWf6hKCK+SyIHJ4bnuHErDqLsgHQ:pKxBTZ6DqxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409868, "uuid": "3988ac3e-d394-4fe7-9b1b-141d7a1c1a20", "value": 79792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409868, "uuid": "95bf235b-bbc3-4361-a92f-f34020b434ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409868, "uuid": "7e8e57a0-955c-41ff-8c61-1963a752ff58", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50a56e5-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409853, "uuid": "3244e4af-e3d1-40c2-a588-e23a4cb20e81", "comment": "Malware payload (Mirai)", "value": "898ed5fb9c302f43e4ba45f2db693982", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409853, "uuid": "1c46c668-3ea0-4d90-9b92-ada1392032f1", "comment": "Malware payload (Mirai)", "value": "999db512fbca3dd4f717807799c1ca6876e76de9062ca4de1c2856555e21f26c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409853, "uuid": "16e6f8d6-79e6-40ca-9d27-5ed620dd2d69", "comment": "Malware payload (Mirai)", "value": "cb3082c5dea7e41ee01159d6458e7e2249844867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409853, "uuid": "112d9d02-1c92-41b0-b79f-83532fa63e64", "comment": "Malware payload (Mirai)", "value": "277c8535c55343d104483e096410800b97aff85538aaafeefd40b52f187961f4853ff7a805e9bb5aff65239930c115e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409853, "uuid": "ed1d9f47-b713-4b20-8929-ce3edc3c0bc7", "value": "T194A32A13B9C19DFDC596C234072FB936E962F0DE0239F25F27D0EA12798EE211A5D984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409853, "uuid": "bea03a0d-a1f9-4032-96c6-2693bd6c799d", "value": "3072:dAFgCBeC1IvDo37rJSfs39o1r1NaDXFe7CxAqsrqRqy:yFxeC1IvDo37UfsIBYoCYr4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409853, "uuid": "31e146e2-e8c2-47de-9fe9-1161a192c457", "value": 107296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409853, "uuid": "ddc0d880-32b3-4fb0-b870-5cb8933a6618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409853, "uuid": "3936ffb0-f9ec-45d3-93ea-f7c14b5becce", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dfb0fd-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409849, "uuid": "6ca053f6-3d47-4596-bcf2-0bfd906f9e4b", "comment": "Malware payload (Mirai)", "value": "1bb92a73333b3230b3420190cca0aa90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409849, "uuid": "d4befd70-85d0-4c70-b158-f25615e1dc02", "comment": "Malware payload (Mirai)", "value": "9b10c48bad61fc3f6ef958b37b7e5b0da6a1455362ac1d4e6d90129958dc21b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409849, "uuid": "06212189-7c3d-4735-928a-c8074864909b", "comment": "Malware payload (Mirai)", "value": "5f9812a1f16aaf0206ec4f8440d40ceaa97b1ef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409849, "uuid": "3c722d11-d6d9-426b-a74b-3cbab5d8a434", "comment": "Malware payload (Mirai)", "value": "8e7ef38693f9de009bc2e03c651104dd731d5bf746e847651a602f05314237a32e24a918f1e89ef2bcb54d6ab03e27f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409849, "uuid": "9eb242f3-f78d-490f-aa3f-2ee7229897f8", "value": "T163D3C61E6F658F7DF365873047B78F26975927C226E1C542E2ACDA001E6038E245FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409849, "uuid": "8a33a04f-86ce-4ffd-b17f-507b01000c32", "value": "3072:Jdf9OUhBsowqs4vxnfypaT0h/qQa04bhOUZ3R8ZXyu/H/dobY3IsGSYjQOQBmS68:Jdf9OUhBsowqs4vxnfypaT0h/qQa04bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409849, "uuid": "ea1e5460-06ba-4cc5-ac1e-fc5c492aa4e9", "value": 141460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409849, "uuid": "c8d559ed-c1b3-4fc4-824a-69194d7a229b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409849, "uuid": "5f2da637-644d-4b19-838d-5d96263473a2", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f50d74-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412999, "uuid": "ea6bc911-c01e-4bbf-8bb1-84ed54fb612e", "comment": "Malware payload", "value": "3ed3d74cebe891949d0097723b3ed3b1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412999, "uuid": "36cd6066-7934-498f-a2a2-d11000fd7534", "comment": "Malware payload", "value": "9b7adffc9107a1222106f1af99cbf7f2c787a7ad2f4d988296a3dfea6cf92d5d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412999, "uuid": "d3f77208-c103-4576-89ec-724d351070f5", "comment": "Malware payload", "value": "01eb4ef1d48eb750c1f977b5deb2df5f60e53b7a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412999, "uuid": "8718d6f7-1646-4513-8302-3ef20fa6e446", "comment": "Malware payload", "value": "0ab9bc109a0091eb10dca925ef934266c924f81dda7dc6d4ce0235f3c80f64b64d5cb30cc90f02b156a859c75dcc2341", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412999, "uuid": "65c33ceb-a13f-4908-886d-a797f3ffbcbc", "value": "T13C26F09AF758AB2FC877403349EA923212974D178A939B436844321C7D776F80F9DBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412999, "uuid": "3f343926-c052-4a7d-931a-ab85f6829b70", "value": "98304:UK3UuAiI6LxNvUlsH5vGq0OEFJ0f3+idcDkydlPeT0iNd2ofr9Ur:UctJI6dNp5+q0DFJo3++ydlPeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412999, "uuid": "1825a6f9-a89b-4990-87f7-4ad994559bf4", "value": 4424971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412999, "uuid": "6f67e8ba-dc93-497f-8982-5ca0b5592409", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412999, "uuid": "d8b557cd-3e25-463e-b96c-1f00c6572f2e", "value": "rajatoto1_1.1.5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351cf465-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764412994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412994, "uuid": "057971db-b6f9-4c26-b52b-d3043f78fed2", "comment": "Malware payload (Gafgyt)", "value": "12951e2ede933b6e21f4dbe263cb87b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412994, "uuid": "b9c47c70-693f-452f-ba1d-14bf45648def", "comment": "Malware payload (Gafgyt)", "value": "9bab632d2e71e7dcf14350752a2072c346cf526c762323385b22d710eec015ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412994, "uuid": "2c6a7fc9-710b-4f1c-a783-7ece7eaeb013", "comment": "Malware payload (Gafgyt)", "value": "230e4e311f1465028d335f61e1225b3a7a0a93b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412994, "uuid": "3da9e68e-10cc-4242-ac4e-6dd2e0244350", "comment": "Malware payload (Gafgyt)", "value": "c667b5f316e23ebf30b9b25dc35155973e4bc479c4caa740843f60e659295568205420ce2cbf885242fb9f8d45a89354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412994, "uuid": "f6390064-c4a5-4ee1-a80a-71462c9359ca", "value": "T10FE30B06EF510EFBD8AFCE3701AD0B4735CDA55712A53B793238D928BA0964B4AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412994, "uuid": "690eed41-bf0c-4ea4-946c-d076ca278fc8", "value": "3072:IjgNmGvkj2oQCEcTvwHIU5HLAH2zSdqB8LxEI0smSlGrF:Iamokj6FNZDzdB8LxqsjGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412994, "uuid": "3ebb1fa4-4545-4b10-ad4e-05d75d996a18", "value": 155348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412994, "uuid": "5ffc2c84-f23e-4f02-a7f7-503581715623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412994, "uuid": "d13386fa-338e-4bfd-a54d-4f3b8a7cc596", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c69b242-cd17-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764416147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416147, "uuid": "c780c505-de32-475f-aef9-a0af9d395974", "comment": "Malware payload (Mirai)", "value": "b1359155329bd79b44de7ff452cd27fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416147, "uuid": "a772755d-df05-4c8c-b08f-c1645cf2c36c", "comment": "Malware payload (Mirai)", "value": "9be32aecdc874cbf8c63a5cf23251278356ea7570bf6bf8965079f9f52398459", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416147, "uuid": "8d2ba728-4814-4af3-88e0-32e2e0fafa89", "comment": "Malware payload (Mirai)", "value": "54ea5d54eaef20b7b484fd59512714bcbbe53880", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416147, "uuid": "8d39bad8-e284-4a76-87f0-783e90a1b0d3", "comment": "Malware payload (Mirai)", "value": "a2a77cb184ef49461b6cc46860b354a4c50e92e806975168362ac99df54b80f3a822d5226e74abefc324cfd2a60ce3af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416147, "uuid": "5e5ab789-a429-4961-b1ac-220f4da2a023", "value": "T151934B52BD81DA12C5D06277FB1E424D7B2753F8D3EB32039D25AF21328A92B0E7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416147, "uuid": "f40259a6-d957-4cb0-bf07-2ad288fac9b8", "value": "1536:dpDGvzs6F13XNlHHOtifc1SMwQ8dyPPIT2p/KOghehzGAHQ98Zi9CemR:dpDGA6b3HHHOtV1fwQ8oHITALHU8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764416147, "uuid": "8a3dae99-207c-4207-8d2b-b95d16ee437b", "value": 96120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764416147, "uuid": "ddc2869f-8ec1-4f37-8ba4-5e6a6c7aa157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416147, "uuid": "caf85031-3d80-4973-a3a8-83a5ebdcfe0f", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378f2c5f-cd05-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1764408273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408273, "uuid": "b0c79e70-48ec-49e5-b01e-99723b2a869d", "comment": "Malware payload (Ngioweb)", "value": "6cda3a47aa249f3dc0d2614f13d08b8c", "object_relation": "md5", "Tag": [ { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408273, "uuid": "82fb6195-fdb8-4d0f-b07b-aca5080cf9ee", "comment": "Malware payload (Ngioweb)", "value": "9c7dff06484f204414d37b0d661ddf6f74af2a060c13ef1d3e0146a33d660044", "object_relation": "sha256", "Tag": [ { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408273, "uuid": "daa526f1-6988-429b-96ff-dbd85c0c687a", "comment": "Malware payload (Ngioweb)", "value": "74a9415385da800770ac768764f3dddc542d5578", "object_relation": "sha1", "Tag": [ { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764408273, "uuid": "374d339f-30de-441d-9201-d631833a197d", "comment": "Malware payload (Ngioweb)", "value": "a7f0dc189c468d3645a92e87406919d1ff32b753d54e7f6696f512e9dd02206314b350e8f5852f53d2d32f05a6fa9a3d", "object_relation": "sha3-384", "Tag": [ { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408273, "uuid": "c035d888-6066-428b-874e-8b79be29d4ec", "value": "T1B3F027CD91A2DC3258934DEBB126961AACC6C5CA1BC64EC474CD00BBE08CD0470A6EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408273, "uuid": "3c95200d-ccd4-430a-8d6f-b411c348957a", "value": "6:ebw73w5/KDbA4PZ9wWLZA9shGo94RNAcs2rFLf+03B0bUeEZuKj6y1bmhS:3WKDbnPZ95ZMoOF7+MB0LEZuKGy1KhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764408273, "uuid": "4d55fec9-b38f-4ac0-84f0-7006f97397a2", "value": 459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764408273, "uuid": "28bd60e5-4bba-4d1f-af68-9cac89a156df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764408273, "uuid": "fceb83b6-ef75-4dc4-88fc-3813942c20f2", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272fe1b8-ccdb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764390207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390207, "uuid": "59c0beb1-68dc-4e63-ba73-2140fe7e85d7", "comment": "Malware payload (Mirai)", "value": "738aa8053bb3cd71df302d99b2a8dc9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390207, "uuid": "dbb22936-b67b-457f-98d9-c4f606b30845", "comment": "Malware payload (Mirai)", "value": "9d1718bd60616b43e1f66507cc093c613ebae2f02a195df318872698f96f40be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390207, "uuid": "538e70fd-3e92-4f51-bf29-7e1f266007eb", "comment": "Malware payload (Mirai)", "value": "575700ed6ff97a67bdb14a3831e4c50b584ef4b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390207, "uuid": "3d310798-ee53-4606-8ae6-920c7c782de7", "comment": "Malware payload (Mirai)", "value": "858fd6e5c2fab25786587e24e24e4d0eef01254ca872fa06d3d54f700c4fa885712e5c7b381d26d290aa1826d85ac760", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390207, "uuid": "d9bc95ab-aa01-4afe-9e2b-1853efbbf9ba", "value": "T1E913638CF86A673EC3E276FFE79953DE227A07C8678BB616C235425537CC3086921914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390207, "uuid": "26089e48-3361-4737-b66d-13f8ca08b3c8", "value": "768:UOsecKhECRpQhKcptV73fOsh/glwOHbm4pJTdk2zjkcV4HHHHHHHFT9:lxcMECRSIEz2sh/I76kldNkIYnnnFT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764390207, "uuid": "0cfc6f3a-98c9-4624-96ed-93a55c3eaa01", "value": 43159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764390207, "uuid": "98940b36-7fa9-420e-8043-a6ce53412c63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390207, "uuid": "be32fb17-1b0c-47c3-928e-35494cb52448", "value": "SecuriteInfo.com.Linux.Siggen.9999.19078.8232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edf098b-ccdb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764390166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390166, "uuid": "d8921ebf-c175-4507-806d-df5a41d39ab0", "comment": "Malware payload (Mirai)", "value": "134fe363c4cfe8d6c7a0769ecc40ca9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390166, "uuid": "89638fc8-4d72-427d-afb0-df9410ddefb0", "comment": "Malware payload (Mirai)", "value": "9d475579aa0e59292fc4934ecfc55e2e0ea7378f48c71427b13b9e926003ed2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390166, "uuid": "2b7d27ed-879a-4130-a27b-52647626bd88", "comment": "Malware payload (Mirai)", "value": "dbe7536be342d1770345f5553737bfd4ed294ecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390166, "uuid": "a85164bd-d6ae-48fd-9d11-bf956940ba3f", "comment": "Malware payload (Mirai)", "value": "85bc16dc5ca3661f129fe2d3452db485deb871ce3577b61f586a48425a33755658266e13d47b578a07865f26d91ff2a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390166, "uuid": "cc7d7a24-81ea-439d-93a4-d4ed1e72ce06", "value": "T1D862C070960A3AD1C5705CB4F27E0A8AACA50A7CD07B3453239683B835C06DBBFF5947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390166, "uuid": "2e026d8c-3803-4bf6-ae62-1fa36ae3e89a", "value": "384:ugOhFJgzfNt+qhldinwYbd+Uh7qmdGUEpiaqkkD:Gqzf3f6wg+U9q3UELqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764390166, "uuid": "3840fd27-e8c0-405e-8093-5d3654b14dfd", "value": 15832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764390166, "uuid": "ca6ebe63-d435-4513-b91a-6d3ee1d96880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390166, "uuid": "a9b72d9e-f123-4774-8735-b7d0ffde8640", "value": "SecuriteInfo.com.Linux.Siggen.9999.19078.8232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fa9d37-cce9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764396245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764396245, "uuid": "626326e8-c061-4bb2-bf84-e1b548c3a3f1", "comment": "Malware payload (Mirai)", "value": "a112d1a4f1d5a9537db1069452be8018", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764396245, "uuid": "e3042c0d-3c4e-477f-aedd-2d51359eca5c", "comment": "Malware payload (Mirai)", "value": "9e0535b2bee4dee7d6c1cd2b53c810571cb307d27262595d47da46ec5110751b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764396245, "uuid": "10171d67-e933-4d73-a133-67fb72a63c33", "comment": "Malware payload (Mirai)", "value": "385954a845264b5df94ef8ad6fcd6cf07859870f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764396245, "uuid": "a69fc3a9-ba71-4ff7-8fed-2f18fc0e5f6c", "comment": "Malware payload (Mirai)", "value": "efacd44ae9f4b4d5c751e1e5a6677fa951af806d18dda4fb2b1d83ebccc25f94078516b453e79dd6392fb1502348b498", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764396245, "uuid": "74337cf9-6d5b-48d6-a077-6ed4e9d350a7", "value": "T10D935A06FAC1D4FCC89AC239565FA176C972F42D1232762B57C0FB267C8EA206F2E554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764396245, "uuid": "83c576d6-5474-4505-b572-6208b8559d82", "value": "1536:AbU6+rr4FT8eUHfiSDxM1SAxTFBvHLJf0GixCCPov:C+rRtqSu1dxTf9f0bFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764396245, "uuid": "171f1cfd-7402-4edc-9b2b-7d00b6a69208", "value": 90128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764396245, "uuid": "49ddc950-312b-4059-a7c9-31f1d6b6556c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764396245, "uuid": "6b29869e-9ad9-465a-93f3-6181c9ccac43", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3494e37-cced-11f0-a129-42010a9c0007", "comment": "Malware payload (Havoc)", "timestamp": 1764398200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398200, "uuid": "33475bb8-3c1c-46a8-b58b-76bd30ac41a8", "comment": "Malware payload (Havoc)", "value": "abc1a4bf260971113464d7fe5b6190e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398200, "uuid": "8d3386ae-588b-49e2-ad1d-ff8770f2b5e1", "comment": "Malware payload (Havoc)", "value": "9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398200, "uuid": "02c021c4-cd38-4057-8fd0-0169d4978363", "comment": "Malware payload (Havoc)", "value": "3167e0abfad23a47fd3885970314818137ac08ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398200, "uuid": "434cb283-b653-4ae9-ab49-1587eba40c0f", "comment": "Malware payload (Havoc)", "value": "129f24f0d4082d61f5a492edfa51fe992063c69cd6cfb6a7ab7e3832e2334f635843b2b50a6f1796e0f8ce35c5114c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398200, "uuid": "a841e0d2-d3ca-4d94-b753-2dea2ddc5a71", "value": "T155C56D57FC9219A7C0AAA231896661827B71BC153F3223DB2E50B37C3F72BD05A79711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398200, "uuid": "29e823c8-febd-464b-ae5b-b3470995b197", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398200, "uuid": "cda3d86d-b285-4b6d-bc8b-be4d8b19f2d5", "value": "24576:jA5xDNPlkBEFhtDhoUFo91x0Z1jJ/5Wj4ElO9LWdbbVkGnWRDL/j15BZ+rVi2:jArNPlNhtDvKiZ1NkjFh+DP6Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764398200, "uuid": "83a9d2d6-b6fb-47b2-a8fc-5b050c729331", "value": 2541792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764398200, "uuid": "fbca9e67-f9c6-467e-910f-433fafe2ae95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398200, "uuid": "4b13df15-a377-46dc-9973-13bc1059675f", "value": "SecuriteInfo.com.Win64.Evo-gen.24351261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3514364-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409770, "uuid": "de3d0941-1421-4e80-9f8a-30d283dfbdd9", "comment": "Malware payload (Mirai)", "value": "da38ab8ab1119192f601dbf198d6a475", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409770, "uuid": "a44718e2-743f-4b08-b673-b258ef082d2f", "comment": "Malware payload (Mirai)", "value": "9ea1de77d5fd14c7a9d827bc542aa53f4fbc051db3542436b420eaa9fd611883", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409770, "uuid": "d39fbba0-ed0a-4fc7-83b2-5c344df1641e", "comment": "Malware payload (Mirai)", "value": "8541e90f3ba4d3e3832a3ffb47c7f14e48e6af07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409770, "uuid": "d4ea4a3e-4f3e-4446-94f2-3dbfb1164ebb", "comment": "Malware payload (Mirai)", "value": "f9508f59eb446a3cb710464a18ec93c3957f611256471175637fd512ac36e215ab8bcbb1ef0e63442aff9729716ab2c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409770, "uuid": "0dfb295e-9be0-4f43-b5d0-62f4e47e9506", "value": "T1F113F19780785DB4DEBED8E607888BD5EF3D6F879A25824290D3AB200D4D1357359CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409770, "uuid": "8c491020-f8bb-4ab3-b33c-af527ec4d907", "value": "768:Ng67Y9HM04D4s7khWdEnwq1+e/pGftQIWI4uVcqgw097oE:2EC4k7WdEnwU+8xXI4u+qgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409770, "uuid": "389eeeaf-8829-43da-8acb-7b791cf82495", "value": 44072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409770, "uuid": "f198a57d-316d-4b6a-8591-01d9ebd47194", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409770, "uuid": "90073792-fa13-43ef-bae3-5f5a0d716651", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24175cd3-cd19-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764416831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416831, "uuid": "4f0bb3e3-e73b-4f35-9790-4ea607729884", "comment": "Malware payload (AsyncRAT)", "value": "ec0659799a60c1cd24dd39c7a50c395a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416831, "uuid": "0290128e-66c9-40ba-abbb-c30b3b679eae", "comment": "Malware payload (AsyncRAT)", "value": "9ec48ed73297b001e892717972fe5e792bc7c593d89d87089a5e652c5dcaf935", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416831, "uuid": "9c642b3e-4f43-4b7c-94f1-b8adbbb5eaf4", "comment": "Malware payload (AsyncRAT)", "value": "7efed855536c9d2af4c1f3fd3080f389b399fc87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764416831, "uuid": "eb67b105-cfef-43f3-924a-92d4a6a39919", "comment": "Malware payload (AsyncRAT)", "value": "1ec4297d1f581dfed6240e88c6d398ab52d150085288e3308c33f6f46a80c5e551bb153104a806e6f41420d74e8a437a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416831, "uuid": "f51343b8-25d3-4a92-aaed-91d0966b8ba1", "value": "T143733B2C2FB78A11E35D4674ACA3A50707B0C5372849C61E3C947CC7DF6AAC585A26EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416831, "uuid": "905ed3e3-576c-49fd-a187-67b9f1f24fcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416831, "uuid": "7c61d53b-27e8-41ba-86fd-cbab23449c40", "value": "1536:EAEuRjFGqTYUbLh98LnFXFubfJeNpqKmY7:EsLGQYUbLUnAeWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764416831, "uuid": "529fd418-53c9-45c4-953f-57b3444f4569", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764416831, "uuid": "27a530ef-2047-4a37-b0d8-2181101c8827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764416831, "uuid": "77f59392-5ca8-4187-9b44-ec2017879496", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a77b70-ccb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764374769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374769, "uuid": "5b61800a-9b42-47cf-b32c-223be6d2269d", "comment": "Malware payload (Mirai)", "value": "1812bf8049784fc48a97ab71910d02b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374769, "uuid": "93a1214a-1b9c-4856-99a6-615a8aa6f8ad", "comment": "Malware payload (Mirai)", "value": "9f83ebf469c37358701346fb32ee88ca9c0ca6b4c01fc73f512cffc8469fa5c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374769, "uuid": "2da91530-d4ba-4afa-b3a9-54c0e57cb13d", "comment": "Malware payload (Mirai)", "value": "eff88527c57534a238be90792c6478c79fb2a912", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374769, "uuid": "8972bf16-7548-468a-b240-76fea3f839da", "comment": "Malware payload (Mirai)", "value": "9f7d5b71fd545eb6ef535b27dae9a0eecc62c93f325a898f67f8cba63c22e07792e63078a2a7dbf6a03a21704041a0c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374769, "uuid": "6de0e1b5-4f2e-416a-a1c7-48714353cae9", "value": "T1F5F38D22C9656EA8C125C974F035EE396B539EA641871FBE1997CB718043DCCFA063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374769, "uuid": "f4c979f3-9dee-43fc-a9c4-6ba2f16b1057", "value": "3072:h9+B3UsqNnee0PI65ya28Suua9NsrwQG6oSW2pQ3huE:h9cMUDy5uua9CWXf24huE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764374769, "uuid": "35c79585-e465-4547-be58-2fa8173ef1f8", "value": 159044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764374769, "uuid": "c825be01-2f2b-48f1-9771-4ae9c909c57c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374769, "uuid": "a83ecf16-68f3-4da0-bfe8-9f4b296f431a", "value": "Polar.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a5417f-cd1c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764418358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764418358, "uuid": "a7d4249c-f2b1-4322-9c1e-ae4c970f0e4f", "comment": "Malware payload (RemcosRAT)", "value": "e00891b43db9e4acedebcadb089f8927", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764418358, "uuid": "fab4d9a6-73e9-4a27-b8f8-933fe1a17139", "comment": "Malware payload (RemcosRAT)", "value": "9f84bbd8179674ee35fd11e94435df0c49c81bb5ca44c2f5ad4b5bec53f0ab35", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764418358, "uuid": "b501d677-bdce-45f8-a454-e87ce061abbb", "comment": "Malware payload (RemcosRAT)", "value": "1cbcc21567d99985b6dd13f75c4d0f24782ec2a8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764418358, "uuid": "ef5d7403-c10f-423d-a7b0-5dd518b64a30", "comment": "Malware payload (RemcosRAT)", "value": "0111b9140125666b84043614319e20ac81dd77505080bba0f09ea41fb8f067a3bc450e363d26397754154682a5e68f8b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764418358, "uuid": "1daafad9-5e8f-4112-b249-58fa22fccfb0", "value": "T178263303117DE4996B837B2464F31E3F31274B93A870E6AEDFEA44E1DB8811391A5367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764418358, "uuid": "fc5c7485-1d4e-49f0-90b4-2bf586b2e7be", "value": "98304:Z8aFSHP97m78U7LV1RFhTBc1QMgvGeXvd1e4StbXcuvvE3TSa0U3BQOSA:Z8GSvo5F1RjBOQhvfe4GbXcuv8jSVIyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764418358, "uuid": "9f635380-a10e-4e3a-adb4-06145acba7bb", "value": 4746100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764418358, "uuid": "b84d3850-1010-4d5c-908e-8597846e2ee1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764418358, "uuid": "b93627d9-464d-4f5d-b276-677ed2633226", "value": "SyAlpha16.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f8b66c-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389450, "uuid": "a5a66237-ba00-41e6-8fb2-aae4e2434ad3", "comment": "Malware payload (AsyncRAT)", "value": "8214affa9ecf95a6aeb6b6b167ac1b72", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389450, "uuid": "b99fb71c-5925-4ad3-8691-adc836cd6b01", "comment": "Malware payload (AsyncRAT)", "value": "a1682a14947f3d0f0cd6ea59a5dcaa927e5a5ddddf7fe0ad8cdb07c388d76008", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389450, "uuid": "c449669d-0feb-4093-a210-f4a5afbf4b18", "comment": "Malware payload (AsyncRAT)", "value": "8335a0f043a929e51a7885850732e2833c50d719", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389450, "uuid": "f799d1c3-ed34-4dff-8db5-f0ce145e68fd", "comment": "Malware payload (AsyncRAT)", "value": "5d0a85753d79a7210fc173b698a26617326d17072c9a660aff2f9c266673e0f35e0519929ae6705910d53fdd0f9e4703", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389450, "uuid": "257415a4-fa10-44dd-b644-0bba0fa1e65f", "value": "T155948C16F75408FDD49BC574899245469A39BC8F1B72EAEF17C8422A2F237F08E39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389450, "uuid": "5776ed85-f2f0-4a19-9256-946c1e00c43c", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389450, "uuid": "e32f9a8b-fbbc-446c-9bde-4254b8d164ee", "value": "6144:G+GYnA0zeWsDi5eJziQ8kV3f+RysMFZzN/E/msHOtb6ih8sNrww:qYyDi5eNiQ7uysMFZzN/E/msuF31t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389450, "uuid": "621f6faf-f329-481d-9487-d8949fb9391c", "value": 416140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389450, "uuid": "605a0b2d-b9f9-4f83-8a99-3e2834955970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389450, "uuid": "3ee5cf1e-338a-412c-b71c-5a9d3e81fe58", "value": "ahzbx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34eef556-ccb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764374768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374768, "uuid": "c070450b-fdf7-4383-811b-cd2e4623e652", "comment": "Malware payload (Mirai)", "value": "9a2bedef729936e603b6f539d7a9d75d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374768, "uuid": "1d7808ce-960d-48e7-b3a7-189476d15640", "comment": "Malware payload (Mirai)", "value": "a2404815a9f3501b29a67966be8c22e94090c4e663c95889c7acaf183687854a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374768, "uuid": "9a9e0aa8-298a-462d-b847-8008319c45e4", "comment": "Malware payload (Mirai)", "value": "df45edc07ee305b64e7b890bc0c536ec47b5d9b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374768, "uuid": "460cc4b7-f067-4a7e-baa7-0459a88268d3", "comment": "Malware payload (Mirai)", "value": "e2a1c15c1399489810261b0e4ef353a36830f688a65435462591de0bbeafac96845f1cd450ee950930d0d4250fe68e92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374768, "uuid": "f3a0eaf7-dc28-4a3c-9c4e-88c8bfa0cb9c", "value": "T18673017CB1609889D6F8CE7CDB8A4D426A5035D60568AFEB5F074CD4BBB460EFA4B034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374768, "uuid": "775a50db-f285-43e0-90fd-b2ab8eaf947a", "value": "1536:HYrjdCxSMLzrTlCG0kzUSYqaXiP5QWhZWwh2xuye4a/0nTmmHTDmSrU4R/t:4PdQX/r0GPz4FS1hZWwhd7/gTmmvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764374768, "uuid": "15a5ed72-d738-41bb-982a-6e8c2f9fe5b7", "value": 73936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764374768, "uuid": "08a88f0b-a562-427c-8623-9cf39e1c2755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374768, "uuid": "2a5e66d0-30a4-43f3-9a9b-f806aaab9288", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609b1d89-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389444, "uuid": "612ceeef-8b6a-4381-a2f5-c94e43117e79", "comment": "Malware payload (AsyncRAT)", "value": "10772936db74d8871f828ba83497890c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389444, "uuid": "8f895b0a-e093-47d2-9be6-ab6bea6adaf9", "comment": "Malware payload (AsyncRAT)", "value": "a2c79ed9e8c6f6f143182b72bc6524c8d62a7af1efb6973af5ece46fac88eb5a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389444, "uuid": "d3c4a7d6-04bf-4c97-9b2f-c83c1453e153", "comment": "Malware payload (AsyncRAT)", "value": "f1181dbc0a9134dfdda43dbacd498eb89aba002a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389444, "uuid": "09004d8f-9138-4237-9f3e-a49f35c1e1f3", "comment": "Malware payload (AsyncRAT)", "value": "22df03e834a4583d31d946b5693612720195bb9026094fde55b200d7eddbf55880b85deb679962a474d1bb27249e754e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389444, "uuid": "0db57e43-4f08-4ba1-8b35-02d7d1cef473", "value": "T18D947C16F79408FDD497C57489924546DA397C8E1B71EEEF1798422A2F237F08E39B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389444, "uuid": "6a997584-0121-4a6e-839f-0f9c144a643a", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389444, "uuid": "fe9f4ac8-e92c-4010-9f60-d8bd7970cf92", "value": "6144:P+GYnA0zeWiDi5eJHQ8kV3f+RysMFZzN/EOtbMrtE8sNrwY:/YkDi5eJQ7uysMFZzN/dmBm11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389444, "uuid": "9fe0e4cb-ea3c-4640-9b31-3d816426ad78", "value": 416140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389444, "uuid": "c47fa75a-1f19-415d-82ea-dc6d2ea51f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389444, "uuid": "87454def-62a2-4b8f-9e0f-3ce553dcb8cd", "value": "37xk8o44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cbd9bb-cd50-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764440567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764440567, "uuid": "04cf7b24-b955-493b-83d3-6405ffb729c8", "comment": "Malware payload (AsyncRAT)", "value": "e2c8813a45be0ad0665599f8749b8432", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764440567, "uuid": "534a21a5-19e1-48b0-b02b-78328e5da3a0", "comment": "Malware payload (AsyncRAT)", "value": "a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764440567, "uuid": "b363aa96-ff45-444a-a2f3-b6d15b279deb", "comment": "Malware payload (AsyncRAT)", "value": "eb4b03f15d948e410e421d29f2d37238c8e557c8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764440567, "uuid": "df86482c-962d-479d-9d86-e35025359eab", "comment": "Malware payload (AsyncRAT)", "value": "9e5715af37ed53ebb9d1aef5d7f2c4bae7b51099ef087698c33f5907570d5f541c41a41330ed9e34fdc159df7b683ce3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hostphpwindowsapps-ydns-eu", "colour": "#CB2B53", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764440567, "uuid": "384355a1-1672-43b0-9696-601660a546ae", "value": "T1FC560328F5859416AC77A77F5EB52818F10C3B2F982249F934068BDB87740FD4A28E7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764440567, "uuid": "1bdb1275-a944-4787-b938-27f8de45632f", "value": "192:41n/B8FczE9O9qOJCO1zE9OS7xZRsJE3Hc2JETRbJ9WqSM+a:jMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764440567, "uuid": "70f00db4-d149-4f7b-8a47-0edcc7edb8a2", "value": 6290792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764440567, "uuid": "ad4c2d1e-b65b-4082-abf8-551218209b79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764440567, "uuid": "2e79cda4-8054-43b3-ad65-4aca1d9ac2fb", "value": "Winlogon.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91a3e02-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409860, "uuid": "be9a6737-1636-4d17-9815-28cd3d507bd7", "comment": "Malware payload (Mirai)", "value": "db1984dd9fd5beeddb16bcec79c435f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409860, "uuid": "f7b7ff8b-9d73-448d-99e7-8e131d33ff00", "comment": "Malware payload (Mirai)", "value": "a4d2208b2412de62f8c93ceef99018506d814e76b6baa2a06f4189de8e9e7476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409860, "uuid": "f2313a2f-4df8-4a99-8da7-b297ee5382a7", "comment": "Malware payload (Mirai)", "value": "f6399892e7841a1642ea2a4957d5929688342804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409860, "uuid": "069708de-d5db-4001-88ef-1a580f66bf35", "comment": "Malware payload (Mirai)", "value": "aa4654c42809fcbaf357fa1be7e6ff8b2d1b5965bc10e406cd15052b1dbe5cf009f9f69a238fcfbf0e5904054cd3668d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409860, "uuid": "69e6b035-39b2-4080-a053-bd0ab08ea655", "value": "T1E8732A57BA4180FEC499C03843BEBA36D87274FE1379729A13D8FE366D56E601E28C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409860, "uuid": "f1f7486c-352a-4d69-87e6-cfce6d4f036c", "value": "1536:BzIDxEwvZ8b7RRINkGIb/+w4HnC+8l8AnzcUj:BUxEyZKDIWGIf4HT8l8AzcUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409860, "uuid": "b979f617-8045-4ca8-a4b0-8c3b8c5e7314", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409860, "uuid": "c85e0c3a-5c7a-403d-86ca-8c03fab967d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409860, "uuid": "85323434-1548-4d58-8f24-c71387095ddb", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6e8c1a-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459419, "uuid": "77d6255b-77fe-4519-979e-bf034b52d6a8", "comment": "Malware payload", "value": "3c52110f109940fab0d201d563f3c5a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459419, "uuid": "2741aa10-a6f6-414f-9f01-7e859632d3ad", "comment": "Malware payload", "value": "a5369ff0e7e57304deb9280c49ecf1c466d472e5bc7deafa5f27a6db4e8c4dcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459419, "uuid": "79854f3b-2798-4d23-a6a9-aa4a594ea669", "comment": "Malware payload", "value": "264cd3e08ba79817c109eee459a3f692d26f3fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459419, "uuid": "9dae0c85-e845-4fb6-b325-c91782216603", "comment": "Malware payload", "value": "cdec88471a1116efcadd271b6672c568b260c08cf4790a348de4f4989aded4818fa63af377ee2a1271249b833d9b7485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459419, "uuid": "25f07486-978a-4851-a39d-4476d6a5f7b2", "value": "T1B207339E5A139D37D07D03F578C460317612C2B02943EAAE30E5FDAB56834385DA9AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459419, "uuid": "e0791cb8-fd33-48f0-85b8-139118548ad5", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459419, "uuid": "c0108c5c-d99d-434f-aa72-893670d00a9e", "value": "393216:Mb73aBDGk8skufVQIVsT/kHu+Py5yXDnVeyKcWduLsQE7ebWpOMlZdfLZv:MPUDBnkMQI88O+rVmtaC8ETZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459419, "uuid": "ba0489f8-ab97-431b-9e1d-8ef911e60961", "value": 18208768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459419, "uuid": "a270cd53-4053-4291-bb01-d2c2beac0c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459419, "uuid": "4f2f4f6e-7813-4169-800f-a37007b14785", "value": "Installer_v3927_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb9d66b-ccb8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764375372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764375372, "uuid": "71f1edb7-58f6-4a26-a0c9-8de915927390", "comment": "Malware payload (Mirai)", "value": "694df74c7f3e8f6605a1edf3c6d6406b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764375372, "uuid": "6b23484e-1a99-455e-a262-ee0ab3d3f9a3", "comment": "Malware payload (Mirai)", "value": "a53977b6dde3d1cfcd5e8879f7a8fc0138530ce0e71251d5bf1804ab4881f7bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764375372, "uuid": "e1903e21-283d-4d1e-a15e-e77465731d20", "comment": "Malware payload (Mirai)", "value": "2242b442c84184fc0cc97582bf06b179c54ee8a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764375372, "uuid": "d6bdb58a-0955-4e74-a53f-33d5eaa23f16", "comment": "Malware payload (Mirai)", "value": "2949da8897797610fde476f5675647434aae4a55418671615100d8eb26d4ac8939dc0141710c1e0f040739cf7f7543bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764375372, "uuid": "5da23074-be2b-4bcb-a3e0-b1c1b23414e1", "value": "T17104BF63B30F20A1C86202F80BCF6B6D252321125E9B9BE76C6E753E5F775DA45063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764375372, "uuid": "9b8e69a7-83f1-430c-8702-a8af8bf34c26", "value": "3072:kw1ZrDNCxWaKPCw74jF42U9s1/SfdsAug7CqvJVwdJHPq:kcMWvGF29sdkuAjCqvJVGPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764375372, "uuid": "f06ea846-f21a-4b7c-8a99-a4251a92bec8", "value": 173696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764375372, "uuid": "6f85eaf7-e343-4288-aa49-32bb3bfd8ea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764375372, "uuid": "30710a22-f434-4e06-9a9b-ea9bd9a219e9", "value": "Polar.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15110e28-cd2a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764424107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764424107, "uuid": "fcd5ad9d-9669-450b-8b67-574e76269263", "comment": "Malware payload", "value": "ddad6252105cc7104a0683c2d3662c55", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764424107, "uuid": "241567f0-9cea-4da9-b63d-536c047c6c70", "comment": "Malware payload", "value": "a5ea2fae2fa215baee8f129be1f2deb650295982764839c9ceb9a3120e7421c6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764424107, "uuid": "7af1f7d1-58f2-4aa9-ac5d-e94022930f84", "comment": "Malware payload", "value": "02d1269ffe56e490c048c1188a8fe3d07584ba15", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764424107, "uuid": "5473e7ae-3930-4843-afed-5ba29c075b3e", "comment": "Malware payload", "value": "28b889be1d75ee314422767f24a21b2eb4d0d6e674f6107c7345253b15618a15d5adef645418cc21a8e218bbeb9e10bf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764424107, "uuid": "7a7ba150-e65b-4206-a649-9e4234e9c76f", "value": "T122553344D3B2C07ED25A81F2D77A386D9C8C6462E3B116EB50BA23E5875EEC05527C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764424107, "uuid": "ce8d99d1-b6b4-4c7a-bd99-41acc7a6348a", "value": "24576:c7d0mv45nyMNZLk9HaPtT4I2YIt+ETfH+JK70P+HrgZS43HY9v5E8bKxTAaFGc:c7d0mm3O6PtsIgxvPY9S4o9v5EwKxTAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764424107, "uuid": "e9ef3df7-5ef3-4667-9443-42bda6bb2cd4", "value": 1353728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764424107, "uuid": "21a3f544-14eb-4ed4-952b-91065d5d271f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764424107, "uuid": "abe966df-f666-4855-b7dc-28cc250fb266", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e3df9e-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764391980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391980, "uuid": "1d9ae54e-7ef4-4797-920a-350a14e22b18", "comment": "Malware payload", "value": "28858a433cbd744b074185c7a15389fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391980, "uuid": "3bd74eac-07d6-4427-acc5-d0c87d07ab1f", "comment": "Malware payload", "value": "a611a824be1ed1347b612a24600ab772a05f54071ae551c5ff9aa2d5e854e8d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391980, "uuid": "dc51d93b-47e7-4adf-841c-f63198a8f4c0", "comment": "Malware payload", "value": "927620b7c7c75e2036638ef650ce9e5bf816b47a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391980, "uuid": "e8c46724-0f98-4b17-9ff1-bf346650d921", "comment": "Malware payload", "value": "2f4850bc8fd500251012f8646120596bcb676ad53a9d98a7f08074d2bc5261d700087ca51f848f35f4d1104df799869e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391980, "uuid": "4c401806-32bd-4d9d-a627-2b359bb4e6ce", "value": "T13E6507B96551D255FE3880B940F6865EB220713286722BFB0160D263EF1B5F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391980, "uuid": "b23f31c2-1581-43f8-94cb-767dfe898f40", "value": "5e3631c569a217cf469245edaaa125d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391980, "uuid": "9ed4891c-777e-411b-b3b5-4d363f737e9a", "value": "24576:5diCGvBxNvYYh3TBv29aajsGNwans6JuYdGo/migY3FY0Bmdy3SEII4kPKCw48vm:5QAe3TBvnSaYdx3LQyFC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391980, "uuid": "2d759060-a70f-49d6-a647-4ec3b3af993a", "value": 1509888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391980, "uuid": "3dceeb43-af8a-44d9-8f45-9bb2ab3dfa63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391980, "uuid": "3767c11b-9d92-48cf-972c-af38ef11fe72", "value": "7mg1qn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f652293-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412984, "uuid": "554e5b5d-d69c-4624-82b2-4354e9181af7", "comment": "Malware payload", "value": "b573c9d4798bddcfc0e881cecd8c3dd7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412984, "uuid": "69e56f91-f597-41ca-953e-d086099e6206", "comment": "Malware payload", "value": "a71d6ce5b59a018eed46c1e2208cdaa5362c6dff1fd2e79cef72656fd5e15581", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412984, "uuid": "8c634eb5-185f-4c26-b886-471a49389894", "comment": "Malware payload", "value": "0f61aff1451dd0f806891fe2deb4828af1eda71a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412984, "uuid": "fffbec44-3792-41e9-be5f-a9bf36d249c5", "comment": "Malware payload", "value": "2389b850851c38494d0184bce8da762dd12257204296b443b1d21c7d8c36c5d0e5206297be27aa67b4f9fa45fdcee73b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412984, "uuid": "4d0144f1-94c5-4edb-8572-6419f60d9cc6", "value": "T177D55B2183407B7E6A980A2FD06C3F08E7F51B53C45A21DCA5936E472D2EFCAB55CE16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412984, "uuid": "c5f05c9e-1958-453e-b7f8-3a019f680368", "value": "24576:5PaI0oiGlRZusGUq85tgLpQpHDrHVAme4h20ogicyFWPMbSR43dJyobGLLJZif:fOGlREbX+tgKf047kzBGvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412984, "uuid": "398fbf5d-a0f7-4c38-b573-ab453119213b", "value": 2763076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412984, "uuid": "ffcb9314-64b6-47ab-8e16-8fe8a2bf9ba7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412984, "uuid": "437e2ff9-e264-46ee-9cf6-86db32a59a6f", "value": "envio_11_28.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d643e60-cd0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764411343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411343, "uuid": "993eefde-53c5-4824-b64a-d06a957a77c8", "comment": "Malware payload (Gafgyt)", "value": "e9ff8d39ef414299f395fb0c96c08261", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411343, "uuid": "aa12ae0e-2c40-478c-9614-060a0d155172", "comment": "Malware payload (Gafgyt)", "value": "a7201e99c8360de7a84f898e685ce9bd6b783aa57143b9ae81bf302211ba6330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411343, "uuid": "ed5717eb-f088-4a79-a976-21498b8c11fc", "comment": "Malware payload (Gafgyt)", "value": "f2b7fc684e452e20b5fcee2a8431521daa68f63e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411343, "uuid": "d196f45c-4d80-44be-893a-f844e67088e5", "comment": "Malware payload (Gafgyt)", "value": "ad0df33b7869a27ae24d8b8c223a6701f9122797087897b3f54b22f9166b5ef8d652f737bb199b41061cef669ffefa1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411343, "uuid": "f35a26e1-3b2a-45db-8556-0fe3b40e3213", "value": "T1C0C3B60E7E228F7DF668833447F74E31D75923D626E1C685E2ACD6011E6034E685FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411343, "uuid": "bd70f1b0-a006-4eb5-b364-62252b23301d", "value": "3072:omSCfaBZyyrn0xl5p3UejsJGfw9fWjyF8k:omScQvrctUzU4zF8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411343, "uuid": "5e7c3a34-77d8-4103-97d3-53ce3cfce123", "value": 118704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411343, "uuid": "e1e9b5a7-f99d-457b-a182-df7d184ea597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411343, "uuid": "c762f598-d461-4744-9b5b-517058c37384", "value": "fmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d43db1c-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459366, "uuid": "9b125754-895a-41ff-b6de-f43b3049b77c", "comment": "Malware payload", "value": "0023afbb51451eb8f8dec03f470c0112", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459366, "uuid": "deb210cf-74f8-456b-9b72-22e6c86bbe8e", "comment": "Malware payload", "value": "a8901cb67a62dbff4095ad5a79a2c47560295ef333e987dd7b5f38ddbee584b7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459366, "uuid": "0bcdec9c-e8eb-42cb-9c09-e1a8d79fc53d", "comment": "Malware payload", "value": "43d002f420180d66752d53f8bb6477b2d763bc9f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459366, "uuid": "0b7ca396-7e7c-432e-8a39-e58f01f9d3a8", "comment": "Malware payload", "value": "c1203c2a143e024b71f631c1c1ff792443dac406571aaedc24123222fa07191e1fda66922fcbf9a26ec4f33a62528649", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459366, "uuid": "0b86a179-871c-40dc-8a44-f9fffa28f452", "value": "T1E707339E5A139D37D07D02F574C460317612C2B02943EAAE30E9FDAB57834385DA9AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459366, "uuid": "c29507e9-2999-45f6-8105-2f8e001d469e", "value": "393216:Lb73aBDGk8skufVQIVsT/kHu+Py5yXDnVeyKcWduLsQE7ebWpOMlZdfLZv:LPUDBnkMQI88O+rVmtaC8ETZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459366, "uuid": "f98dea71-d536-4c48-9f22-7d003db4a486", "value": 18259968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459366, "uuid": "c0eeb404-f4e9-43f9-b340-695225cafb10", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459366, "uuid": "e28ae3ae-cf6d-4791-afce-25cd7ec21f15", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0633f8-cd39-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764430533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430533, "uuid": "a2038264-fd98-4004-b70b-6f43aee97cbe", "comment": "Malware payload (RustyStealer)", "value": "1d154306cb0824433bbf2674fac0e236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430533, "uuid": "97242b75-2881-4cc3-a361-03b01ed2a8e6", "comment": "Malware payload (RustyStealer)", "value": "a92e51dfc17216802cb9a74f043bf6feabfd0cad3bfd7b3e699120dcd9f29b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430533, "uuid": "4770a1c9-eea4-490f-bbdb-b90966494a26", "comment": "Malware payload (RustyStealer)", "value": "4b394640c378082c6a96769ecd48894925d1d7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430533, "uuid": "b6d75861-1b0f-41ac-87e0-aacdf7e29ac1", "comment": "Malware payload (RustyStealer)", "value": "3fd2cef847d56eb359e1ca7de7e41c6c5fd1acf910d49d5348f623972c8c07682f1e747657dfc16586b5c6c31c6a074d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430533, "uuid": "e46d90f2-e19d-4eed-812b-1ec61fdff01b", "value": "T13A555B03F6958A6AC45AC274824BA333F632BC4C4726F76B57C0A7313E66B505F1EB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430533, "uuid": "f20e8247-b0f2-411e-b6bc-6c0741ef95bf", "value": "988e38830f38f4e1388f24e669d6a878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430533, "uuid": "23ed29b6-822c-4121-a84d-320014aa74c4", "value": "24576:gx0yEgQsYDFalp5YOSvHi//nBWQTztjF9GyrYowx5sQn652FOGp:TEQsY5al4OSvanTztjF9GyPwx5zPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764430533, "uuid": "83334465-a9f9-44b8-8e2c-2460cc434702", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764430533, "uuid": "6675e1c4-81f8-4aea-918c-bcb39460c98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430533, "uuid": "ffae40f8-30b8-45d6-8bb5-44ce9e9dc974", "value": "7p3ow2ZH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a62c19-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764392008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392008, "uuid": "b489bdf1-795f-463c-a7a1-18c75641b058", "comment": "Malware payload (Vidar)", "value": "70aef7129ba5aaf1f0f6b3c40ec30810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392008, "uuid": "6613ec44-32cb-4661-99f1-edec87969c46", "comment": "Malware payload (Vidar)", "value": "aad442689220862cbfcb0c8ae5a3294060283f416531d8ccdf902c99bc19b216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392008, "uuid": "a56e5ed8-83e6-4b8e-a407-7fbae8644112", "comment": "Malware payload (Vidar)", "value": "20d09038aac69011493dc5b72d9eacbcdb7d56ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392008, "uuid": "31a1fabe-0f0a-4621-8170-40a3b8b435c2", "comment": "Malware payload (Vidar)", "value": "0c538e6e283547947c3b6fa2d740893a2818884a814c6173bd798e2cef7cfd989c9de0590c12019670b19a31c94e8f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392008, "uuid": "84fb24f8-2e72-44f8-94f5-b76ee6ad8157", "value": "T1F7361917794E8AA5D49AD23EA5D271C5763C7C4B07323AD30A983625FD3A3C81937B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392008, "uuid": "29538521-714b-46fa-a4cf-0afbbc9c6ad9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392008, "uuid": "634e05f8-ac7a-4876-b6c7-0f1c86ad43c4", "value": "49152:gjev9+omkz3CRViBh5S8P4V98DvQqUVkXXCXAeXfXI/paBmB72MN8SG8/o+1TKE0:goxWR60upaYEKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392008, "uuid": "a8cc8082-2e13-4141-8561-a3b1fec7dfdb", "value": 5108376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392008, "uuid": "a5d1df02-78af-4ce7-b812-caa695a154cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392008, "uuid": "7af57033-2d94-44b5-974d-4b0be9b8aebb", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac743cd-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409836, "uuid": "81b3c96c-7a45-4112-8d41-5c704e273b1b", "comment": "Malware payload (Mirai)", "value": "0d52a915349cb92dc8e3b0d9069b7e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409836, "uuid": "0fbd0635-ea4a-40c0-a429-290a519cb258", "comment": "Malware payload (Mirai)", "value": "ab59b7659be58e7725e7411749c256f6bdf36a3bedffd54e9a77bde85240482d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409836, "uuid": "173e1b76-6531-4241-b81c-b1737293d710", "comment": "Malware payload (Mirai)", "value": "56bd090711f3ede918bd3ab7099c4a7acdcda3b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409836, "uuid": "efb33cf0-7325-4ba2-9cd4-a7c80e367e05", "comment": "Malware payload (Mirai)", "value": "b1ae898bb8cd1a4df76aaf29a1e6525b0b47be54da44858322d498e84ed5d512b5dfb1296613eddf5dd3e7c8be8ef1cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409836, "uuid": "9f3a05a4-0c42-4828-8db8-61836515caa9", "value": "T14AB32A51BC818623C5D712BAFA6E828D376613E8D3EF72038D255F21378651F0EA7E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409836, "uuid": "f169832d-4ef8-4a9a-9ce5-3945d27a9728", "value": "1536:iXZjUxAYS3lTTthLP8in65mktnEYDyGU6dGKQwpJRmDLRf2eV2Jcu3vOZbJR:iXZA/SRGb1QgRmQC2DOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409836, "uuid": "8f2cac86-7c8e-48a8-9ad8-8b217337e3b5", "value": 116548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409836, "uuid": "97b1f454-8957-4657-aafc-a23deb9d8f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409836, "uuid": "76dae2c0-4367-4a06-ae25-a98be73987e2", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f46105-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389158, "uuid": "04666144-d1c9-49fb-b99c-ed70ec30365d", "comment": "Malware payload (Mirai)", "value": "0397d5073fb4a93f26c6a9bbab2fdc7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389158, "uuid": "6b96e016-d3e0-45da-858d-9063c476e0f2", "comment": "Malware payload (Mirai)", "value": "aba57c20fc82ae432e70144784fc4b51854ae1caec1db521251327581abda406", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389158, "uuid": "ac740af9-75b5-401d-810a-a7fc5d97fe0c", "comment": "Malware payload (Mirai)", "value": "aa1a247870aa203dc6b0a1e08c18c4d39fc00579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389158, "uuid": "788abdba-9565-436e-b975-68e94fb5220a", "comment": "Malware payload (Mirai)", "value": "c9522185040be0541de8b7d2e0847eacc53670a7ca8e8d5f987aaa89f0cbeca94ee81c18f4bfc5b9ed8b01ef966ab029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389158, "uuid": "0645ec7f-3951-4a06-a675-e9a84b65ba95", "value": "T152030247DCEA6748ED2FE034ACEC294F3010F3465EA58AD748C03978B816ED5F639201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389158, "uuid": "f0227052-7505-4a70-8bda-ae95555876df", "value": "768:o33zCK+kSPH02uQjCn34OVu32gIepK3AB7nc0nnbcuyD7UHQRjC:o3QuQj8CmVepK3AB7nc0nnouy8HyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389158, "uuid": "c13ea18b-6b42-4f2e-aacd-8aa2a6a1c138", "value": 39392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389158, "uuid": "2b06e13e-35e3-4da8-9c3c-1a02b5d85dc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389158, "uuid": "da537edc-975e-4866-baf1-48b8f3b10761", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3ecf85-cd65-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764449786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764449786, "uuid": "5c6f04c7-63b0-4174-b9f9-d99b109b7d88", "comment": "Malware payload (CoinMiner)", "value": "5452f5e780a1964b7b48c04459b91c78", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764449786, "uuid": "daf41665-d9c5-4beb-a0c5-2b14e0a2218e", "comment": "Malware payload (CoinMiner)", "value": "ac9b66046e7b48690eec441a018373e654b164cdb01957f1712d39404063517f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764449786, "uuid": "da69f042-2ce3-4ca2-8810-5446bcae782f", "comment": "Malware payload (CoinMiner)", "value": "cc8d20657003ccbc1a8a7ee6ca457d412e26f786", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764449786, "uuid": "586b5531-6b7b-4822-b06b-e53e8ef18c95", "comment": "Malware payload (CoinMiner)", "value": "5e9380179222857c7bcfabcb92446fec477139b009632986455f1f3581562d9fc91d390da57e89d44f36a51fec4792f7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764449786, "uuid": "e682ac8c-02c2-4458-8e73-af71aab2f3ce", "value": "T11195237B3695C969C733A2B0A8A3E58CFEA33F1729B683171714738D55BBA00C679143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764449786, "uuid": "2f97d362-55ea-4204-a887-dc66bd2a2040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764449786, "uuid": "871161a7-80a8-4f9d-8e1c-f55d6c22009b", "value": "49152:W8zt1S0tH8/SXCsHhJbv/vnvyYN1HFEHJ:Vzfp8qX/TnXHvlEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764449786, "uuid": "1cadf3ca-3a4b-4ebe-ab1c-4c211cf3fd2c", "value": 1964032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764449786, "uuid": "fd67204e-8384-4ab9-af54-e12bcd2e930f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764449786, "uuid": "1f8bf8a5-962a-4ecf-94a1-af5a0a0ff278", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50560892-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764391994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391994, "uuid": "b4a61e1a-b93a-43b0-9fab-cda334f403bd", "comment": "Malware payload", "value": "2ef9c7f21b7c4eeaf74aeeffbfdb660c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391994, "uuid": "c41e3daa-5141-4ae8-8f43-cc3b914e0070", "comment": "Malware payload", "value": "ace3ae219d74eff91eb2965848f0ebc55ca4ccd7e5061d57089f0ee6f273e3c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391994, "uuid": "26c2a107-5411-4caf-824e-c37e4f79ede4", "comment": "Malware payload", "value": "ea921f75885a9f540723093cf3386b279bcb9a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391994, "uuid": "65e4f5ec-6b17-46a7-a521-388b96a4d54c", "comment": "Malware payload", "value": "2097ad0e3581badd5929b43a0278a8930c97888768f15683ab783838edc4150e0afc46162796bbe4e61f3e09a3bd1e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391994, "uuid": "2b1565d7-1c28-47ae-be0c-9d9a7636b711", "value": "T1C17507B96551D255FE3880B940F6865EB220713286712BFB0160D263EF1B6F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391994, "uuid": "512fab20-a995-457a-a32b-52d3f80706e7", "value": "5e3631c569a217cf469245edaaa125d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391994, "uuid": "543b96db-8d3f-4cfa-b676-36e00bd65d5f", "value": "24576:QdiCGvBxNvYYh3TBv29aajsGNwans6JuYdGo/migY3FY0Bmdy3SEII4kPKCw48vZ:QQAe3TBvnSaYdx3LQyFC71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391994, "uuid": "855ccb9f-4d0c-4651-8d3b-301c47c54bb2", "value": 1602016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391994, "uuid": "624012ad-b60e-473f-9f8d-1905599206ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391994, "uuid": "c7ada9bd-58f1-46b5-9228-4ba577e59be5", "value": "ew5yshsd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d25e1b-cd13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764414255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414255, "uuid": "0d930fbc-0b88-488a-a119-00bcf2ff35cd", "comment": "Malware payload (Mirai)", "value": "ff17858c790f97f6b5ce056cb7022c23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414255, "uuid": "5285ffe7-0cfa-41dc-b615-8b2b48704e1e", "comment": "Malware payload (Mirai)", "value": "acf55ae6cc02e2f40f55d47f4b17f20a4e145bd5dd2ddab836d3f22b2d7c27d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414255, "uuid": "5ba640af-d77e-4100-8bc7-50198cb1d033", "comment": "Malware payload (Mirai)", "value": "59f3f40a33f58eb86cb9cb50e43bb40c1aff60be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414255, "uuid": "6d29c4dd-4ba7-422d-9e7f-11594dbe2c15", "comment": "Malware payload (Mirai)", "value": "4ee085b7e2aa0c37e817a25e0eaea165330d1a4781fc52d8709cb154dc9e420e924dc0a598f31e4a495ba5f8ec9ef1c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414255, "uuid": "2dbb1feb-cbe6-431f-9cc1-2ba5bb2ba4e4", "value": "T16FE33956B9C088FEC485C17C07FEB137D861F0AE527C765B27C4EE262D8DEA05A38685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414255, "uuid": "091bdd2e-c9a2-4fdb-bfbb-f91388bec392", "value": "3072:zqJlzf+5ncXxyLMYOJ7JGRUYN1ufT0huxtD3CKG05/CUs:zqJJfuncXxyLOJ7y8TyurDVd/CUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764414255, "uuid": "a3d03cef-a5f5-4285-ba7a-deb8e2e3a73c", "value": 149912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764414255, "uuid": "1cdb3ceb-a751-4e07-b97f-5022230f660a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414255, "uuid": "e7b21622-3b5a-4773-af25-ce0797f7aa2d", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6227804d-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764392024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392024, "uuid": "5603f87f-c27c-4864-b800-730b241933ce", "comment": "Malware payload", "value": "5b7be10007b14ad87147ed1345696774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392024, "uuid": "66affa02-ff9f-44a7-9743-7c077b929080", "comment": "Malware payload", "value": "adb9b2e223175aaa121d3d5f78a75a116cdb8e47553893e1a4c26e137e062b5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392024, "uuid": "16870ce0-2d9f-4048-b2a3-a3266af0c00d", "comment": "Malware payload", "value": "62299636aa9230f0b935f6ce780023e165a5ac48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392024, "uuid": "c8723fd4-3ff0-4a75-954d-79e46ce5f40d", "comment": "Malware payload", "value": "530ae3e5bce9aac68dd5b9f8555d18dc0d5642cc410d1913aa84fbf259be97cc128c6e9bbfe6359229a5d2c4fbcac7ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392024, "uuid": "c6010cb6-0d84-41d6-bb94-8463b43c1b0c", "value": "T1DE5507B96551D255FE3880B940F6865EB220713286712BFB0160D263EF1B6F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392024, "uuid": "7a1edbde-530f-4f6e-8435-b56403e1af14", "value": "5e3631c569a217cf469245edaaa125d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392024, "uuid": "1af8518f-f19d-4043-9b96-6e0f90dc313c", "value": "24576:cdiCGvBxNvYYh3TBv29aajsGNwans6JuYdGo/migY3FY0Bmdy3SEII4kPKCw48vm:cQAe3TBvnSaYdx3LQyFC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392024, "uuid": "ed505a40-1df1-4667-8881-bbb23db53c57", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392024, "uuid": "8420a30d-0df8-472d-8544-1e652fb40d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392024, "uuid": "6f3ba39a-c618-4025-bcb8-1a9384c927b7", "value": "uo6zf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dc2b76-cce0-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764392327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392327, "uuid": "c1ec4e7a-d2e5-4e1a-8194-8d09b9bb69e7", "comment": "Malware payload (LummaStealer)", "value": "3c9782738f4c6d31f14ca2a2a9c0355d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392327, "uuid": "b212ab09-d0ab-4716-a701-e4459b41ca54", "comment": "Malware payload (LummaStealer)", "value": "ae09ac122f409b47d00d8e8f1d98dfa134366e165fb3547debf1beddfe77d5ee", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392327, "uuid": "0759eef1-01cb-4f4d-9e37-b93359622fed", "comment": "Malware payload (LummaStealer)", "value": "83054bbe56a02233049bc5b22bd8a3ae5231f141", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392327, "uuid": "3b2bbd9d-b1a4-4a27-b9a1-7a211cfc4cc6", "comment": "Malware payload (LummaStealer)", "value": "025e3b6fbd3e198722f0aae8fb93e0f397634dff9f04df99a048c237492d8b5ce161c393a3fdb14b94d7c1d47bdf868a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392327, "uuid": "3b80308a-00ba-4f34-92b2-564bf9b489b3", "value": "T195E0AB14DD269297173215E5E04A8B06CED3E423202798257500DC059F2C8AD2A2C1F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392327, "uuid": "9a030726-311f-4e0e-9cce-efea30251bdf", "value": "6:j+RwQ9vDzFsJgg2gAC3NqhLx0HGFGH/tCOBaiS0LSyjFaYZiXMvveAt/UC1AED:K3vDzEcCYhLGHMw/opjy4wiu1UlED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392327, "uuid": "d8f3f450-adf5-48f0-b63a-42d75d75cbf8", "value": 434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392327, "uuid": "082e245f-7298-4710-908f-be11b7c8d30e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392327, "uuid": "37f7b2d8-759d-4283-9813-c5c8c33fbb51", "value": "ww.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce736f0-cd3b-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764431717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764431717, "uuid": "367bb1b6-29f2-4205-a06e-343855f145e3", "comment": "Malware payload (ValleyRAT)", "value": "84bc52fe81d8d821dc0b36e15be9b6ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764431717, "uuid": "0e95c7ff-c232-4bf1-b51b-3928f8779173", "comment": "Malware payload (ValleyRAT)", "value": "ae9e4365816e3f229297938b9a14dd9b3d16291e17f17d879d33f99e967d3485", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764431717, "uuid": "dbbaab98-439c-4ecf-a235-2773c1dfe316", "comment": "Malware payload (ValleyRAT)", "value": "5d377b9fddf4fb7b8afd09a89cefee8eb6f3cf68", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764431717, "uuid": "d03bd666-d829-4f40-a0ff-d9a8f04c7d3b", "comment": "Malware payload (ValleyRAT)", "value": "2776fec3e08dccec11886e26cbbe208a28d32f981819bdf179ecf4e0bd4fb75784570bc78773b6470f3dceb3ce36b09d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764431717, "uuid": "f3af21b0-2fc4-4cba-8c3f-322121127880", "value": "T19176AE21FAA087B7D80782336558F23900ED9E7D9A63C01F27ABF21F9D39542C755A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764431717, "uuid": "6edcad9f-db49-490a-b334-50e35d8cddda", "value": "81d96ee899cc30cc4015fdd51314de26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764431717, "uuid": "6401b132-b232-4814-bf18-c9cc3b2f670a", "value": "98304:2JwcvLj3oql4lGrpevwRjVQfb69NjUvLHGbZzgy3eBfDI7uMllmKHf6DQU9:9cf4ArpFJFjUvLHGlcEifDIDllmKHf6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764431717, "uuid": "267d8441-1f35-4dd6-81c0-5f5d1aa50500", "value": 7700352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764431717, "uuid": "211ebe67-0d30-4343-9c46-1e55b7960342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764431717, "uuid": "0a44fc13-c6a8-455b-a2a0-6470919d4bd5", "value": "ae9e4365816e3f229297938b9a14dd9b3d16291e17f17.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7018671-cce3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393884, "uuid": "34558e88-1e50-4cfe-b9a7-10f542c135e2", "comment": "Malware payload (Mirai)", "value": "0ae0242fae91399a4beff8faa282ed6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393884, "uuid": "618619e5-b319-4b1d-8676-bd7083f36d6f", "comment": "Malware payload (Mirai)", "value": "aebd647f12f33ba0062a135789fcd69f96b6db9763f1fb1b229ccd59a2bda381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393884, "uuid": "c7ef6f84-4538-44b6-a47c-f591b81f5140", "comment": "Malware payload (Mirai)", "value": "5c9de070d48332be3192a25954f9e64e042a0770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393884, "uuid": "5ac6622e-4c49-4b85-9c94-7173fe0d05a9", "comment": "Malware payload (Mirai)", "value": "d6056e72d2e887ffac4a4ea95163d3167686dfd09a17253e6055459323b432a6fb2c3c61763423d3a0b2f269e62c393d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393884, "uuid": "2fc78c3a-fc3f-4f59-9a74-2e52fbb97ca7", "value": "T1E013E1B322A99154D599C0B77CB43E4E184088CCBD4DD2F2BFCC9A29E9C1359AF34AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393884, "uuid": "5e76cf81-018d-4938-842e-6ba05aa3b258", "value": "768:SSpA5iMObG3QGbW8/sHJf6gHgn+05XYP9NZjrAIRyBH0JRq43nAScnbcuyD7UHQo:VA5ECQO3kpcn+05Q9vjrNRyBsqKInouD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393884, "uuid": "6ab5d854-12f2-42dc-a13d-c44d9733beee", "value": 44064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393884, "uuid": "1d49ce0c-680f-46f5-bdf3-dcdeaf4773b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393884, "uuid": "b51b7595-640c-4d81-8e42-b802e043fa31", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6c92d1-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409840, "uuid": "f06aef1c-48a2-4a44-9954-a569b1094f22", "comment": "Malware payload (Mirai)", "value": "0bc4d1f788d8ee8a6c7e9d9ef86bc497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409840, "uuid": "3bdaad64-4ed0-4c44-9ca6-c9dbdb29e47a", "comment": "Malware payload (Mirai)", "value": "af009ea6b07266a24ecda971a297f2bf2239944bc11ab91597810f15da4135b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409840, "uuid": "74f04b4b-eba3-47e5-9b00-e6c1163bedd5", "comment": "Malware payload (Mirai)", "value": "dac9de47eb6284f8116cd518b1b2a098c0e2c6a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409840, "uuid": "38425086-813b-400f-b500-a8929cbf6867", "comment": "Malware payload (Mirai)", "value": "2d2ba24f789f70d9b722c1f3ff5f09533634fc7bb651de041027dc63a40a1efef06fe2e3f296d5eeea1194a681aa8637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409840, "uuid": "139786f2-eefb-41d4-a9cf-509394e0ddd8", "value": "T1B7144B46EA414A23C4D7177ABAEF4245332397A5D3DB730689286FB43F8375E0E27A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409840, "uuid": "d7c8f75f-5cd6-4cc2-8a38-98c09c8b145a", "value": "6144:QR620puFYSmtfgaLKDwZqMvzepyjBvyuEzM/9SbgWU:Q420pu1mtfgaLKDwZqMvKQpqQ/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409840, "uuid": "9e39445b-003c-4123-84e7-335b24d7abaa", "value": 204124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409840, "uuid": "563e5638-e6c7-4117-a622-4dba6a78d773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409840, "uuid": "f2dbb7a7-7c62-4ef3-b42b-4c9892b9284b", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3908fef5-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389378, "uuid": "c0505c3f-6498-430f-96c2-2266109b7c69", "comment": "Malware payload (Mirai)", "value": "5da3c75cb1ee0d3bd1b18081b36efe31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389378, "uuid": "91e79b58-9202-42ac-91ee-d22641d90034", "comment": "Malware payload (Mirai)", "value": "af1506c94ce6c5c7ddce3418610231833e597904b549e3b43174b1839f844414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389378, "uuid": "196aee5f-87b7-4c77-ba28-dd647a4a6aab", "comment": "Malware payload (Mirai)", "value": "d9ec660d36af004a019914a3a5f0300449f0b0ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389378, "uuid": "de88ff94-9062-421a-a552-c866f4efb724", "comment": "Malware payload (Mirai)", "value": "9429156eb6d164f1ec141c3fc2a9664109925992f34407c365cad1ddadd28295ee3a72eee081a5e64ec392c80a489e1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389378, "uuid": "2b5b6923-de9e-4d68-8a60-15bb490a097b", "value": "T157C2D0C2695DBAB0D2B01C3AD495CEC327430AF4F1FC3659AE5496607B8252C4AB47D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389378, "uuid": "4b91fdc1-1505-4414-a09b-5ed8f24407ee", "value": "768:XKPxxwscIM4LDvXDAYdCefihkCfuv1D8s3Uozg6:X4/wscD4XLAYfGfCzg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389378, "uuid": "74d2591e-5a24-4961-b628-4df17a9d34c1", "value": 26756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389378, "uuid": "d0329b90-d9e3-4750-bb70-775e1046372b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389378, "uuid": "85955704-4dcf-4dd4-8d8e-13c382a4e706", "value": "niggah.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73a0f45-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409830, "uuid": "88bd5fdc-7fb5-48e4-8731-33afd8fb5242", "comment": "Malware payload (Mirai)", "value": "11f3cbed1867115bdd92725913a46b92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409830, "uuid": "197d56cc-4fe6-4aa8-9927-1859be84b261", "comment": "Malware payload (Mirai)", "value": "af839910d3db7c200488d1f6c1b470ba4a9962902ccfc1fdad2fb04d80b1cd18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409830, "uuid": "68cbf51e-e458-4f2d-b9e6-d38bd9108a26", "comment": "Malware payload (Mirai)", "value": "4c889115cac5d8c863c77121564edabeb0069e19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409830, "uuid": "91f5c159-c35e-4b92-896b-5cfcb42f53dd", "comment": "Malware payload (Mirai)", "value": "d5297cff7c0c336ca158b920268353fe580ff9266da046ca91d3d2b71e4eaa32e0c3583179f56745968fa67600460b5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409830, "uuid": "4c9e4292-3788-456c-8aec-82969160b06a", "value": "T150A34AC6F653E2F8EC5601302136FB378A36E1B9112EDE87C7649B72BC52641D90A79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409830, "uuid": "1a596bc6-5139-4037-9887-a2d307372885", "value": "1536:V/i8rDjQ5ZJSsvcyoe+fuOiOdv3GvakQsg0ySpGQ13sjfBhL9lFsSDe68R:V/iATocyoe+GOLdvG4lQ13WBhxLBWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409830, "uuid": "314dde15-826a-471d-be13-f9ec5e3982ac", "value": 99984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409830, "uuid": "2f337b59-1864-441b-b01f-a75b055be1d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409830, "uuid": "3ebb3e6f-0f5c-4971-8c74-2e0c6d63277b", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c83561c-cd0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764411342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411342, "uuid": "2782e285-05ba-4bb3-8bec-161576eab46d", "comment": "Malware payload (Mirai)", "value": "701ba49d419db77f6b604dae9db63fa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411342, "uuid": "cf82981f-7acc-48d5-a86e-f49b83641170", "comment": "Malware payload (Mirai)", "value": "b0a47d02af0ca35829fa988410ae80267986b1e5b0720a14b7934faea454404c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411342, "uuid": "c8dde199-445a-4e91-ad9d-fb2a4d8bd496", "comment": "Malware payload (Mirai)", "value": "cf17e1d60a9d79d83c61c82c2b9677d2e41ae6d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411342, "uuid": "db3efba4-a395-438d-80a2-8dd0a90ec8d2", "comment": "Malware payload (Mirai)", "value": "aa030717b980d666003c317925c38699c0782c6971c3b25d30108d0e6fad875e3344d61c55afb9d2fc3e7c07349ceeac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411342, "uuid": "8d707593-386d-4bb4-bf38-e24650506e28", "value": "T1D043F1DBD7A68332EC2B92B68D3F394B0718C10C00959413B1D527A6A9F8F551F6ABA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411342, "uuid": "dfeae3e4-4e51-439f-89cc-72019a283db6", "value": "1536:sMgxMzXat+KIJldUMe4WfCdipL0qeLLGPeinouy8HyB:sM7KtJslhe4WfCQpL0q4Lee6outK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411342, "uuid": "8a93541e-a6ea-41ca-83c9-22c7556212c5", "value": 56824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411342, "uuid": "61a71266-5c12-4dd7-98d1-ab80e45cda26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411342, "uuid": "283ccd18-de0d-48b2-988c-314b9b4b4894", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e074305c-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389229, "uuid": "6a25933c-05f7-4031-b643-18af4eaa625e", "comment": "Malware payload (Mirai)", "value": "6eeb85cf54f87237384c23c4862be009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389229, "uuid": "738f8841-3c32-4939-89d8-e5a0ddd50d5d", "comment": "Malware payload (Mirai)", "value": "b154c830ff77e53dcf8f8951bb961cafbcb191ddede5e4729de479a8384b610f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389229, "uuid": "3dcce91e-6c44-448e-b1fd-f98ebe5bceb7", "comment": "Malware payload (Mirai)", "value": "1fef62286defd2a02ef52e848b362b24a391e8e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389229, "uuid": "e48d071f-79b1-4fff-8a77-e70466c5269d", "comment": "Malware payload (Mirai)", "value": "2f46ee5acbacc77e64a408db012a2f3a002e6cc6cb684e54955a2d6f882135296b0ce5ee4b8629ce2b9c43d952070362", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389229, "uuid": "b5893a9a-230e-4f63-bdc6-65040089cfe5", "value": "T14F046C02735C0907D1632EF03B3F67E193EFD9A125E8F644650FAA8A9176E32154AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389229, "uuid": "9254afe9-4564-4912-b587-df9d7a5e00f1", "value": "3072:O9DziipldaxZhRW1FvCpp0KHHxXA2O3hXUcFQS6o:0D1onxvO3hX5Fr6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389229, "uuid": "ff316fa9-6473-49a7-bcca-b8152265ec77", "value": 178012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389229, "uuid": "c13df23e-12ab-4ed3-afb7-7a072a539171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389229, "uuid": "3001065d-26f6-4978-9e1a-02f3b7e24402", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8334395-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409778, "uuid": "fb59ab55-a71d-43b7-bb41-c8c76aa8fb97", "comment": "Malware payload (Mirai)", "value": "73f5c15f3ea041c13ef0fa291de5c967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409778, "uuid": "434832bd-bcad-428a-9881-9fbb69f7d997", "comment": "Malware payload (Mirai)", "value": "b20f0db0a50071a99d9b475f3bedc2ca3c03fa2e1a874df9b9974e148afba509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409778, "uuid": "acf66f81-0aad-4ab9-94f0-04fa5fa088e6", "comment": "Malware payload (Mirai)", "value": "74391d106e708652a0353969f264052e10eb5e91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409778, "uuid": "e54c679e-368c-4390-9fd8-84dbbb718c0f", "comment": "Malware payload (Mirai)", "value": "9d3e3a6b4393c38e6903458bbd6605799e0944a39ac647b3c3c5dd172c191e95f5a50ca8b3f5539307ccc29122f0c56f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409778, "uuid": "d8a527e4-dd50-4e7b-8b19-39175466d6e0", "value": "T11323F1F55B9065C6D49A827123F44BE00F546B87EC207E667A43F7EA8C022F8BC67274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409778, "uuid": "68b56e3f-cfe5-4cd3-9701-5d6026442511", "value": "768:or1XPBfIZyn6FW/7iUPpNIq12j81ZjM/EifLQEBaKfJgGlzDpbuR1Jl:i1f1X6+Kh81iEXKdVJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409778, "uuid": "e8865099-715a-4511-bccf-755ff8aec6d9", "value": 47080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409778, "uuid": "082a205c-f351-4aae-b950-61cc2a29f8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409778, "uuid": "eac735bd-8c64-47ce-8317-bc4ee564555f", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cda7a2-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409775, "uuid": "b17dcd52-8101-4d6c-bcab-1c77ca8096c2", "comment": "Malware payload (Mirai)", "value": "067d71d97e8cdcad7abe6cd0eaa05e38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409775, "uuid": "8ae05f98-88ed-4ce0-b6ca-e53151ecaa0a", "comment": "Malware payload (Mirai)", "value": "b2ad36d5d9f18056c253a104565a3a988de52d82b08cd8547a18c8293621daef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409775, "uuid": "651cc92f-3845-4a63-bfdc-346c2a3456cf", "comment": "Malware payload (Mirai)", "value": "90206124113fd39050b3a7941fbc23cecb71a9c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409775, "uuid": "f7e20989-5391-496e-a070-e6f59ccf650b", "comment": "Malware payload (Mirai)", "value": "ccb9da85879857fb76a724c12ea0caea19c3e34cd431db59c8300928a0bc827894beffd478cc55aaab0cf78abab340e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409775, "uuid": "eb03de04-71df-4d60-8bb1-28f1044920dd", "value": "T1E513D7077B540FF3EC9BDC3A09AD2742028E5C1D65A56F32B128D848B74B75E29F3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409775, "uuid": "61b1d88b-bf1f-4300-86ae-d91df6266356", "value": "768:guFovdkddZKAUinimyyh9NMuP3uLEN53QxMx03PYqQDaLCvlT2ynZdNYXMI3xERg:guFovdkddIunimNMuP3uLEN53Qx403Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409775, "uuid": "d796f62b-4653-4a3c-ac16-a461006a60b9", "value": 42408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409775, "uuid": "95f776cd-d5e9-4e33-8186-8020d6cca544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409775, "uuid": "d8a31f47-a147-4bde-82dd-1366fe27fa23", "value": "yakuza.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7d875e-cd38-11f0-a129-42010a9c0007", "comment": "Malware payload (ZhongStealer)", "timestamp": 1764430505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430505, "uuid": "b302004f-bee4-48cb-a243-8f0158a7a6c8", "comment": "Malware payload (ZhongStealer)", "value": "baaf52a5ba4b0639cce2ee4918b6da16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZhongStealer", "colour": "#CDB2FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430505, "uuid": "9ea0b195-5b75-478d-ab8c-c060bf325e98", "comment": "Malware payload (ZhongStealer)", "value": "b2ef6a86983e15d0f70e5941b79d03419d4c7bcd4b1c58223f6b8334ed800deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZhongStealer", "colour": "#CDB2FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430505, "uuid": "9cf939f8-963d-4de6-81bf-0ca1be3af076", "comment": "Malware payload (ZhongStealer)", "value": "30fa0d96860adc4443d9e3d4a9e800046ad35d63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZhongStealer", "colour": "#CDB2FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430505, "uuid": "e13166fc-3ec1-4e6d-816c-78497faf0a0a", "comment": "Malware payload (ZhongStealer)", "value": "73118c7d9b02f576e289ce981cbd0905fa25da9a8016658f31c966bb1343a7e142e8b1ed890e759ee14c5e89a1803ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZhongStealer", "colour": "#CDB2FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430505, "uuid": "2963b3d6-b94f-4f33-ad0b-fb52b3d321a0", "value": "T15F136D096A7C8F27CE5E6A7E94A232071BB6C317E157F70F5C9885A915C73C0D7102EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430505, "uuid": "49b8ca6c-acef-44bc-8f7e-d775fe2da8bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430505, "uuid": "f0fe9607-8bb5-4b9d-9e54-6279969a3616", "value": "768:BkcjrTL3kj6DMaoQVd0CvkGg1Asl/scCldedtpL38tNbJ82ADaEVXiNi:BkcvTLjoU/rs4devpL38tlJ8teEgNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764430505, "uuid": "8e7e4fa6-ca4b-4619-a736-fbddf2babae1", "value": 42032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764430505, "uuid": "7b0008f4-121f-4769-8cd4-490aae4fbff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430505, "uuid": "88f98a3a-6c3f-41db-8fd3-73ec728e7874", "value": "BusinessDataProcessor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a701b14b-cd0a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410608, "uuid": "812c67db-eec8-412f-be09-78fc77f56a2a", "comment": "Malware payload (Mirai)", "value": "66e15bda69fdf880970f9377408d498c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410608, "uuid": "3d9f5f8e-0878-4204-a964-bd75f17ed282", "comment": "Malware payload (Mirai)", "value": "b4dec03b5dad403b29d619fe5c0846cdbf1770c58f6bef2e5a53eb1bc9f0da01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410608, "uuid": "4a33f3c6-8211-44c9-946c-0485e0e9ca16", "comment": "Malware payload (Mirai)", "value": "6e2e011443f714a6731b83448f48a975ef0bfbea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410608, "uuid": "246f839e-4993-49a0-8877-e54c7b9e4021", "comment": "Malware payload (Mirai)", "value": "9b647d6c3b467cc5b8a15600158a0077e3e49611d056a8d66ac62c41a52b41beef8a206a4cd9b04664324848a223b736", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410608, "uuid": "88861646-aa5d-419d-aa3f-4d9f4fda4223", "value": "T16714E80F6E319F3DF7A9833857B78E25A35923D223D1C545E1ACD6011E6038E646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410608, "uuid": "56abd302-824e-48c1-980b-c02c1a31db54", "value": "3072:1AkVhAdRtVZSP5PtJjN+9Bk7BtfZw3yL0gZ8y0DpMMG:1DAdRtVZuBtJjN+9Bk7BtfZwqXoDpMMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410608, "uuid": "10801857-8833-49fc-8ade-9ad95716cce6", "value": 198808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410608, "uuid": "dcf2188c-4a2b-4422-9706-d6b8bbfb8a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410608, "uuid": "b21cf528-61c5-437f-ab91-aae38553fa1d", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0c7ea3-cd7d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459770, "uuid": "c510b19f-6f93-486d-9951-0835c1687c33", "comment": "Malware payload", "value": "e0c9ca6e15bdc5b956d72438d4a8000e", "object_relation": "md5", "Tag": [ { "name": "213-176-79-34", "colour": "#4E6AC2", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459770, "uuid": "4d0531ce-7597-4ff8-b29e-f3b3cc437da5", "comment": "Malware payload", "value": "b5360c1b2fe0604b88a897d3926f8b38a3f23bf489deaef5a68e74213ba31fdc", "object_relation": "sha256", "Tag": [ { "name": "213-176-79-34", "colour": "#4E6AC2", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459770, "uuid": "90c39f93-7cd8-4fc4-8a24-0aa15a01aa2b", "comment": "Malware payload", "value": "6764cdf202f164b864df35d008b1417e0a3eb0f5", "object_relation": "sha1", "Tag": [ { "name": "213-176-79-34", "colour": "#4E6AC2", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459770, "uuid": "c4fcb8b4-005b-40dd-b6f3-e8f9e31593d5", "comment": "Malware payload", "value": "b6196549b1dab45e05e12c176fede39e06addab55d37a03793e27593c34da0cd37089afe06b1f9d87f137d2dbdd7ab8a", "object_relation": "sha3-384", "Tag": [ { "name": "213-176-79-34", "colour": "#4E6AC2", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459770, "uuid": "d8648c8e-8eb9-49ea-a44e-32b46c0ba370", "value": "T1A8161717A991CAD5D05AD238B8B261C1B3757C4C0B727BD33A807A762C3A3C85E76F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459770, "uuid": "12e5789f-66f0-4c30-ba5f-eac3d375f8f0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459770, "uuid": "b1123790-0963-43e1-896d-822d7c20ab97", "value": "49152:jxyedPCzuPkX950+htHdkBKtPdxaVGwrktJnCsfj8Eq7PXO/1i5Xmwxo27InpM3x:jPgvXUeOLFRHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459770, "uuid": "6d9f48c6-406a-44bb-a953-d926b662f5c8", "value": 4412928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459770, "uuid": "09d6851a-ef29-4369-b75c-bf1addcd8609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459770, "uuid": "46d9935d-7896-474a-bbe5-38b24d5b6c3e", "value": "download autodesk fusion 360 full crack_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166b6f74-cd7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764460187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460187, "uuid": "023dda17-097e-4d85-a6ae-b010a16183bd", "comment": "Malware payload", "value": "ed96a3cd2b0e02c557cb138876a5a316", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460187, "uuid": "6d3fb5d1-3753-4fd5-87d7-a99cff600878", "comment": "Malware payload", "value": "b5b18c3fc33732ebfd837f7d85aea14db8e3326014d5019da5a92465a55aeea7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460187, "uuid": "b6f89d6c-f183-49e9-abc9-4953494544f0", "comment": "Malware payload", "value": "7c15013c33aa7813f602b0dc716ab15d1d54647f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460187, "uuid": "59d48b12-637c-435d-ada8-fa6b49c2f16f", "comment": "Malware payload", "value": "5eecb84f0b5cc0430eb09ba390d0e9ba5e2442052c13747d00e85fa074f29722132c2238e3c7804dfc64f1c76d18b62c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460187, "uuid": "56cefd6c-fac0-47a1-8ca0-62dbdb9e8c45", "value": "T149E11526BE4B5CE6D3D39AA3C2E3C71C7F6954DD8407AEC170A8C6C65821C6E0799E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460187, "uuid": "1c011e09-a185-45c7-bd9f-0eb2484369e6", "value": "96:VFIKA5QwAM0CT75wGH3PIHIC175IijQsI10C/niVIPaxF9TpEsQ6h:VVAgKHdInkZq3bP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764460187, "uuid": "24a59b63-2f54-43c8-b37e-82af0775c51f", "value": 6905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764460187, "uuid": "8b9361e2-11a7-4df2-9228-807b3109f426", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460187, "uuid": "98edd036-0a24-4dd6-a6d9-63e6025e4092", "value": "styles.css.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d40c64c-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764392016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392016, "uuid": "c66bea02-459d-44a1-9f9d-4dfca6399b0e", "comment": "Malware payload (Vidar)", "value": "c6fe6278fd0a5330a9cad80ec19860af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392016, "uuid": "fe0ca59a-30dc-450d-af81-a9631d60b1bb", "comment": "Malware payload (Vidar)", "value": "b5d98fe0bc2876cc0434fd9dc91444e5dc34ba49426f9319b8f4fe72ca068f77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392016, "uuid": "f1b767c3-0c5b-497b-907f-a98ef5c56bc3", "comment": "Malware payload (Vidar)", "value": "4a072da1c7c47eeda317992249b24af0449d6f24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392016, "uuid": "fb805e53-7937-4126-9da2-179a3c7219bf", "comment": "Malware payload (Vidar)", "value": "4e2bfe62bd6c340903fa37fe8774e3a4014ed870c2fda4d8ad47a866108011081a4ca1d01400d51c152a727b8e4fe3c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392016, "uuid": "916bd0e3-967a-47ef-9f2d-95288b946fe1", "value": "T173467E12BE858A15F49AD338BD91B1857AB13C442B713BD70A81A7771D3B7C86732B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392016, "uuid": "87c1f323-ad58-448e-a12c-87012e52e401", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392016, "uuid": "85c8fee2-cacc-4285-9024-8ba2b7463365", "value": "49152:ofQeJ0gynoFSgN74MurC0bxGxQXnnR+7XLFX0X9y6Pc5oOSI9s1htOT+ITWjH3L3:obEZgBMT5YqnrDVPeKBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392016, "uuid": "c0b046ac-2372-46ed-8369-9b05def19ea5", "value": 5395698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392016, "uuid": "d56124e8-57d2-4107-8b68-13d9ab8bc187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392016, "uuid": "0596f5e8-ea4e-4cc7-bff9-67902627ac9d", "value": "t3p7in.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b447dfa-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389462, "uuid": "19b9fac1-a3be-4e0b-b128-4f3a04e2894e", "comment": "Malware payload (AsyncRAT)", "value": "d7186f4045189eafad47aa7b63664312", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389462, "uuid": "8b1dc27e-188b-489a-abe7-c24145db728f", "comment": "Malware payload (AsyncRAT)", "value": "b6f5bc42a3073335e112e917f10b844b114886bcf9d864dae063e6a68b9da6f7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389462, "uuid": "2982e52c-9dd8-4ad0-ab7c-96b99cbf2599", "comment": "Malware payload (AsyncRAT)", "value": "38d3f623d1a400fdee0b4d2c3090786a7d9e9807", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389462, "uuid": "c57eebdc-9825-4f9e-b19d-4d61c5e7a893", "comment": "Malware payload (AsyncRAT)", "value": "15808978243560621288950723aae58926045d09b4755baa9b938a13f2bec224c857b516831a27b580e176144cb29bb7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389462, "uuid": "3f214de5-352d-427f-a302-631bdfc5aa8c", "value": "T108948C16F75408FDD5ABC57489924546DA39BC8E0B72EAEF17C8422A2F237F08E39750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389462, "uuid": "7af9f0b5-65f4-422f-ba79-23001fb77c3f", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389462, "uuid": "03a97ab7-077d-47ec-8384-5732f742c047", "value": "6144:X+GYnA0zeWsDi5eJziQ8kV3f+RysMFZzN/E/msHOtbMrHEfsNrwI:XYyDi5eNiQ7uysMFZzN/E/msum7L1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389462, "uuid": "ea798d13-a82a-4aa3-b9ae-cdbd73dc0d62", "value": 416140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389462, "uuid": "abb50db4-86e0-4555-8f7f-0afd8c9a0c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389462, "uuid": "3f658a30-bef7-460c-a5c7-26c0c45780ac", "value": "f9iy6vt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1141f932-ccf1-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764399619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764399619, "uuid": "b1a340c0-55d7-446b-9d1a-ecf68299a83d", "comment": "Malware payload (RemcosRAT)", "value": "a2ffd3d42d8442840c8f998f4a4d9229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764399619, "uuid": "0221f703-c495-48e2-b2c9-c1ee6436c456", "comment": "Malware payload (RemcosRAT)", "value": "b709907641259451070d2864e5372df1d16b9744f9423ad4c7482b89f330c617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764399619, "uuid": "5b5d2e11-26d0-48ad-b129-c82bd0196045", "comment": "Malware payload (RemcosRAT)", "value": "d62f543a95126dc4284a8ff05e0d81e590f81de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764399619, "uuid": "1f0cfa7a-b331-4736-b9da-e7382047061d", "comment": "Malware payload (RemcosRAT)", "value": "27c94ef09fe2791a73d31ef5ac8fedd8fe5321324e5981edd8d85fd336e96bdeebc7784ffe3bb1a589bba0e0e6d3a23b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764399619, "uuid": "ea90c2c8-a325-43a7-b8b1-e15a65730ab8", "value": "T1ABA4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D57FD30190A63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764399619, "uuid": "fd5c81bd-329b-4654-8d92-638c83c685f0", "value": "e77512f955eaf60ccff45e02d69234de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764399619, "uuid": "09567b33-1d9c-4b98-9773-2b53ce9fd0b1", "value": "12288:r13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQ3S:xak/mBXTV/R0nEF76gFZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764399619, "uuid": "4e3a94f7-c99d-40de-9f04-a23c72acced0", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764399619, "uuid": "69577bb0-47bd-478f-9631-565aab05040d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764399619, "uuid": "cf4f9b0d-8e57-406b-8bc0-054d970230d7", "value": "A2FFD3D42D8442840C8F998F4A4D9229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c84236-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409873, "uuid": "dee9ee1e-0a32-482b-b9bf-efd7873e8388", "comment": "Malware payload (Mirai)", "value": "f165c7f0df2216aed3f75015c5024674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409873, "uuid": "b3bb34bd-5d2f-48bf-94db-33918d6b97c1", "comment": "Malware payload (Mirai)", "value": "b84358147c9048333c58e5019f91d88a0d9f8a84fd02ddb13639e947a12c8951", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409873, "uuid": "aeb17e26-1aef-47f0-9d22-20a78f836877", "comment": "Malware payload (Mirai)", "value": "ef3ddf003ccf3e9941724e5b75fcc22b076c097e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409873, "uuid": "29aa5fd1-e05a-4b45-8eaf-c1fd2a13dd91", "comment": "Malware payload (Mirai)", "value": "5e6a02b7b51abb1b68262fb4668b243a131fdd081c6332413cc352894ed3d565b71b4bee73b25601fee23737527c707b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409873, "uuid": "b7431394-2f66-4a70-9c38-63d39ef659f8", "value": "T11FC31956F8814B21C6D712BEFA1D118E332317B8E3DE72228D245F2477CA56B0E7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409873, "uuid": "b8092462-b35b-4685-9ca0-9e7bd331e550", "value": "3072:TmjkMRNpZ2JesCtSDm5a/E3RPHzumFK6:ijHRNpZ0Ct0WaiZzuUK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409873, "uuid": "39c0a7c1-1c3b-4294-95ad-e6bed0f18624", "value": 120632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409873, "uuid": "d4e395ab-26cb-44c3-b18d-d19629ca5d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409873, "uuid": "eec869b8-4372-47d3-a144-7fecbd012ec6", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48d8314-cced-11f0-a129-42010a9c0007", "comment": "Malware payload (Havoc)", "timestamp": 1764398202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398202, "uuid": "2b82e72a-38df-48e1-bb89-1343b21e5bf3", "comment": "Malware payload (Havoc)", "value": "b3872174f2a606accd8306b60085e69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398202, "uuid": "dbeced88-cc26-4472-8a75-0439bff90218", "comment": "Malware payload (Havoc)", "value": "b9c6a448c486cde5a856e6f4c7c74f46bede0f1249db139a0c7b27c9f71c52cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398202, "uuid": "69aaab82-05dd-4b4b-be3c-d2853c1d803f", "comment": "Malware payload (Havoc)", "value": "1159a21c512b1e66adf26369de0aa0a205e82ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398202, "uuid": "23995fff-3ffb-4ee1-a3f2-e35fbef48a26", "comment": "Malware payload (Havoc)", "value": "3c966771d92e547ec3f90b5bafe5e55141c531b9fc3871afa3143ccb9ccf2e363f7f13d141e76bc796eccafc159fc3b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398202, "uuid": "c09ff2e5-71a0-4281-98f8-ee4ecdc58051", "value": "T180647C6BEB1268B9C127C1348B97BAB17832FC195337F86F1699C7213D30E5027A9725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398202, "uuid": "01c9b105-00e5-44e2-b8ed-65d911a74334", "value": "c84e174a1740bb79c6b8b375416d55f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398202, "uuid": "00f5ce1b-2cae-40b9-b465-5f6853cc6d18", "value": "6144:OfmGLKsnPflv1993xNEruYBPthD/vIf/8oljMjrUNFC/555k555J555555555898:O/LF39yugv3S8qjMjK88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764398202, "uuid": "d8b0aa9d-b2a4-4f8a-b5c9-6bce48c03778", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764398202, "uuid": "ea7b2640-6dcd-452b-85b5-d657d361c565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398202, "uuid": "c224b28a-3d9d-47bf-860f-3a9b948cae74", "value": "SecuriteInfo.com.FileRepMalware.12591228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15964b0-cd09-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410276, "uuid": "0bf87aa8-ff61-4011-a2b3-81b266d37ec6", "comment": "Malware payload (Mirai)", "value": "ca89f72e71ad82434a2a95f72e39bb19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410276, "uuid": "4612d67b-a447-4c2a-8158-faf886673f1e", "comment": "Malware payload (Mirai)", "value": "ba4f63fad129eb60be3fcf0033d2d256d592845b561e97bbecf1aed54143e805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410276, "uuid": "b3b2987b-03f8-4946-9699-e717841d83fa", "comment": "Malware payload (Mirai)", "value": "30c0cd97a64e870c0b771932c95e2afec5e12316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410276, "uuid": "6ae01823-3ec8-43db-a276-9d011f0191a5", "comment": "Malware payload (Mirai)", "value": "dbb99c07288e614ab8dd922c51bb81d7bca9e751185ae31dada03ccadd861409c6348eaab64a2171ebbf6972c6b4d98b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410276, "uuid": "038bca98-b585-4832-ad1c-1c7ee7faf20e", "value": "T1D94302E28656E582C6E40CFCFAB69AC64A321584EDD3563F23406BD1D84D49AFB890D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410276, "uuid": "f7c9f62a-6711-4a75-886b-52bc2895dabe", "value": "1536:twYhcnk4RUUP9NkT3BRnUtzIIyGoxWQHlgz1I:+o4+v34zy1WfxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410276, "uuid": "d7a03843-8d5a-4d5b-9203-24b147fc444d", "value": 56344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410276, "uuid": "9948cdc3-187d-4881-a686-7093afbb76a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410276, "uuid": "78471ede-a3f0-4c60-ba09-053aa525dd86", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02afb195-ccf3-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1764400454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764400454, "uuid": "324e083b-9db6-44cd-8c43-67c620609bf4", "comment": "Malware payload (HijackLoader)", "value": "ad702794a2c7a8a28e4d7a7744cf543b", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764400454, "uuid": "28fb1e99-cc50-48b5-a18e-8f2e4e5ed806", "comment": "Malware payload (HijackLoader)", "value": "ba8f2313b3398187c424d9abed5f735907d01ebc9a11077136d2919e369501d6", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764400454, "uuid": "9e1cb37c-92a9-4900-8b88-6fca42aa3e4e", "comment": "Malware payload (HijackLoader)", "value": "29bd0126089dc53f053a59cbb62bb05e9fe943b3", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764400454, "uuid": "9a4f0fb6-a0e9-4185-b67b-e5dc0e12d3cd", "comment": "Malware payload (HijackLoader)", "value": "c7806c27c6cd10d725d80ae11aa01b62d48a97c8c55a1923238ec9ca676a864ba2c265be7abb88ba8e2767366c8101be", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764400454, "uuid": "8d329da9-4724-4ee4-a6a4-7985c2caae9c", "value": "T1F326338BF9D0BCA6E44302731B2A70DA0356ED160FFAF25F40567E1806B45B5F9AF612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764400454, "uuid": "eac14a54-4526-4535-bb4b-a98067b8d711", "value": "98304:G1rTSU5KHlwQXiFh/1qr5oKYofuc85UjtZHL4VK7FTLM:GhmHlwDh/1uo5ofuc8ytCK7FE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764400454, "uuid": "ce30357f-992f-4b0c-a71f-a0cc93cf86e6", "value": 4620288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764400454, "uuid": "f61f6def-07f9-46be-806b-5d2e78e903d1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764400454, "uuid": "2c154591-eccf-4e2a-b286-01167f0aa65c", "value": "MRXTOHRL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b498f15-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764413004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413004, "uuid": "74d08103-64f7-4145-8420-3caf561c1317", "comment": "Malware payload", "value": "5325c6c79405f80c3d243c9f35f3e4b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413004, "uuid": "6b2dcb0a-6e0c-4c10-bcc0-5df72c212eb8", "comment": "Malware payload", "value": "ba9923de60e31b49b658d48489b84e6c6498381efbd4e714726a5c40516b4a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413004, "uuid": "d3150c6a-cff6-4280-9cdf-4143715882fa", "comment": "Malware payload", "value": "59d877b303343777524b750792b4db46b90ea7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764413004, "uuid": "5a211b14-adad-4ddf-a592-1c428d10f1b8", "comment": "Malware payload", "value": "2f1c13238b35a1a5c11e2b7f394eaa8177b533b9679b63bc9b328da130e4205ec4fc01bd9fece50c9ab26a5db50b7665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413004, "uuid": "06b40adc-4cc7-4d22-9109-dc3f743b5c36", "value": "T11145BF3238C28073D6A24170557BEB39CABD6674173285D7A3D45838AD726C1AB3E37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413004, "uuid": "50e664e6-310a-42dc-9215-6766cc3beec5", "value": "b4f78474edfef30df1432a65dab0a0bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413004, "uuid": "16dceb32-ca40-4244-aa2f-d325403f9d81", "value": "24576:qcw7UtrlugWvwWyj9l1cRYAQ7lg35P9CTnCW7NIS5q92ojeltPmL1GEPww8XKccE:xwIh7mR8P7NIqq9TjeltPm5GEPw7X3cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764413004, "uuid": "e184d4d9-5d2f-4f28-9b78-6fb48f51e6e4", "value": 1211184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764413004, "uuid": "b085eabb-1a30-42e4-8378-99aedaf9d70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764413004, "uuid": "e1dda4de-0348-4cdf-a216-0fd274b911c2", "value": "\u5144\u5f1f\u4f20\u5947\u3010\u590d\u53e4\u3011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c2d980-cceb-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764397209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397209, "uuid": "f2f19333-7aed-4597-b4b5-c1d889b6b398", "comment": "Malware payload (RedLineStealer)", "value": "91cbabb559eddc9b84d4a047d083b3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397209, "uuid": "467a4e47-6043-46c0-891d-0a09253aaf3d", "comment": "Malware payload (RedLineStealer)", "value": "bad7a477675a09a5b609330c1e77bade3d8746b01735b3f61b2dfdf0e42b8865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397209, "uuid": "a40addac-81e3-4971-8824-4b6a33743c2e", "comment": "Malware payload (RedLineStealer)", "value": "23fde9ece884d90b9c91a7b362b7dd62bb5ab669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397209, "uuid": "00bf0dba-4d1b-46d4-a58d-308c0ec71079", "comment": "Malware payload (RedLineStealer)", "value": "7c07b2e1b4b4c431bfa9269a7997d55e88779b27709b32169f144a3404978494dc0fb62fd27e8bc7ea29d3f2d10e8ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397209, "uuid": "b3710d34-cf7b-463a-b978-49febe3ba772", "value": "T1EDA35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397209, "uuid": "17d3e83f-2b62-4b0f-a94a-2f08aef88c6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397209, "uuid": "0c8645cb-6dde-4927-896a-3bf35ab516a4", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2s3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764397209, "uuid": "7b50086e-fe73-48cf-975d-7676d90fd7f1", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764397209, "uuid": "f1bb91de-cf94-4df7-a694-c37796335f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397209, "uuid": "c36c6b1b-58e9-481e-846a-116508be9492", "value": "91CBABB559EDDC9B84D4A047D083B3F8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cf061f-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412933, "uuid": "022a4e99-4d73-43cc-870d-9a3167144e9a", "comment": "Malware payload", "value": "e434bfd05fd5ef38667ae12968b58a14", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412933, "uuid": "3133e152-296b-4b47-892f-4f19abbd55f8", "comment": "Malware payload", "value": "bb20f076894b26a4e0efb98192ae4ce9809e4c00ed535d505b099452f5a0a86f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412933, "uuid": "37b05ea8-0651-4729-b6c0-488e5fd1f837", "comment": "Malware payload", "value": "73c933b9b8ddd1e07c7a77b148f44eebcb5fa732", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412933, "uuid": "269542d4-8bbc-4e58-a277-c2c6f23f942a", "comment": "Malware payload", "value": "8fc342ca487c8359d74a94a4f62f90578bb6f8e29db77b397ea93105dc24423a606108c14fe855a37aa41bb5445f26cc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412933, "uuid": "9423d0ed-cb79-4185-9ceb-3c1315ca2fcb", "value": "T113272387F7989A2AC47340F14D4E4372266B4D198E43A34B7D44375D68B3AE83F4ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412933, "uuid": "86cd02f8-7ccf-4d76-abea-a30ff428c68c", "value": "393216:HRXyyNHd/wLbjxwfRoZ4mICS9b5gHi/KAsaQhDznhv7qTIq3qrmW6JRiGyYGLYNO:H9yyNuLJwou3CggC/KJhDp2cjrmW3NYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412933, "uuid": "626f412c-5220-4d56-b86e-d627f4e1e296", "value": 22295333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412933, "uuid": "40231fa0-567d-4a5c-ab1b-540bebabd622", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412933, "uuid": "4a04b06f-d11d-4dab-9e64-a084c1b4eefd", "value": "CRICFy_v5.6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a9a5fb-cd25-11f0-a129-42010a9c0007", "comment": "Malware payload (Poseidon)", "timestamp": 1764421986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421986, "uuid": "d5a7f8ea-e241-4104-a7e5-a1bce671bb65", "comment": "Malware payload (Poseidon)", "value": "4f76c0439421442ec620db7b7e5a34e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421986, "uuid": "1483c6f7-fe75-4c8b-9767-91af12f456f7", "comment": "Malware payload (Poseidon)", "value": "bb89c48e22795d4b1a9e0cf46778b7120797186faae0a688c4b2efc1c2813fbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421986, "uuid": "c2cd28db-fb52-4205-8410-11a968ba1e0f", "comment": "Malware payload (Poseidon)", "value": "c49551e0c949fa5c6f1a77e22006763aa0db029a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764421986, "uuid": "4b9cc0b9-1aac-4bf0-b413-df4de44b8e3f", "comment": "Malware payload (Poseidon)", "value": "b1e5787b9429987f30452369b32fca489f6684c07ee858c9b3aa27b6d5efa4e738302386eaab1ddc3e21e825eb38680c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Poseidon", "colour": "#D69BAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421986, "uuid": "d24680fe-de7b-4eb3-95fd-601e69a48ff5", "value": "T1D1373C43E8E219A8C4AAC174D66A8167BB727C0D1B3C23DB17A0F7701F367E06A79751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421986, "uuid": "b77b8843-f8c6-4d40-9df0-2a0dac8a2ff4", "value": "98304:WJiYX153r0GbdxPddOvx40+PrYbOKQ47iPNwZsUBTnUVDrfjyTMiU+WpXb1sJKK9:WjD5xFCxJsrYtQ47INwhurGJmLfJsBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764421986, "uuid": "e32cde39-b133-49ae-83cd-9bdb357f42f4", "value": 22518424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764421986, "uuid": "a5902bfc-b0df-41ce-8959-46455e7ca41a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764421986, "uuid": "66f4b7d4-dafd-44be-820e-2a9ba358b5e2", "value": "poseidon.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577d1aec-ccec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764397590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397590, "uuid": "b8539092-f43f-4ca7-a4ea-0ece23f59496", "comment": "Malware payload", "value": "73eb197966032c0629c47eea08521354", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397590, "uuid": "be3172ef-dbc4-49d2-93cf-009e60daa12b", "comment": "Malware payload", "value": "bbb89ff309832d5c3c09d4d75a825af2e16501b1df397342b65e2d7807fa7852", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397590, "uuid": "35a00177-2acf-4396-a671-c01d3a02b323", "comment": "Malware payload", "value": "bbcfa997dea8e997cbdbb5514f72a779438ec827", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764397590, "uuid": "cc2384d7-5fed-42f5-b95f-06ae147d83ae", "comment": "Malware payload", "value": "a05a8082c0d9ce222b6e9b1e497043d6a2873fdc43fb22cb5ea8aeab0832f3886492f3b40fbd9779a93759b77e773755", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397590, "uuid": "ee50690e-01d8-43e4-994e-32d457c246ac", "value": "T1D001F9BD91A88A5205B5C5C7B2F54546C490D08BA2FE57E6F38D09266F28CDE3C5330D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397590, "uuid": "611ebb16-e275-45a0-878e-d0ca4fc61281", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+GSjRCkV9GDClkV9GDoBjZhG+E6:FH8j/wWi2jzCmPV9TSV9lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764397590, "uuid": "85702921-142a-4426-9e79-b4c3203d9cee", "value": 736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764397590, "uuid": "6eab1152-63fc-4c23-b307-59c88397ac92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764397590, "uuid": "d4b968f8-0138-4818-a515-fd1980fe4e56", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6c4e9c-cd71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764454934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454934, "uuid": "7e1a454f-8bc6-4a87-96be-7528ff14f53b", "comment": "Malware payload (Mirai)", "value": "22458d1e55ab4ab34541bef7c7ff364c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454934, "uuid": "73d15e3f-1138-4ef3-be5e-33507cb9b798", "comment": "Malware payload (Mirai)", "value": "bbec00437de4d324bc6e406908c36535933aad2f41a77a6b3a097030a2356e8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454934, "uuid": "6a4b4103-d042-4df4-8f23-e79078ff235f", "comment": "Malware payload (Mirai)", "value": "b481bcb1d44ce51aad004fc6bdf8c07dab0e89a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454934, "uuid": "c7d83e15-5888-4ed9-ae62-911d4e526ddf", "comment": "Malware payload (Mirai)", "value": "5d8bc60bba864a1dcd80ae93fa84ff96a696711d1f257052e76ce51624f82f3c2859dd1c5b949a468502e72e9ac9e171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454934, "uuid": "68fed140-4e1f-4434-b9de-cd8fabc0ffeb", "value": "T181B34B03B9C29CFDC046C034477FB936D925F0EE2638B29B67F5AE266D0EE600B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454934, "uuid": "bc0fb240-4957-45c3-94a4-43c0b9222864", "value": "3072:emvsrP1O2m3v9yg62bUQuTcGcLlumTThDygiEmEea:emvsgv9yg62bUQuVYTpixZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454934, "uuid": "691759ab-defb-4ef2-8b8d-f95ccaafca7f", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454934, "uuid": "1b662cf2-436b-46bf-b034-2e37a959dec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454934, "uuid": "6c795f28-8e1b-4aff-834b-bc93c8c4c19a", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e9e6a3-cd1a-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764417310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417310, "uuid": "45a8a53e-4d00-4289-aa6a-72cc121b8c8a", "comment": "Malware payload (RemcosRAT)", "value": "443adb5dae7a2e747608c996d9d54972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417310, "uuid": "c6792a26-6b1a-4d25-b4b7-e58ab60f7ec9", "comment": "Malware payload (RemcosRAT)", "value": "bc7887b7012dc107b2eae0e8b0676b1df008371eb342c156f23cefadb7777845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417310, "uuid": "54431d21-62a5-438f-889a-bce67d465356", "comment": "Malware payload (RemcosRAT)", "value": "c02c01cadced9bfce65d8d32c88bb28e2422c3e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417310, "uuid": "45a90bbb-1558-45df-b4ac-f36d4fa6b421", "comment": "Malware payload (RemcosRAT)", "value": "aa77aad801a8a88c4206c8eaa919b6e5fbbe1d182ad8d61dd08da583b4e2db2c02274bd7b8226cb40b823808829843fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417310, "uuid": "64085319-3e0c-4168-9f60-2bbcc259d1c9", "value": "T1B9B4AE01B6E2C1B2D57654300D36E775DEBCBD102836993BA3DA0E57FD70190A72ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417310, "uuid": "ce0f3751-62c0-4e89-9933-cc9c891e43c6", "value": "cddfe8e303eaa8b61ff402273a99dbf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417310, "uuid": "2a7d7823-ecf2-4476-8c3b-af15cc97d45d", "value": "12288:tpLwt0eOWdGeNovfPrazoXfBE3VYzp+sPZPc:jwi8dzNcpXZE3VSptZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764417310, "uuid": "dae62817-3ec5-4e07-b850-6d406664fc1a", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764417310, "uuid": "43652a2a-e0a0-4a80-9998-7b79456fe879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417310, "uuid": "ffc01597-6e5e-4fee-afef-c3611d5a1c44", "value": "1122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0bd561-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389141, "uuid": "689c56c4-a703-4b0c-957a-38b9e93e0045", "comment": "Malware payload (Mirai)", "value": "420df10085bd16eadb29008de43601b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389141, "uuid": "fc812e66-572b-4d50-a8e9-b16f6a70457d", "comment": "Malware payload (Mirai)", "value": "bd48fb3dd067a827d6ea8ea03dccb6b9e2d48ff5d014d4ba2e8a7cb32fd25f9b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389141, "uuid": "01678e9b-e4ee-41ed-80fe-8cc3d283fc03", "comment": "Malware payload (Mirai)", "value": "c98cb4aaada58039010800c0a4d6285925db2071", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389141, "uuid": "5a7d9465-1ddd-4e74-bbbc-5a021427e879", "comment": "Malware payload (Mirai)", "value": "018b1e7e5f854c8f3b84955ea45a92293d3f02b300e31a6335ac2c6fb51ca074108b459b562c20aee584192a0c247337", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389141, "uuid": "d6c87164-b003-426b-97a7-20544c4c0805", "value": "T1695190CA12524F316CEED92F77B988883184E5FBB4C6DE24D9DE78AE448DE0DB040646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389141, "uuid": "103fca66-e13d-4d2d-b152-38e10c99998f", "value": "48:iDO8DviD8wD/qDpmDR7qDtitGDaMD5+lLD2uXJDbaD/SDIMxDEIDjl3:ifO9+McBDyLr6OHxdd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389141, "uuid": "55af6e8f-23fa-40d4-bd2e-0b13190dbb6c", "value": 2564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389141, "uuid": "daf32f96-78ea-4098-9e05-0f14846dacb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389141, "uuid": "efe960f7-e997-4df9-a2fb-64b41836add1", "value": "syslogs.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32af44b-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393502, "uuid": "96ee996e-0641-44d0-8ed2-8e17af951ca8", "comment": "Malware payload (Mirai)", "value": "683ff0f4c4be45bc70bdb5f1bbee89f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393502, "uuid": "9e547f3d-4850-4384-b343-64d7b72593e6", "comment": "Malware payload (Mirai)", "value": "be841e28592080fabdb0e3297c33c88e52c0497aa443f715197e7274b62ea834", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393502, "uuid": "babc8c7b-5e37-473d-8a64-f74b5bcdb070", "comment": "Malware payload (Mirai)", "value": "d6e8a6124524deea995bad87b92686f682a5de88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393502, "uuid": "88b05d54-c0d0-46d0-8ac9-c55b7bd73c48", "comment": "Malware payload (Mirai)", "value": "70aaff8fedb747a70619b19dcd2c6d43b5ef5b790a93849f239b632726f149b82a982ea09b1a447e72271bbedebc2777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393502, "uuid": "9b5d3453-c36b-4604-a914-4fc9fb5dc97d", "value": "T117630A5AB9819B15D5C112BAFE0F128E7313176CE3DEB3139E24AB20778B56B0E3B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393502, "uuid": "0ea24220-143f-4084-afdc-c127ef54854c", "value": "1536:dAnYOUC+FFakFfah2F5+2yMviCIUo0inoI5+YUEVv:4+mifaoxIUo0inoIkhEVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393502, "uuid": "1a97db4a-cb95-4a67-9940-2a92fcc42a11", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393502, "uuid": "1acae7bf-755a-4b1d-b4c0-f2ed636d0b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393502, "uuid": "9526ed76-d73c-45f6-b833-576698f14577", "value": "niggah.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c997d6-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389510, "uuid": "7755b07a-a135-42d5-9ed3-22f68160d72e", "comment": "Malware payload (AsyncRAT)", "value": "c61a475088a0100d1bcbb7f1886afc7e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389510, "uuid": "abd19764-9205-4580-a059-022f8cbbb835", "comment": "Malware payload (AsyncRAT)", "value": "bf0cd615446c2a245b275694f3641c5d5b57b304b2fec1cf6b09c9ee37ec1aa3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389510, "uuid": "c60b706e-e032-4b5d-8b22-9d0ce7c80984", "comment": "Malware payload (AsyncRAT)", "value": "0b4ca4ac4206e6b8cf463bbf2859ecf5af8d7d7a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389510, "uuid": "6e75f169-f98a-49a6-a1ba-1c8f4a3ce121", "comment": "Malware payload (AsyncRAT)", "value": "80cd05f3a3ee61f3507466c2d756265e7c5b37fb6deec71db70339443e15ae72d8a071f5dc0eb38c22e7a220729878ae", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389510, "uuid": "6d68d724-3ab3-4065-b57f-53c4d6b55cfd", "value": "T184948C16F79408FDD4A7C57489924546DA39BC8E0B71EAEF17D8422A2F237F08E39760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389510, "uuid": "d3dd6d37-cfdd-43ea-bc51-d2dad8697527", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389510, "uuid": "34600868-3d61-42a9-8c4b-fee450294fca", "value": "6144:G+GYnA0zeWiDi5eJHQ8kV3f+RysMFZzN/I/msHOtbMrtW8sXrw+g:qYkDi5eJQ7uysMFZzN/I/msumBk7Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389510, "uuid": "09a7a1f7-07d5-43fa-b9ca-56f65322777b", "value": 416140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389510, "uuid": "35d6f4c5-008c-4b07-8242-13f45059e78a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389510, "uuid": "d5df4b1f-e652-4355-8d71-50b938dcdfdc", "value": "vup78r33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aebb14e-cd71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764454665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454665, "uuid": "6c1b6feb-c607-43fc-932e-7f45a62360bd", "comment": "Malware payload (Mirai)", "value": "da7cf81c43a79620ea87a4d4852fdff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454665, "uuid": "75156993-9f51-4fcf-b9f3-f9ed631f3f6d", "comment": "Malware payload (Mirai)", "value": "bf3b6336ee6993488abeac29d4ed835c1ad9b5796e982aea8d4efa5bd2855a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454665, "uuid": "bd3ebe65-ad67-4fda-9ce3-9643c234cd11", "comment": "Malware payload (Mirai)", "value": "3ab59f8e62991ed7626491eae643220f5cc5d669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454665, "uuid": "c8b784db-442c-4e83-aee3-c16c3a9453c4", "comment": "Malware payload (Mirai)", "value": "4f31aa5eb3276452463443123d4ef18fcc6fe8952253764ab3234f97e0f24aa613333c82ce82ac80270b6eaccc169407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454665, "uuid": "d1328544-ad50-4a3c-a398-622f02a4b56f", "value": "T1C4636B21B8391E1BC0E4957A22F7872AB2F9534E24E4862E3E750F8EFF5558076472F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454665, "uuid": "51906e51-cf63-47f4-9d3b-98cfb539bbbb", "value": "768:IcowEe26GLAhfg+MhN2K1sv11FN1nD3Id1pvPnh3Ei3iaJbyqCDSgPoGO+75ZLo0:IcIMlhfgNhNvRPntVypX75mUotQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454665, "uuid": "06959d99-c63f-4de5-af09-982265436a39", "value": 72660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454665, "uuid": "afa9408a-b8fb-45f8-91f2-b244673b817c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454665, "uuid": "7c978c68-0fff-433d-82e0-555b97261791", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba6faba-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412924, "uuid": "58ee6d47-86a4-4905-9d32-ea688165b83b", "comment": "Malware payload", "value": "058f303509e3ee4756240e4b3a0ad051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412924, "uuid": "fff8b928-f5dd-4236-b7f8-ec897a007934", "comment": "Malware payload", "value": "bf3d9f3850b3885d320ceee994e2456a92c4ee7cb2cd39ae569e3efc5f5ee009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412924, "uuid": "5e15bd18-1ce4-439c-9325-57486068fb46", "comment": "Malware payload", "value": "118f84704bc97a65827ab7fb850dcd911f83d1d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412924, "uuid": "d60242a9-30f8-4f00-aa0e-9dbaf20d32e6", "comment": "Malware payload", "value": "ac4cc4b25d58f75489385e58353e57c11cff15cde39444b162659747eeaabde2cacb2b0c88830db82184bac243fb5ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412924, "uuid": "b7db13f6-337e-4767-b894-59323fea1aea", "value": "T10D860111D341C43AF9930171883E572EAA24BB30131594D7F3C86EAEA6FA6E37936747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412924, "uuid": "61991a8d-b680-4582-973b-9e457e2fb4db", "value": "69970eb87c1ffdc04fb7f80fcd567384", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412924, "uuid": "cb53a8c1-6773-4f27-9681-5516e1535302", "value": "196608:fnGA2t94BUpluKcwu7sq9Ku5vaNfCB8lw2QCyQXAC2Gg7D3J:PoLE9KYiN6B8BQzQl43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412924, "uuid": "4805a952-c1d8-42e2-9311-8b6a200a086c", "value": 8344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412924, "uuid": "9ff8f559-1f02-44a9-b8db-9133c80abd83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412924, "uuid": "05aee68c-c875-47a1-8655-2d089e56422f", "value": "!Launcher.exe_1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45d88fe-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764393450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393450, "uuid": "cdbcdb23-815c-45a9-ab3d-adf490560a97", "comment": "Malware payload", "value": "804e9e73395a2ef384f9897a85d721b4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393450, "uuid": "cd729495-cae3-4ffb-97c1-059a3a98b245", "comment": "Malware payload", "value": "bf3e52b9f053f41e8d108f29f3f813301b420a5c1e7654f72a0eac4af76b91bd", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393450, "uuid": "9b5941f7-a955-4705-9a43-5eb35b10a087", "comment": "Malware payload", "value": "e9a5524140235584e7ca12087d169447c416b1b9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393450, "uuid": "ee4ca386-c9c2-4cba-99bc-ddddb751e82d", "comment": "Malware payload", "value": "eea794817b14e6146d7b10289386a5a21f5ff914d159de65b4aaa16946a66bfb4262597959183388b47abba68ce0df75", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393450, "uuid": "20025e3e-242b-4aac-a888-caed0373a33a", "value": "T1B87355890DCBC0EC66E774E485DF8C02F7A54923161CDAD1BB5DA9A0AF1163CB1F89E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393450, "uuid": "81846edb-b2ec-4328-bc82-7aa98b4983cc", "value": "768:t0vZlnfoRpgAfONWddSHI3EOgf2DabTIWupmDwu2hwrhqrby1/oWiTGf54eupaq2:tITgeo6PsEJCPTLEHaCDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393450, "uuid": "40018386-5be4-46d6-97f7-0bd726bd51d2", "value": 76015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393450, "uuid": "7f87bb77-9876-49a5-82d0-307f2c735486", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393450, "uuid": "4f54686f-06de-4431-ae49-30c534f5b57e", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca235559-ccdc-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764390910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390910, "uuid": "df1ef4d5-53be-4654-b05b-9daccbfb3646", "comment": "Malware payload (RemcosRAT)", "value": "63fc36bb8c38d6a3b85a68086198766f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390910, "uuid": "0792abbb-fc3a-405b-86d4-d6c8b491740e", "comment": "Malware payload (RemcosRAT)", "value": "bf68190a743215ba83339703d99ecb3507f00182ca1fc4dce9a472e4b0c5f757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390910, "uuid": "1af41969-2342-49d8-b02c-fdace752c504", "comment": "Malware payload (RemcosRAT)", "value": "03184b777ee3ec7ac39a0523f1dec97504de00db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764390910, "uuid": "7be6567d-b008-4b41-8486-7f5366c1e627", "comment": "Malware payload (RemcosRAT)", "value": "0c86ebab8af44d8465c46607d77334f3d0df7378630c387c24e52721f6fefe6fbcc62fefef2799fa645330f84f0e1ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390910, "uuid": "29081a73-5307-4b46-abec-f40cb2436b1f", "value": "T14D1523182794CB22DCA42BF31973E37113B22E9C6531E3169EDE9CEBFA167114855363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390910, "uuid": "2d1367a4-69c6-4945-b803-b078c74eaecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390910, "uuid": "4d849988-ce9d-49f4-8f47-595b6043d4d9", "value": "24576:FkkVajrVimmiySFGlTWnFhw9X50YSDuxHrsQFXU10Vl:Fk9fVTmzS4l59X2YSyBIQhFVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764390910, "uuid": "a74a9830-649a-4eee-9643-9433b6fdc5e5", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764390910, "uuid": "384f01b1-934c-490f-abc9-e8aef65d7580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764390910, "uuid": "817ab02f-4439-42fe-ae51-8f11c9777555", "value": "63FC36BB8C38D6A3B85A68086198766F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63035cc8-cd6a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764451725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451725, "uuid": "1bb4a5c9-571e-4d08-85a6-87b4cdc8508d", "comment": "Malware payload", "value": "f4691075cad53bbf24b7957f38c00b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451725, "uuid": "3668946c-0e6b-42c2-9812-e65c203f080f", "comment": "Malware payload", "value": "bfc96abe978e154086f793062458b43ca9d570fd8c62c47c0d4ad0d3e1edbbaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451725, "uuid": "bbd7c69b-d1a3-47b8-a8f9-edb5c4edccb9", "comment": "Malware payload", "value": "52714948719d3005f0a50884bca8ae1909f6ffd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764451725, "uuid": "caa3e0e5-9344-44b2-a294-ad06baabeea5", "comment": "Malware payload", "value": "b15c5527e80340163dfe4b20d2f3f22f146239cf74daefe28d1cf54504996b41c80a95cc32795218c9505eebcbfdd8a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451725, "uuid": "a94813e8-4461-4f37-b0be-ec63472482d8", "value": "T1C5561213F24E633EE47A59361972AD10953FAE60641A8CA396EC3E4CCE395901D3FE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451725, "uuid": "d7fee286-18a2-42c8-85fa-62689cb655c2", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451725, "uuid": "74052d5c-553d-4160-b50d-52f597ee6c13", "value": "98304:rDbXTBNILSN9Snq33G2vFoTKFnX1HoVjIhXrrcT3iYpKJ0JNf4faxA:rDbXTrI63G2yGFn9QjMrr6pKScaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764451725, "uuid": "49aee316-43df-4a70-9d22-5111fd996df9", "value": 6380280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764451725, "uuid": "a3b33957-b36a-42fa-a7ce-0a527b60af41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764451725, "uuid": "4c553985-695e-44df-b2e1-db403aa17f38", "value": "MaintenanceTool_1295.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bb3d24-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412971, "uuid": "6c86c823-d56c-4ef4-9792-4b6b0351c460", "comment": "Malware payload", "value": "49e202f3c3ccfb9f6b20ed9b67f689f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412971, "uuid": "fb39e017-02e8-4822-9688-f13d6b856295", "comment": "Malware payload", "value": "c128ce50b40bf6771789eb5b01c39bdfb457686abddbe692ba81f2f4ada4877c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412971, "uuid": "d103f2fe-59e0-462b-ae17-721a374e6897", "comment": "Malware payload", "value": "2cb14a83976f0d2fd124005527e3b3aa3f90e0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412971, "uuid": "24f8b5c8-a28e-4f78-82ac-60830d0ff545", "comment": "Malware payload", "value": "739315cd36430c62b19ce1ba2de97763501688b3a48c79eb14bc6aaa98d2aebb79ddd5d78c4fc32790ef70dccf9d3b9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412971, "uuid": "64668a93-1f5a-4ee8-b39b-eaed9d38435b", "value": "T10A2522898DA6D566FF83803CA9B26F8B476205BB60B74DE0CB513C4C447DEC87B416E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412971, "uuid": "6dd5ad83-25ee-416e-ad60-da02ab9cad77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412971, "uuid": "7c868b4f-e7fb-43a6-bc7e-a2490be4320b", "value": "24576:XYLDNS1i6+1SCtkwkANYtLDNS1i6+1SCtkwkANY:GMin1SCtkvANMMin1SCtkvAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412971, "uuid": "ff387a57-59a4-4ac8-bfd8-47e5f499148e", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412971, "uuid": "dc37c58d-5f9f-4a1c-a188-fc41dd5b663a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412971, "uuid": "90faa3b9-dc64-4831-9c91-5118772f3362", "value": "NalockUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76288db7-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389910, "uuid": "9add537c-6936-464c-99a6-1d9196a3b8eb", "comment": "Malware payload (Mirai)", "value": "194ea952c8a60f71a78d8305117598f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389910, "uuid": "99044bc4-7be6-4af0-8d77-ba828d364a98", "comment": "Malware payload (Mirai)", "value": "c19dfac3c3c3c0b8a24170bfe71f2b2fdf357029cc407620292142945574c66b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389910, "uuid": "09909b57-7c6d-4d22-a76b-92e19d835816", "comment": "Malware payload (Mirai)", "value": "61db4ce77444b8ab27794313c269cdb4616bbf99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389910, "uuid": "ac3a534d-120f-41d6-b469-78e0baae0e35", "comment": "Malware payload (Mirai)", "value": "f3b5a871e9a8b4a0f574fa08a6ed34eeb7b5a330fc69113bcfc3f2cf82ba872c26bf8a4b0a9dd1a6d0687e3aa7dd2239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389910, "uuid": "e1069b0a-4c89-4b95-8eee-edc6d3165301", "value": "T139D36CC4F64FD0F6E81254712127B7369B76ED3A103EDA43C3A99B369CA3581C91A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389910, "uuid": "5a452014-66d8-43da-9008-d1ddbc9e1688", "value": "3072:o58NWobg8VHFrp1Qne9iEnrDRiwuiQ/0vdwz8xB:A8NDbg8VHgUi4SfcvGz8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389910, "uuid": "fca0e48d-1ae3-484b-ae6d-b753d37c0299", "value": 136428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389910, "uuid": "14d9c670-a7a8-4517-b09f-f23ced2a00ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389910, "uuid": "b492651d-9345-44f1-8b8d-ef99505dfcdc", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05661824-cd5f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764446844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764446844, "uuid": "ae3e9e33-ac58-4d62-af79-c22cd1cb8e5a", "comment": "Malware payload", "value": "cde69e53c34fd3d7d4a65d8e350235c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764446844, "uuid": "f419ee74-f0cf-4f77-9b33-422fd58015cc", "comment": "Malware payload", "value": "c20e81ed44fd96c4519ccff9472548aeb95a757a743025eb05a33a64d188b403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764446844, "uuid": "93cfca85-c573-4746-b832-49c8b0e4eea2", "comment": "Malware payload", "value": "67bed377ea1ee2a576a4506f09c61ff54dab0d6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764446844, "uuid": "ae6f9657-ffd0-492c-8976-88efa0f2a6be", "comment": "Malware payload", "value": "7937642842f7cc4dc14a44dea58d28175ce670a87e0b3846cfc09f1da90ad9dbf3dd77c7acc3f13fff09e3d0c44d2f7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764446844, "uuid": "6e783b56-15d8-4e0c-ab45-c351619dc4ed", "value": "T1D3A549026E5A89E9D58DC874C2868AA75E2230CB0B36B5BF55C5123C3F6F7F52F1D209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764446844, "uuid": "f1a47c6e-ecb0-402c-a61c-d4edefd04387", "value": "c9a611cddd2566d176e1876ee1b921c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764446844, "uuid": "7670ca56-20b1-4935-b17d-83fdc9b2249a", "value": "24576:j5DTESceAw36scUYHKI9OJagGZfizfNVkv3c7f8Af+fM/jIuMr:VDVcuqscRbkG4zfkv3c7f3GM7IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764446844, "uuid": "62c26176-6376-4cbf-a88f-c7847a0dde43", "value": 2171392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764446844, "uuid": "3ae38870-b77e-4c49-8098-211800ee4b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764446844, "uuid": "ca1a28f5-c88e-4c04-936e-7ffc6c3a7586", "value": "pc_info_sender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab429ead-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389140, "uuid": "f1592bd1-3aee-4dc8-a5bb-827902670001", "comment": "Malware payload (Mirai)", "value": "4022588d26597bcd570d5f420e017d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389140, "uuid": "20bbee03-f02e-4730-bd0c-86f249bfcb7d", "comment": "Malware payload (Mirai)", "value": "c2486e32292cc3db292a13be8596bd6da104f2a8d8206562b54aad44b6282382", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389140, "uuid": "fa172baf-0371-4de7-b6e6-a1110501f87e", "comment": "Malware payload (Mirai)", "value": "4c015106540f13b631e32ef630017cd16dd837bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389140, "uuid": "3738ef76-3517-403d-be35-d477d2c4f662", "comment": "Malware payload (Mirai)", "value": "4e8e6ec6df1dc3c4e7eda45e656e03d2a5f96f6358f69585dc3b00d21aa6e6fba82a5c2116fde71470752d90fef36f5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389140, "uuid": "f5187e5a-60b4-460b-be9d-fde4aff67444", "value": "T1FB143ACBF800DDBEF81BE67A4C534805B130B7B250925A377257796BED3A0A50527F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389140, "uuid": "1bdcc053-ec27-4e10-ab5b-488a5281c5cd", "value": "3072:wLWff7FkwVQ+fJ5A3bSdj63lc7u/yUbRNY2gD8XvD3opIED2VKjbiZLQSzlFYxX:57FXTR54bSdsyUVNY2rXUaEDQLQSrYxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389140, "uuid": "c4361f1b-3744-4af4-afb0-ae5deb94c199", "value": 193664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389140, "uuid": "30404b10-9c63-4e3c-ac29-718ed24d4fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389140, "uuid": "aa29156b-e5cd-481b-85af-88ee211d16e6", "value": "Polar.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5815d9e5-cd5a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764444835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444835, "uuid": "6b079678-3f16-41de-8a38-d9419e6443cf", "comment": "Malware payload (Mirai)", "value": "b31d28cb96bccd88b17a50d870a6af65", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444835, "uuid": "24b4c84a-9a4c-4045-bdd1-1795fe54bdbd", "comment": "Malware payload (Mirai)", "value": "c365eb8429b8efdff9f8d8e2b9783bfbb341cc815633161bbddabf19d4965bd4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444835, "uuid": "6c74f6d7-ea5a-460f-8ffe-90dc483e3cf8", "comment": "Malware payload (Mirai)", "value": "933c55e72898ec23ecb78ffdc7812ba2156f1978", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444835, "uuid": "420c9232-b448-4b3f-af30-d1c9748d540a", "comment": "Malware payload (Mirai)", "value": "35fccd0d5fea53623c8f9490fb63727ffa4499abe3dff52a1255edb42b893e9abe5dc8ed6beacc43e3c85a9b829aa241", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444835, "uuid": "17217be8-343d-4857-ae26-a4d9ccd04c9e", "value": "T132513E5D19B189312991D8BBD25AC68D30A190F74CBA9B81ECCE31F5C0AEE463478B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444835, "uuid": "e7e4c0ac-935a-420d-9ba0-1a05c31abd89", "value": "48:vXyfp3G5JZXnVjVEfsWTxG/hrb0SolnCsKe33WgrB4i937aharnaeVcaxq:vXyfp3G5JZXnVjVE1TxGpAzlnCsv3Wgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764444835, "uuid": "b4727ceb-74e5-4709-8662-e5787d4986e9", "value": 2562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764444835, "uuid": "f0c440d5-cd87-4dde-ae55-e74c5247ffb6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444835, "uuid": "d9846b1a-6716-43e2-a3ef-63d88edffb4a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6123ff-cd1e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764419076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419076, "uuid": "2c06654b-551b-452d-ac75-a36f9f94e161", "comment": "Malware payload", "value": "33e941ec8735150c25589cc9fb35a892", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419076, "uuid": "0a20d67c-c0fc-4d53-9136-4188111c05b3", "comment": "Malware payload", "value": "c3773ac6e1dff041a08823c51c99183671fa16b5d4094df230b545169c78ed4a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419076, "uuid": "4d68c5af-41b0-4199-81bc-8031e6f96662", "comment": "Malware payload", "value": "41822809c5a7de397fbe1474f4f0b5bf2e133116", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419076, "uuid": "50200572-3fae-4185-9400-e8581e70af0d", "comment": "Malware payload", "value": "b5e59f3b4857c546ac7a1a84a85537e30fda5fa85e6a476d34432d1367504ecb909461b01386f4e3aa01a47fb8afa40e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419076, "uuid": "740194fb-0bf0-4762-a40a-ea0dc97c2c48", "value": "T17D7364994ADF94FC6517F45489DF4C11E7E684032A1CDAF9BE8DA9B02F10C38A6F48E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419076, "uuid": "f5ac4942-4d9f-459e-a051-b7d8d52bd85e", "value": "768:OJqeWFT3pWFTbGpwCuGAYny7bm9xowerWj6r9F4utvrSCLS8/DAvpbmiuK0TmGwD:4XF0vheI6XFPah0HvLC8kZyPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764419076, "uuid": "9539bc16-63e8-4b9d-a78a-c83bb97e0a19", "value": 75950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764419076, "uuid": "3e634fe2-0ba5-417b-9822-460337dfbe36", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419076, "uuid": "943311de-6caa-4f66-be19-43bcc3900a66", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f78c9f-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412972, "uuid": "a0062720-8f77-4d52-b1e1-875ad0e0740e", "comment": "Malware payload", "value": "599af99247466bcdd516c63e24f143b8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412972, "uuid": "325ce36c-d517-4b83-a58b-7e8d86375617", "comment": "Malware payload", "value": "c46ec1f2ad91dd0d7930c5cb627761f7e42cbcbeb1b1ef377701b97ed75c918e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412972, "uuid": "12bef270-25dd-4d96-a068-be81b2e406a1", "comment": "Malware payload", "value": "ac7d58fe2c0032d1b335038eb554a3fd2f899832", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412972, "uuid": "e99c7233-d6a1-4c81-929e-0686f4089809", "comment": "Malware payload", "value": "c65b0ec1ce21667166561c08bced6e4d14e08fa54de6e54d7b9502049d0709fbc23e87adf16c5f89d53321c549c78d6d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412972, "uuid": "3ebf8c38-f5dc-4e19-9122-60847611e78c", "value": "T197472316F3486DAFD8F7D3346D7B06A22015AC25CB07D58BB928B33D29F79C59A4A1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412972, "uuid": "7c4eeb87-24fe-4722-b232-2098d0f9225e", "value": "786432:FwJvSUfrsWkHvWKNpidrs2hb/JQZhoAB4e:FofrgvWKNpiR/pRWhoJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412972, "uuid": "8457c183-d294-4283-9a6c-d5cb07a2faf9", "value": 25392739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412972, "uuid": "15c892dc-ad16-46d8-8fa9-dafe71697e3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412972, "uuid": "2fae4ff7-b982-4911-ad46-78888e421e40", "value": "certificado.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c908ba-cd7d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459864, "uuid": "29bc78e1-3e8f-4b72-9a84-4f5c60d4cc37", "comment": "Malware payload", "value": "41c21594a0eace4094ae594bd86aad06", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459864, "uuid": "9de3ea60-7301-48c0-bbe3-b89c955cc31e", "comment": "Malware payload", "value": "c47140f8611ea0e080f36fbabf208e6ac9e3658c67e47f2ee4641ac155e6e09f", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459864, "uuid": "5459a461-4b32-4735-8a7e-6e5a815b3f4e", "comment": "Malware payload", "value": "ae3c0f612162bd813d5e61ccbc1d80771ba2f2c4", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459864, "uuid": "38d7b501-3245-42cc-9988-161e09080a1f", "comment": "Malware payload", "value": "257dfd2a82e448fb1766f29e1bb6c00c7ee6128d0e67521d88858890083041bfe4acf74a1a1c8a99bd42e6913ebeada1", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459864, "uuid": "88f64098-a3f2-4297-9e28-2dedbd079b67", "value": "T14AD6336866D001FADAB3507CEFE41269E2B478760372CA9F4BE49764BE171E08D3D607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459864, "uuid": "1411519c-54cb-43ce-80fb-183e739b587b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459864, "uuid": "af2bd74d-6e84-45ab-9cec-c455eaeab0b5", "value": "393216:w95t1ueZOddt7EYu7uBMBmqXMCHWUjHcuI3/PjuUwO:w95t1NZOddJS7+YXMb88H/rAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459864, "uuid": "fb362e5c-ab63-4280-9191-b107e76b0965", "value": 12615976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459864, "uuid": "e2b763b4-bef5-4d74-bb4f-53f3625bf05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459864, "uuid": "3a719e57-2102-46dd-ab12-dea9b743160e", "value": "\ud835\udc1aft\ud835\udc52\ud835\udc2b_\ud835\udc29orta\ud835\udc4f\ud835\udc25e_v8\ud835\udfd26\ud835\udfe0_\ud835\udc2cy\ud835\udc50_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1a2687-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389469, "uuid": "d1152d47-45a6-4d73-8501-ebeb1fc2c73d", "comment": "Malware payload (AsyncRAT)", "value": "1b671a06f31f1805f101cd0f2251ab57", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389469, "uuid": "a480522b-2708-44ae-962d-da7022cd7a13", "comment": "Malware payload (AsyncRAT)", "value": "c59e51a5e0b2f61688dcb65782fcb650d2de5633e4ebf1a46062feddaa4fc569", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389469, "uuid": "abfdc3c1-5d15-4c31-a5c6-aceeef8605a9", "comment": "Malware payload (AsyncRAT)", "value": "89a0cead6a9519f422741c05367a6889d05ac77a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389469, "uuid": "4e63f3da-4cea-406a-a840-19bbd54ef9c2", "comment": "Malware payload (AsyncRAT)", "value": "10aca066d637487784d5dceacd6c9bee3e7338101ca3b5b64cf299a26a6725fb6dbdca4fab2947f42fdde8e01b77f231", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389469, "uuid": "07b4e375-a160-496a-a000-319308f3e710", "value": "T119947C16F79408FDD4A7C57489924546DA3A7C8E1B71EEEF1798422A2F237F08E39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389469, "uuid": "d08bd9bc-6714-4592-ad1d-c738cfec8bce", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389469, "uuid": "a82c14a5-b8ba-437f-b885-d0f3b2124638", "value": "6144:u+GYnA0zeWiDi5eJHQ8kV3f+RysMFZzN/EOtbMrtYNsNrwr:iYkDi5eJQ7uysMFZzN/dmB11S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389469, "uuid": "abe4ad28-839a-45fb-912c-007c0bcb1a76", "value": 416140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389469, "uuid": "6d43edfb-1078-4e40-8c5f-cd0289a7e00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389469, "uuid": "71e0cee4-afe2-4d86-9656-c9d969fe4cab", "value": "hd5nv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c6f5da-cd0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764411383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411383, "uuid": "a6960d01-6567-439f-94dd-33044f81cf47", "comment": "Malware payload (Mirai)", "value": "471749a65d4a9cdeebe037fb66963858", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411383, "uuid": "25756ad9-1e64-4ba9-a9f1-0f631b74926e", "comment": "Malware payload (Mirai)", "value": "c66891c613ea979d1d5f1640de32df1fd51bfc9e16a9264395135cac18e9d1b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411383, "uuid": "d98799f7-5225-4826-b1f9-8dfee5c2a2f8", "comment": "Malware payload (Mirai)", "value": "a24574256a9c9bc2def551fb47daf725a6c24337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411383, "uuid": "4c21e0fa-e6b8-4137-b950-ad358432890e", "comment": "Malware payload (Mirai)", "value": "dbedddd8a47085f3ec9505c860450e084d3d7f22d336c68102190c1a0c8bed280d65357a8b93748cee095a58af22367e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411383, "uuid": "e3cf53da-08db-4ace-81bf-76c80867600a", "value": "T17EE33A80F94B80F6D8478D3121B6F33FCA70A5A98077C65DEFD59F35EA27841962228D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411383, "uuid": "4a1379fb-0a62-4f5d-ae23-bdcdad376f6b", "value": "3072:qVCDfM5O1NvMGxC7cURJRfYBybhvBT/zy1PYg0ya5pEi:ZMOTvMGecUxYkGJSya5pEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411383, "uuid": "e480292b-5cc5-4aca-9179-c3e10fcf4696", "value": 148976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411383, "uuid": "bdbbbd17-1d2c-4f8e-884e-aec104f4e643", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411383, "uuid": "764190e4-6c16-402e-983c-04dfed01a762", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98b8eb6-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389218, "uuid": "f221086a-b754-474c-8312-6dd2059dfba6", "comment": "Malware payload (Mirai)", "value": "2e2ee5ad6879794dd2ed631e3a61a2de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389218, "uuid": "22442b98-d25f-49db-bd25-b6889d4b80be", "comment": "Malware payload (Mirai)", "value": "c68f97546a22a9f8b57e31b368f1783304b4f516f55d74ac8419d583113e88c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389218, "uuid": "aea17fa1-00b1-43b5-9894-2e6ac2e6074e", "comment": "Malware payload (Mirai)", "value": "48561949d207cbf35faa2bea10f3a9fca262537c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389218, "uuid": "81487781-7413-428a-9d18-b667795e51c0", "comment": "Malware payload (Mirai)", "value": "08df48543d82ce433e4cf01756d4b3ab674476990f695b35544efa93ac8150fccaf3d94a49f7a0b36d4132d47cb71ef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389218, "uuid": "cab6dd60-af06-46ca-b59a-32f7036992c0", "value": "T15EA32C47F9928E12C5C212B9FA5E514D33136FB8E3EE3212CD24AF6123865DB0DBB516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389218, "uuid": "0573f814-b2cd-4808-93c4-9f8c47ea0b65", "value": "1536:1An+3IsJ0KO536EcFdtO906VSpW3lz7WaSp1SXzDgRiYm13eiC7SN5wYX02:/YyleRSQVz7WaSbm13eiCGNiM02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389218, "uuid": "9901f807-434a-4780-a37b-a63466cc62ff", "value": 99036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389218, "uuid": "51f949a3-66ab-4ca6-a177-f29d949448fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389218, "uuid": "be79f3f2-e913-4fcc-93ab-8d90cd541995", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647a4f1a-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764459459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459459, "uuid": "063f76ed-a520-4f4a-ae3b-eb33ffc10708", "comment": "Malware payload (Mirai)", "value": "f2754e52d1b319442cc42574aec1ecae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459459, "uuid": "731527ba-a496-41f7-baa1-49ba33348d4d", "comment": "Malware payload (Mirai)", "value": "c777d77fed53bbd6e60875ae3516d61a8826ac8f8d98cdce07e69ffb4f7fa083", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459459, "uuid": "12ecdd56-4890-4e6c-b042-6629f38cbb6f", "comment": "Malware payload (Mirai)", "value": "c11bc36056ffb6d1a6baccb902dd369cab27f03b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459459, "uuid": "8ed626b2-9beb-435d-afb2-e1da492116a0", "comment": "Malware payload (Mirai)", "value": "630a7c63bc3c20cce8285e52ed30e3ec3f030d0b192c2c1492fbd70a7f33ca15e62ecad9a289294ef817470798171c6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459459, "uuid": "8db30280-6df4-487d-8bfb-e9212c179b05", "value": "T17C232996BC91DA0ACAD023B6BD6F64EE330163DAC2DE3247DC145F2436CA90F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459459, "uuid": "55b81ce9-c47b-47e7-afaa-59cc8a3d58de", "value": "768:1TOD91Ug/ghNHSSxyhI7QgHZqx4F+ErnZJffui9TU5SpwpYWaBESn3VeeB16Y03y:wKgYjHSS0ucxUrn7bASpwq/u0qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459459, "uuid": "82a01e15-c66f-4d21-8ebb-4eecb42b44f5", "value": 48260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459459, "uuid": "dda5a372-f37f-44e0-98bf-4765f26a640d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459459, "uuid": "74c33c54-5fe0-4ef8-bda8-da6db1cfb28b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c893bac-cd14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764414697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414697, "uuid": "1639dc75-9af8-4ecf-a2f3-53c0883c40d5", "comment": "Malware payload (Mirai)", "value": "2d78d8d3d0f3f3495e50fa0b71556902", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414697, "uuid": "90658f50-ec17-4e41-afe0-ed1fd3e53ace", "comment": "Malware payload (Mirai)", "value": "c881768e214f21a0812b34bf350d722d2c82075111079f3bebb5134b595c6950", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414697, "uuid": "fd45b49b-b56d-4d2e-880e-ac7275653034", "comment": "Malware payload (Mirai)", "value": "3db3cda9ada98add538b09765be0a9318449831a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414697, "uuid": "4b576f47-4ed2-4cc9-b359-7087ab5719eb", "comment": "Malware payload (Mirai)", "value": "d100a10d3e4e473e79456f495c624610d4307e3b7d21a904d0a7b992410cb34d792dda8b48f3378ba92542087ad4a574", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414697, "uuid": "6bf0001a-fc84-4d03-9993-6e412715c81a", "value": "T1535116DF4A310631AC0998A9307B11187C80A8D718CEEFD2D8D435EBE4EDD68A5737B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414697, "uuid": "02751c6f-0283-43bc-bed5-0c7026ad6de3", "value": "24:wKP1lSKuEGK1R1NIeoKYmWKoKG4GGXx6KVeV0qiwKjRjH4K8ykKTce8KFjj8K+GO:w486GMoKWPAEgs0qiw8VH4Ukc8goIjrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764414697, "uuid": "c651a906-2e9e-4daa-803f-3a623e64db70", "value": 2608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764414697, "uuid": "a0fa599a-dfc3-4ddd-b9d1-fd1bd820c0a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414697, "uuid": "b65b484c-f086-4fcc-a2e2-ed6db583031a", "value": "fuckingshityoufoundme.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4dddfed-cd7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764460426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460426, "uuid": "2cadac48-e601-4f1d-ae85-634712507ab6", "comment": "Malware payload", "value": "64f8ec514f98ce055355ff64d792b31f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460426, "uuid": "18abce19-069a-4c42-8e83-c75d0b3fabf3", "comment": "Malware payload", "value": "c91ef21c66b7279fda58f15e32b4e563d39221d6f4b7c6e5bae0de7ca7a854a3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460426, "uuid": "e86c70bd-ea87-49af-ad97-17ebe4bbf4f3", "comment": "Malware payload", "value": "2a32d30cbb5ba226471d13aead30a9bbfc7b771b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460426, "uuid": "9d9a5bb4-fb93-450d-998b-152b9cd53ac5", "comment": "Malware payload", "value": "f315553c78e7f6a2ee57d0539c5ea6aa1d1cfc3fc28d75c998437bad2ee4299dcea5892653be9c70983c87182d527eae", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460426, "uuid": "f08bdec9-7471-4cbf-b2e0-f70e9d65364c", "value": "T1F9A6234F6BD4E3D8C083C730768A9A5AB0F0B9A657EE4B1D35CE38416930CB6570697B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460426, "uuid": "6dc7dae9-493d-49a3-b444-6f3aa403beb2", "value": "50273325e8c998c3212647a12deb8924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460426, "uuid": "b33c6b41-f3db-4708-8e04-db9000a8a098", "value": "196608:cCD1JqMIZVyFxf02c/V6mwj3E75+SbiIGEhO4kzrmke9qt2:JfhBQ5TbV2rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764460426, "uuid": "f64ac528-65af-4a11-92a1-e08d5bdc6aa2", "value": 9742336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764460426, "uuid": "6b2d4cb2-9a39-4bc5-a679-0ca11f9b0b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460426, "uuid": "955e3a33-17b6-49ff-a0cc-cafc8ec96bdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c189ac8d-cced-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764398197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398197, "uuid": "2e35c590-a0e6-41c9-888d-9680b52942e9", "comment": "Malware payload (Mirai)", "value": "fdefa8940138ea8db7e65e2a831b8639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398197, "uuid": "f69474cc-0e80-4d8f-954a-b2a3dddc4df9", "comment": "Malware payload (Mirai)", "value": "c963932288dc59d9f4f9ef074760373cafabdf811004d76827d0829db23119eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398197, "uuid": "9b52da65-f8f6-445e-a355-f7f7533d56eb", "comment": "Malware payload (Mirai)", "value": "85b9ea50905c89c860c95df079d0fe9ece7cf18d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398197, "uuid": "1b61d354-edfe-420a-b3b6-c82c3235f3e5", "comment": "Malware payload (Mirai)", "value": "55300b646962833db2d75fd3f6f3c6bd22d002345bd44b444a27effb39b852a5f042c7bd53d611d21e260a482a61d084", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398197, "uuid": "95477303-ea88-45c1-b6a7-ec5bd04f42fb", "value": "T10892D039578A1EE0D205E1F40D7A8755620C3143B7B781C89BB098357DBD3AA71DAA58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398197, "uuid": "f0d1ce59-301b-4e56-b767-c88d9e3ee005", "value": "384:O5FwqcfzlFb82JC5CzMR/BR3fELuS5tqasNUsCqMLlTXsm0kMG:O3wnj82JCAzMR7fEL3tqjNUa0psSMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764398197, "uuid": "d55f17be-bf77-45c9-a865-3daefc59f03c", "value": 19729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764398197, "uuid": "d39fe207-4378-4030-9224-22527c609183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398197, "uuid": "65263fe5-4488-41da-931d-43077ff6499e", "value": "SecuriteInfo.com.ELF.Mirai-GH.85583311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa4df72-cd0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764411580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411580, "uuid": "118b222d-8d2a-4223-892d-044fab5fbabb", "comment": "Malware payload (Mirai)", "value": "c91c7b06c4be32b911e83c3253b4e39e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411580, "uuid": "d11b8eaa-5409-465f-b1bc-c7b80a9cdfd0", "comment": "Malware payload (Mirai)", "value": "c97cd2d3e456c860426ef82a3fee4fedebe9d16a56062719b2288ead527e0b0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411580, "uuid": "ad73d249-c705-4d0b-85be-1669de5ff2c2", "comment": "Malware payload (Mirai)", "value": "fe9188b564b950c0e2661eda81cb2e7c4ef89df9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764411580, "uuid": "d46859ad-3ac0-4c01-9970-09653139a696", "comment": "Malware payload (Mirai)", "value": "daeb601d355d7a8063de1eed95733a61a8fbb7a73ad5b10538220cb4c23b2e4e01388f6d8e1e82fd06bc34ca24b39efe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411580, "uuid": "8040e3a5-6f16-41e4-ae2b-2e5538164baf", "value": "T1A4E208526CC19A2AC5E0127EE57F419E33206BECD2DF731BCC515B087A8999F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411580, "uuid": "c493ed80-1f07-455e-a17f-3998f2afc27c", "value": "768:HvSPYeBEDkfimvPB+cSr3LlYQeSNjcFCiQvnn5Vaysdk51d:AEGJIcSrLlteS9YCiQvnn5Vds2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764411580, "uuid": "f57c27bf-e8ea-4dee-8de7-93c46c9c7750", "value": 34008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764411580, "uuid": "285d09e7-fd14-4c17-af72-6210d31f32a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764411580, "uuid": "1c5de2eb-948f-4a4e-82e7-539202ec6342", "value": "yakuza.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f90fe1b-cd17-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764415937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415937, "uuid": "0a6a5f7c-b20e-41e4-92b6-ce304895c900", "comment": "Malware payload (Mirai)", "value": "b6c76341ab8df1da67c414112ccee0b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415937, "uuid": "dc398f26-51f0-4663-968b-9c1e6be8daa0", "comment": "Malware payload (Mirai)", "value": "ca0ad15bc2e338ac3ce0edef14a566afef86547079fa2f914afcf5ad7759a601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415937, "uuid": "8c35acc2-5c56-4b72-9974-2125761b05d6", "comment": "Malware payload (Mirai)", "value": "f27a8041b40fff8cb10ab4759cf75b03272ffb7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415937, "uuid": "cdc5ed09-30a7-46e8-a256-d7c8a99321cf", "comment": "Malware payload (Mirai)", "value": "c4297fad2c56ecb3deba3221ffc4230bcad153dd30dd62fc1e2dffb2aa4835ca12436b2528ec49ab4a4289ac3d583c39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415937, "uuid": "b03003d6-1b2a-456d-8dde-37d46bd71b1a", "value": "T1BE344B8AEA814E13C4D717B9B6AF524633329760D3DB33068E14AFB43B8765E0F67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415937, "uuid": "e93096e4-3623-4a8e-80e9-388482f29c02", "value": "6144:pQWlqWuj+6lnfa3uyIaanCJJZM3feCo9qaObM/9eDw4mIwXBL/SZ3:pQWlqWuS6lnfa3uyIaanCnqPUQo/Ec4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764415937, "uuid": "97f37833-4aed-4840-b4b2-d6ec530ceaf3", "value": 251138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764415937, "uuid": "bf2d48e3-483f-4ce7-8a1c-50f3551b1c49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415937, "uuid": "3be0d1e6-a832-4f14-9d47-52b460c1782e", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82edd19-cd09-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410315, "uuid": "4e3fda73-c88d-4001-8e5f-ee41aa376281", "comment": "Malware payload (Mirai)", "value": "254149740b03da4412297a92551c40fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410315, "uuid": "ba380032-26ab-4d39-b913-cbe197096c61", "comment": "Malware payload (Mirai)", "value": "cb58d2e70ee0f6fb58e7a5de921b55faed178a7a05cfd6e569ab33177ac72c64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410315, "uuid": "7bf8a0d8-4038-4d6c-9c96-8cf5e36e7ed0", "comment": "Malware payload (Mirai)", "value": "a594103644620ddcae9fb59c447c9014c59fb30e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410315, "uuid": "0bbacc51-1b87-4557-8e02-cc47e88028c7", "comment": "Malware payload (Mirai)", "value": "7abec6a6514aa57bc83ce846317deda6c2aa1208c73f5e1b339461998c186a20d6b63842e2f243b63c21eeab1dd7f9a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410315, "uuid": "38c6ddf5-861e-4428-a0a6-ac2671b713ca", "value": "T142E33945FC829A12C5C727BAF66E028D371623B8D3DE3103DE255F25378A54B0E6BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410315, "uuid": "dc1b6709-3090-4569-ab58-e04c4fd03dfa", "value": "1536:e0bOY+kdNrsghwiXZj/EX3FlkAJKJnup44gnCtJEosU1APVlF6Dc5mOr1vAoshQ+:e0bOYdNGlllmJYUngJE5NN9AGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410315, "uuid": "7e2ea186-49fd-45bb-a401-59bc2d19a8a0", "value": 153268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410315, "uuid": "c738f409-d24e-4242-a540-99277394caa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410315, "uuid": "96e8bc40-92c3-4b8a-8e24-52899320b343", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0377d52-cd70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764454432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454432, "uuid": "25485272-bef7-463d-9d00-f47878ca340b", "comment": "Malware payload", "value": "660dca7688fa7da7b8b46668a7d1cae6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454432, "uuid": "f8fe893a-d878-4503-b56d-5fa0f40c900a", "comment": "Malware payload", "value": "cbf489bdb20fd5f3c4abbf3cdce95e487c25b4fcf366465567c728ff16342d36", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454432, "uuid": "48dd963a-5124-4e7c-bcdc-3ed37790266e", "comment": "Malware payload", "value": "26a0a36b902a125c0b3826b60630b4da98e7f6ad", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454432, "uuid": "1dd719f3-d78c-4995-aa6d-e09747cfd9cb", "comment": "Malware payload", "value": "9c6211d211fd8d31d359c7ebc175ac3077a201f293b30fae0acc6b251028ef9e253f25b1685e8f4b8203fc4fa78d919e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454432, "uuid": "086ffab8-d9af-4822-9f98-a1c443f84d4b", "value": "T1617342481ECFC5ECEA277455C99F9D05E7EA8A03151CE5D2FE4DAAE03F01428A6E48F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454432, "uuid": "f24bf24d-dfbf-41d4-8cfa-3aeec970e7d6", "value": "768:9qrwdesKSaji4DPVnTK5aHnXOtLaH3P/2oRSn9fziLzfb1J7XI4Dxd4o97O6yc9O:Si6/OtO//2oRjko9xyQdiD2qu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454432, "uuid": "c1fefe35-c86b-4ad7-a12c-51b8f11f5bd0", "value": 76954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454432, "uuid": "a3af45dd-6c28-4dba-8816-c47fbce80a78", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454432, "uuid": "bef16d3a-f5d1-44e7-bf4c-348f89e2d1c9", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d18ec86-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412927, "uuid": "4a95097a-8b24-4847-adeb-29dedc67eeda", "comment": "Malware payload", "value": "74e152964d6eb7e08824a2ef3254ab76", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412927, "uuid": "11fb194a-dfc8-4430-a27b-574040bf5e8b", "comment": "Malware payload", "value": "cc9912310caa4dbee677d104c181a7e274490134fbc733a5825a9340e4d4adbf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412927, "uuid": "b1a35f59-525c-47a8-88a7-67226e198e55", "comment": "Malware payload", "value": "8ee00785d4ba11d65a5d2187e1ddb9a356607d8a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412927, "uuid": "ac390ff8-3779-400b-88ad-55284527fc84", "comment": "Malware payload", "value": "7609e9dce399c14d9d72cdce5faad3fe6ecfeccc19d9f81d69a474417cf6be4d61f7429cddc9fb228c9a4427c0d8e649", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412927, "uuid": "dd5323d4-0d56-4a69-8775-39ada2608b13", "value": "T172C4E0179A05C327F06A93FEAA471DA8E62B4F1A944152DA383CBD4F2FB75404FC694C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412927, "uuid": "124536dd-4a77-4e25-8f85-a2b193ac1080", "value": "12288:EFZkSmBBz8C4b0Z294TfXrWAqtPDCmOcWFAR2/a:EF7mvz94brKTf7WPfOZFAR2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412927, "uuid": "ff79e357-d7f7-4ce3-8dd8-fdfaaf84771c", "value": 568590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412927, "uuid": "37e79d86-95f8-4cf0-8246-3c1e0ceccf97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412927, "uuid": "3fc85fe8-d4d0-4740-9fd2-b6e4188554c7", "value": "001.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ad5a52-ccd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1764387010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764387010, "uuid": "3de4f535-c6d4-4887-895a-82f0a625d5f1", "comment": "Malware payload (Gh0stRAT)", "value": "48a6b46ff9206d3d0fc7626ae43ac78b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764387010, "uuid": "f4fedbe2-fb11-4999-93a0-fdafd8fcd12c", "comment": "Malware payload (Gh0stRAT)", "value": "cd99dad8d914e3fba54e450fc20b2b71fb8d0bed3e6da1739db272572be75fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764387010, "uuid": "22f95990-2a6f-4b27-a5a8-7341921538b9", "comment": "Malware payload (Gh0stRAT)", "value": "b8ba029e92dcb6fd9b6bbadd7e83787bb63612f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764387010, "uuid": "69c4a7fc-f98f-4d0a-a3a2-916471c605b8", "comment": "Malware payload (Gh0stRAT)", "value": "c1c8b71b92ea9776fa342c095bd59928cb9c2c1083cd7dde2393836c4e70719a5f43612a2d07a14caa9fa7615ee68ddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764387010, "uuid": "571dcdd0-e694-42fa-ad19-eda7cc325b1e", "value": "T13AD44A12F243C0A7E83210F26186E7F76678BA3555349D1BFAF86F15BB303D26A14786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764387010, "uuid": "78217404-5900-4e33-bd9b-73bdd6e09bc3", "value": "7e621841c03aa2469856854a5a3165e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764387010, "uuid": "e224bfef-8ca8-417c-a709-fac9ff60a673", "value": "12288:i/lZ7RzvCAgXtU0LB10YDmFcgVKT0YuTcoEHSsZu:i/b7RerWUByYDmFg3uTCHSsZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764387010, "uuid": "94ee6c85-3d1f-4596-bde3-007c092c5b44", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764387010, "uuid": "555873c6-f60b-4610-825a-ed97ba0eec2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764387010, "uuid": "20b12a30-00a1-4aeb-844e-31c865ee844c", "value": "48A6B46FF9206D3D0FC7626AE43AC78B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69ba23a-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389159, "uuid": "1100633e-6e92-409c-9ab0-58157ed39732", "comment": "Malware payload (Mirai)", "value": "9c309e7926955bdb63d05f91548ccbec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389159, "uuid": "16aed518-2eb3-4738-8f5d-fda7eeb8efd1", "comment": "Malware payload (Mirai)", "value": "cea109a1388edb5a1829d952637a0d9b37a48d8eee6fed0c2fe7b250085c707f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389159, "uuid": "bd79fe71-abda-488b-a32f-511e6e28f0d8", "comment": "Malware payload (Mirai)", "value": "81649e4b0654a1dad30926abb2ce93b7ae8a1713", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389159, "uuid": "a32ede05-64af-4c9d-830d-71e762ada511", "comment": "Malware payload (Mirai)", "value": "e0a5a251d66d18258f4c03184394573b8daa88a6e19080220835b929206c79a048d4dd54038f2dd28ae212c586952c0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389159, "uuid": "faec0050-788f-41e8-bba1-000416321520", "value": "T14703F171F214654BDFA7BBB2E0B48383735A0B947B9389DF109EA30A85DB63632021D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389159, "uuid": "84b91dff-598a-4620-bd77-89eee18e0264", "value": "768:vMUkUr3bac12aVUkyP4rQoM2y/YAwB9AxvNn9VFdYBZvLXdiQoZYf4uVcqgw097:xjF2aVyP4rbM2yXvN9lYBZjXdzo6f4uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389159, "uuid": "0ff821ea-bf61-4eea-9d4a-24466374686b", "value": 38172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389159, "uuid": "2b7c93c4-773d-43e2-9a94-1b70f961a97d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389159, "uuid": "332c336c-6307-47d4-8c40-afa7d6042320", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3656cb-cd14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764414942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414942, "uuid": "7437f9c0-0609-4d32-a787-107c8ab30a39", "comment": "Malware payload (Mirai)", "value": "9e339d5c78a2228ca95505fc459fe8f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414942, "uuid": "36e1fa6e-d9cf-47d4-890d-a8f14886dffb", "comment": "Malware payload (Mirai)", "value": "cea95d463cdbc4961333e9990b36d0f8b719db6e0fb057ecb7d4dce94b70da21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414942, "uuid": "b8434924-1542-4ad4-b8d2-bbf9fb33d2ff", "comment": "Malware payload (Mirai)", "value": "4205a2e1e726e32741d73869a7d9fde8d33e7a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414942, "uuid": "f839fb53-90e0-4fc6-8119-f510925e8d46", "comment": "Malware payload (Mirai)", "value": "fdb5f66b479eb91ec3d12ce50087a99f9fc80a99b3a5adc7238ea5bb04fe46107ff498d6b12851b9d5fcae51a52ad882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414942, "uuid": "ff6df31d-5d77-4d31-a311-715c70cea05a", "value": "T15113F1FED5A63922C10F9FB8E41671B56A9260E0333F4B4C5A02484DB62ED77F408AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414942, "uuid": "2a1067c8-6d02-423f-ba23-8060412df896", "value": "768:TZ/H8VpygBGEX7Qx+xmEpoWZ7jg701CWZC6cplTWC:FeIAGEX7QIxmEpoa7jgY1z83pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764414942, "uuid": "20043b61-a217-4924-98e3-13bf378ed3d5", "value": 42228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764414942, "uuid": "37df8ba8-745c-4f48-b977-8e64adf72184", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414942, "uuid": "f98905c2-a6f8-432e-acdb-9ee255e63caa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baaab749-cd31-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764427391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764427391, "uuid": "8f0261aa-0947-4fed-9414-b55cb1f0dee7", "comment": "Malware payload", "value": "585a1282570d1bae731eec53a6e28f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764427391, "uuid": "133d47a7-59de-4738-acec-89a1f2fba8ca", "comment": "Malware payload", "value": "cff7be264479e94285bb66b122e5a6d47c4220c7285a981c667fe354e549a69a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764427391, "uuid": "fa82b564-a897-4ceb-a539-6aa0488b3883", "comment": "Malware payload", "value": "1f5bb156d7dd185b9e15ea6c3e51cb4780618b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764427391, "uuid": "99d32346-fc97-4b21-aeeb-5c0c287f990e", "comment": "Malware payload", "value": "6cd949d3083562db3595120925a85e578e19221a71034e9f133704738dd141df6655f5a350675b4c73fd60faa9aa99b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764427391, "uuid": "61fdaeab-340c-4c8e-9c96-a2f1032553dd", "value": "T10055338083F2C07EC36B12F1E765696D88EC6851A3A24DFB10F53385576A9C65E26C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764427391, "uuid": "18dd62c1-a650-44c8-862b-463d5744ba62", "value": "24576:c7d0mv45nyMNZLk9HaPtT4I2YIt+ETfH+JK70P+HrgZS43yHxo767OoGuk:c7d0mm3O6PtsIgxvPY9S4iRou7sT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764427391, "uuid": "b153501c-05ea-41a0-a105-7dc1a25ccfa1", "value": 1354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764427391, "uuid": "cdffdf96-cb24-45d4-b735-527a9a957900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764427391, "uuid": "8739ee3b-fba8-4a10-b0e8-88e49d121731", "value": "SecuriteInfo.com.Win32.Agent-BDPB.31373539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73012a0b-cd70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764454329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454329, "uuid": "c1388810-3dcf-4348-9123-d90712a2a75d", "comment": "Malware payload (Mirai)", "value": "1e6380615b98d7f7d9e52425257d58f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454329, "uuid": "000bc23d-a7e3-4f4d-a507-fce22fb4128f", "comment": "Malware payload (Mirai)", "value": "d059e3bace2bdf73cf97c0f281983fd5fee1f4eccfc172fc6f1b22018fc47b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454329, "uuid": "d8709bbf-6212-474e-bcb7-3f6556661864", "comment": "Malware payload (Mirai)", "value": "0ceb15b7a961d5bc4663a9a1c577a1175fc052ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454329, "uuid": "1474b2a3-282e-4965-b04f-d6755377cc78", "comment": "Malware payload (Mirai)", "value": "9324988ae57795c6475f415e5f16dae9b5afd5aa90f2afa1645da1514a268907ca30927ab26f320727c8a4f9dd7aa1c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454329, "uuid": "5fc03e45-de65-4ab8-a820-05338c1bdc02", "value": "T1A6B33A51F8C29A62D6C7237AFAAE41CE332227E4D3DF71078E256F21378251B0E67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454329, "uuid": "f15173f5-6ad2-4a1c-80bc-9269497fa6c5", "value": "1536:NsWO1M27V0Vyx+M0RnhoHO2LFg2xgT6Ks+kOG+tn5JX6s0XDBsvsFl/:Ns91M2OVyS2xI7G+rJ66s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454329, "uuid": "67ecab73-1388-4501-9f85-04d7c813c6ba", "value": 117716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454329, "uuid": "4ecc9f0b-12aa-4d2f-8f75-b9b80a5ee27d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454329, "uuid": "7414d34f-fe3e-4501-9a22-8eefce5d69c5", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7309a35-cd70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764454551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454551, "uuid": "7a257a3c-73f6-47fc-bdd5-285a7541a979", "comment": "Malware payload (Mirai)", "value": "cea059aa9a103cc13a8871b40466f62b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454551, "uuid": "8d4575f8-1f31-4f99-8b1a-716b9b327c0d", "comment": "Malware payload (Mirai)", "value": "d08dc31922eaf40c34525ddaecf49db13773a0ba9c78b4fc69ca53635026b76f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454551, "uuid": "0c4a5b5f-0d95-47e4-9f78-d8a713a1700a", "comment": "Malware payload (Mirai)", "value": "a13ac15712df386596cf4ab03adeacf09afd9832", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764454551, "uuid": "9b0c06ab-6ad6-4c56-af0a-b978b07ff001", "comment": "Malware payload (Mirai)", "value": "7c9120d7332e1588a1bb4c82d30318cca8527ecdde460d84ca506e87420a2e63da13e591627a80f3c0b0de49be0bf1e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454551, "uuid": "bb8f8c54-3df3-4190-b770-5f648331e6ee", "value": "T11913F105E4CD86A8EE171F31A644D3C37BF7AF466B929EC234A9971A404AE00D4D3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454551, "uuid": "d7dd370d-be22-4389-a912-97db6048e862", "value": "768:RxFDnZxzhJl+Qr0/Wd7n8vt5tHQB0FyxaoYjfuuhYbDCd2hXfiph4uVcqgw099:Rx5nb0QeaAlPwuFyvYj2uv2hviph4u+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764454551, "uuid": "c0ccdd82-0fe0-4974-886c-3ca53ab7f4c8", "value": 45476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764454551, "uuid": "d13d08c0-48c0-4c0e-9362-09c97fc7efbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764454551, "uuid": "5ddb3b01-0e13-4c2e-b265-898c82ce0124", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b524ce-cce8-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764396050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764396050, "uuid": "aa46b704-aaef-4018-8318-76a388641042", "comment": "Malware payload (ValleyRAT)", "value": "8ba27fa91af836e6011504f920375a56", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764396050, "uuid": "a1356004-a341-4867-a24f-90b71ce234d4", "comment": "Malware payload (ValleyRAT)", "value": "d1461dea7e2ad3a3dc4366772bcdebba5185a18d6f793d0e4a27dd3d78f2f2ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764396050, "uuid": "16e3b84f-9fc6-4169-b8ca-9a55693e06f2", "comment": "Malware payload (ValleyRAT)", "value": "c2b311c1ce22e8ca9d233f87bf7f5a218dd41c21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764396050, "uuid": "9952592f-01c0-40b5-bcef-715288da9ab0", "comment": "Malware payload (ValleyRAT)", "value": "c4e7443d5d2412939f09e702e22b951f77a45c5e4dd343e592e6d1f63665b73ac43d524c927c2278fdec66cb604a7d38", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764396050, "uuid": "f39bc226-1980-405b-bad3-36e5f88f6578", "value": "T12D644B00B641D036F5EB04B5DEBE8A7A5A6C79711395A0CFD3C41DBE5F22AE17A3021B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764396050, "uuid": "5fb428a6-f1c9-43cb-b159-e54201378f60", "value": "eb0717668560c69003c9bc284324e3ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764396050, "uuid": "9396e12b-0504-4d1b-aa25-c6e6210f8ffd", "value": "6144:TupolQnpsSuoaCsWq06uKwJWU997c1J2kEy:TupIKpsnP08wJWU99I1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764396050, "uuid": "d4877b64-719b-439d-b057-4d05bca79599", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764396050, "uuid": "1f531b8e-5a1e-41e7-bc92-2e2882d67ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764396050, "uuid": "da0aa8d8-eb4c-4c8a-8ec1-de4026174dd3", "value": "8BA27FA91AF836E6011504F920375A56.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ad9fd7-cd7e-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764460511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460511, "uuid": "bfede6e7-c150-46a5-bad8-ac4b3a2302f6", "comment": "Malware payload (PureLogsStealer)", "value": "12e25a923917143e722fee54ae405b25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460511, "uuid": "9ef06572-f443-4ad1-9886-d5991697d8b1", "comment": "Malware payload (PureLogsStealer)", "value": "d1a1d84b660a4ff770b345e169486e2a70b70f143846fe7446dcaf8de91be2be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460511, "uuid": "afcab937-4226-480b-9439-c255d4483624", "comment": "Malware payload (PureLogsStealer)", "value": "c907c09e8c50139d27011cf320b82d2c49c9521c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764460511, "uuid": "cceb00e0-09cc-45d7-8bfa-79270715e6e9", "comment": "Malware payload (PureLogsStealer)", "value": "ec807738a2d3e17c28d849291a377a3a5cec1d65dd7379a5d8f0b84553b8e2ef963117f69432671bae04378a18a686dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460511, "uuid": "766155c1-d145-4848-93cc-7faf209cd716", "value": "T19CB58D0B7CD846AEC05A9339AAB252A27674BC470B3233D33ED0AA7D2F363D45535794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460511, "uuid": "3f864c8f-0cf3-44ee-81d8-f721eeb04fa8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460511, "uuid": "420d7d8e-f18b-4e3e-9be0-d74aed897a13", "value": "24576:TiymPk3BBj/YeMsBBxUMUIUKCAgByR2j6z9rK1sURqGWWanqRTtK/lj:TiJk3ceOHNoMyR2jSsRwp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764460511, "uuid": "1a06209e-0755-4c59-af09-aa2d55e30a3b", "value": 2479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764460511, "uuid": "4902c5f9-f5c9-4e0c-b9d5-8589fb9bbe3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764460511, "uuid": "6771f1af-add2-496d-99fc-78b3ff42ca2c", "value": "12e25a923917143e722fee54ae405b25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e9f039-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412962, "uuid": "2a7a606d-b19f-4ca7-9afe-b9561c097432", "comment": "Malware payload", "value": "7526f82308bde68835827326b625c8f0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412962, "uuid": "a99bb8bb-c2a1-4453-8941-a08e2feb438e", "comment": "Malware payload", "value": "d5a6c9bfe8bdf22b54840e90c5e0d7ef2507c7ae4614e52b0de2cced7e685717", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412962, "uuid": "c67fc78c-9e81-4cd8-94bb-0d604b825222", "comment": "Malware payload", "value": "842ef080084d5c1082ec259ece633fa8c5431a88", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412962, "uuid": "dfef0d04-200c-4390-bf29-62990ae3e60b", "comment": "Malware payload", "value": "a6d67a207dc99a6181bed7f3659897e9d2600d9bee6e525f01a5d24526664df6c36db2fc63e04ab3e0d925352fec296b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412962, "uuid": "e5370f91-4645-4eb7-82a8-c01c190d17ea", "value": "T15346F1C6F7D8A92FC8775072C9BE52B151874C028A839F836D18760C69BB5D42F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412962, "uuid": "d8c584d1-a09a-43df-82f8-538e58d56a1d", "value": "98304:gPxH3oTwrYkKjofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltk:gJHNKMfyaIbaciAFvrEZpXqmY9XrF/mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412962, "uuid": "cb39f691-3f5d-40d6-873d-e44effae9156", "value": 5865754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412962, "uuid": "c8d8481a-e420-43a9-9d23-0077753ece4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412962, "uuid": "35746fb7-c08d-407c-900b-470d2c438af5", "value": "Gecko158.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a5d672-cd09-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764410275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410275, "uuid": "21a4dc95-3f4c-4d12-8756-2764e0205843", "comment": "Malware payload (Mirai)", "value": "a7f3480e56c0fe2843554e0a6f9b8c51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410275, "uuid": "d4b7d089-6b6e-4d3c-91c6-68c3ced89f0d", "comment": "Malware payload (Mirai)", "value": "d615368fe82f437637ecc28839faaa5ff4f726efeb466bfca9f01da543034653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410275, "uuid": "d96120ff-3276-44fd-a85c-ecb47c9b8b93", "comment": "Malware payload (Mirai)", "value": "f472da36386ed88c6a4052febfa813010b7f796c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764410275, "uuid": "804a4086-2fc1-4a90-a04a-48130d8790bc", "comment": "Malware payload (Mirai)", "value": "5ba00b09218554f567ff7812084bb5cb3b6f2feca154d6305ca64934c6f3f33e378b7d2913539570ddd7e09b934f33cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410275, "uuid": "a6dacf9e-740f-4f83-b067-96c9b559088d", "value": "T16CE37D22B5351D27C0D0A5B722F74325B2F247CA15BCC66E7EB60E8EBF252403657AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410275, "uuid": "5c8dbf7e-6918-4f9e-b660-e15d482ada11", "value": "1536:iCSulPLLEb1pLoyTCFn6FV8GC+4OPXu7N15xYAfUC0IvWT+SeyphH1xYj8BW6LRB:HpeWMPu7jeYi1ej8BRl+o9UMWVwgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764410275, "uuid": "c2f88579-0b87-4157-a472-860f1332ec4a", "value": 150948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764410275, "uuid": "8b1a0390-2d19-4132-b8c8-377ca6835dc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764410275, "uuid": "1630f8ac-3c79-44b4-89dd-88bac2865043", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbec8981-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409838, "uuid": "4c5aa302-daeb-44b8-bd14-cc35ec6b4c84", "comment": "Malware payload (Mirai)", "value": "abdad44518ce54c85fa09b271a32023b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409838, "uuid": "23824def-1037-437b-9c1c-d00b77145040", "comment": "Malware payload (Mirai)", "value": "d6812e8a41679303bacb45f74d3630d217a2953c91afc6f8f20eaf52a6f53ad9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409838, "uuid": "c02222a6-c801-4ee4-b116-dc1e2772f2af", "comment": "Malware payload (Mirai)", "value": "595c2965d3c45ac39d07fc09ce6ebf498f2dc2f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409838, "uuid": "a5a8d3de-24dc-4310-ae43-c6ca22fd5403", "comment": "Malware payload (Mirai)", "value": "94f3a5f96cf9e71cc9b2cf1075ad639560655b85ba25aa8140c4dcdf899e96f29ca19ed06e94cd9a6dfca955f14065f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409838, "uuid": "db016df8-be6e-4637-ac54-b52d3b76df98", "value": "T1ACB35B06B21C0B4BD59359B02E3F5BE183FAB5E020F0F789691E975982B6E371446FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409838, "uuid": "ac997a08-5f50-478b-8c80-82c871e78141", "value": "1536:ZIHQa6Qc6MzXYKQo6Ytu6UTLD16BggCCv9p0oDM00yChQybqIlVGstm:ZI4zXYKXDWLpgggrw2MaCPjPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409838, "uuid": "4d13fe7d-c623-4687-929c-7a7501a83024", "value": 112548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409838, "uuid": "5397870d-7725-44e2-a483-e7b88b1a1cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409838, "uuid": "ff5366d1-6054-4f62-8731-76e0c18ddadf", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295d507f-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764391929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391929, "uuid": "cb194152-0e99-45f2-b833-9d5933b31359", "comment": "Malware payload (Vidar)", "value": "68c12760e01239dfaf8cde94ad80727a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391929, "uuid": "0ba9ba6b-4ebe-4842-9e82-0073d910d70a", "comment": "Malware payload (Vidar)", "value": "d6b67fa61ebc306a71d9919aefa40190b142beb894b6896d2596854231944e2c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391929, "uuid": "fb79c75c-f5b6-47a7-a7c3-9cf0212c132d", "comment": "Malware payload (Vidar)", "value": "03078802ee7cac805e3224a77a340389b446e6d5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764391929, "uuid": "8de18628-2f63-4aea-a634-9ce870ac93b5", "comment": "Malware payload (Vidar)", "value": "588ec8e70700a636a7b52abd49ba3fb4c58bab61dd10118bd9f641e68c65aa17e44d1c4de7014706c012fde84db1df3d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391929, "uuid": "e3dc9e3d-b171-4667-894d-3ab71b55a49f", "value": "T1B7F0AB18DD2AE2E62B3215DAE4814706D9C3E863202754257924DC066F24CED766C5F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391929, "uuid": "c60cdc3c-2ac3-4d63-b1ba-f4e59f1eeb3b", "value": "6:j+RwQ9vDzFsJgg2gAC3NqhLx0HGFGhjCOBaiS0LSyjFaYZiXMvveg/WG/UC1g/WX:K3vDzEcCYhLGHM3pjy4wiN2UArD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764391929, "uuid": "38a97273-5c2c-4c84-8a1c-01c0dea1a903", "value": 448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764391929, "uuid": "8c461a1a-e139-4b00-a163-cdcb215d90eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764391929, "uuid": "b1e1d6ae-813c-4d8a-a734-09c05e38a205", "value": "xw.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323df3bf-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764412989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412989, "uuid": "ab6f86a8-d71f-449c-a612-543e1c28e8e3", "comment": "Malware payload (Gafgyt)", "value": "41b9b0496fc3c3ee4661dac83497b17e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412989, "uuid": "d4628799-e47b-4714-94d1-3c4645ce5bd7", "comment": "Malware payload (Gafgyt)", "value": "d6ccc737f8f8195bd472e56d405f3dba28bb338e9f5a83814a84e43d3910f7a0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412989, "uuid": "bb36ae90-499f-4c51-b50a-810e705b83a0", "comment": "Malware payload (Gafgyt)", "value": "bb70543ac0347d3671740e76efc5453702e29d15", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412989, "uuid": "0ca84049-b569-4ab6-b817-02011413bb1c", "comment": "Malware payload (Gafgyt)", "value": "ddf5dae74a2573d4e1961a401114b410d221d66bbbe7dae8ce7073588d4319eb050a2d0bbab252f99e3959c79057b524", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412989, "uuid": "d812a709-595f-4686-b562-870763b0efd9", "value": "T15E11EB36E81DE820077A4098EE06A285FD2A89030F242933711CA0F0BF3C053A1BEF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412989, "uuid": "a42afae0-0238-44da-8fdc-e8175ebb8fda", "value": "24:gpb5GKBo/hseTX9hXZ1gYcq0ECQPeV242L8L7wEKfYxn:WHuScNtZG1q0/BVGo41Yxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412989, "uuid": "44c10648-4708-4d99-b34b-e58a04626f15", "value": 894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412989, "uuid": "ad640112-5510-4420-a8f3-f82c18a144c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412989, "uuid": "0d7e8a38-0b2e-41f0-8afa-f2c741e44933", "value": "g.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfa407b-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409787, "uuid": "74bcc947-68f2-42fa-b127-ab1af6e15efb", "comment": "Malware payload (Mirai)", "value": "18f1af7dc01a38088ed117a7fb7ae6e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409787, "uuid": "12906b4c-5ff8-406f-b2ed-40e0ed93810b", "comment": "Malware payload (Mirai)", "value": "d72fed94286e50d9c5a33fe72e670ecf85121acdd5bf8bb2f983c5e8422c42ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409787, "uuid": "fb384e93-15fb-4181-96b0-de05fffa6b4a", "comment": "Malware payload (Mirai)", "value": "d9778bdc9017b6d56fce9cb8b7188ab1b5b30506", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409787, "uuid": "6d227142-cd01-4bf8-ad77-24f85f54f081", "comment": "Malware payload (Mirai)", "value": "f47b15b44c75de682e80191bbbffbcc1b092250a0a7ad00db99c09e76fe0edcdefe73515b05cee644216e4a6a9ece75a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409787, "uuid": "83848f3b-c245-4964-aaee-13c99714c2e3", "value": "T1F8D2E120B1F4C851D3109CBD8D1CC6D1DB278DBDA3603E466E77065B66CE83A9A7CAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409787, "uuid": "c5a7f9e3-1b9c-4b5b-b06f-c33b04319a7e", "value": "768:GsX9W2aylwWbNFxfQAwNBjDdop4s3Uoz9:miVbNFxfhEB3dojz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409787, "uuid": "86be38b0-ad90-4274-bea0-30c67457ace5", "value": 28360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409787, "uuid": "ec64adbd-eeeb-469c-88ec-99a71fefc74d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409787, "uuid": "7e70a5a0-a1eb-4d3e-87cc-4d861d585eb2", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfba51c-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389893, "uuid": "921bf974-1334-4f3e-8411-9b65b09016d7", "comment": "Malware payload (AsyncRAT)", "value": "da9f041b892abb81992953cced442daf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389893, "uuid": "0194638a-ee4b-48fc-b55f-393ab7de907a", "comment": "Malware payload (AsyncRAT)", "value": "d7d79eb686a429964aaa232eb9a54e6c591a852519d2e4b04b1f60adcb9fcdc8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389893, "uuid": "de38f3cf-070e-4ee6-bcad-3c1ed8384488", "comment": "Malware payload (AsyncRAT)", "value": "9a99c80e9920c3291955f843b7843c356b1167d9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389893, "uuid": "3f781c7a-1e44-4d47-ab22-56f1ec304d6c", "comment": "Malware payload (AsyncRAT)", "value": "9fbbbc08b27c67a7fe2a955907b244265c2163f3fad69c71ee3e21a870a499f6aab74c8c85a06ba7edc800656f267dcb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389893, "uuid": "19195c30-3018-42a8-9de3-e5a97b744f92", "value": "T129751806B7E94128F1F36B71EEB992655A77BC61AE3AC54F1384025E0DB0A90DE31733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389893, "uuid": "5c2aca66-2835-4f49-a38f-4943dff0c1d8", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389893, "uuid": "82b4a37c-08ca-4104-b69e-ddcd483a8f0c", "value": "24576:6bvgtXabdrZe4aWOLT4yXGQtAm6K2MtENK:lENZCWOLT4yXGQ6m6K2MtENK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389893, "uuid": "7d707726-acf7-4d91-a7d5-77e52a70548e", "value": 1626904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389893, "uuid": "a857348c-c44d-4984-bfa6-a5b9d199b3ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389893, "uuid": "2e36e2a7-3649-4804-97a5-fe8db714eb22", "value": "tuf2my.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c8629f-cd78-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764457909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457909, "uuid": "27bb3202-9702-4b00-bab7-1cb730f51ee7", "comment": "Malware payload", "value": "71fa4308b9c52b07914c64d679957d06", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457909, "uuid": "a184f379-debd-4987-8440-b1494fbce73e", "comment": "Malware payload", "value": "d874054687ce5bf99ac4c83791e6f60c7b00db67091de6fe08985d7d56f7a8d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457909, "uuid": "1e0600bf-3bf5-48aa-829d-862f4d467569", "comment": "Malware payload", "value": "b4a80a34cb20ffc30a1bc10d02ad474746c824bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457909, "uuid": "d46438b8-3498-486d-ba32-ba79d78c4e52", "comment": "Malware payload", "value": "7e38088df9c1aa7b7d07fcac9aee4d0e4ba5aaee9330858eb9cf003dad90b7fe2bace039e5b68adca48ef835d31a420d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457909, "uuid": "2f4909b9-8a59-45e7-a613-446c13cba4c6", "value": "T19FF05CB1F4245C2032AC847450084029F453E627932A2C5461F3D2343ABE692D55E71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457909, "uuid": "381a1f00-ff74-492d-ac93-6e4e95a1add2", "value": "12:Q6A/bv/S7FlGp+Deu7DBP/JLMEam3Fm8vOrxDZshVIY:Qj/bv/UbxnBP/ham192FZ3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764457909, "uuid": "cb4531fd-4faf-4d26-939e-34cd894f0085", "value": 445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764457909, "uuid": "b94eb4f0-206c-4577-860c-f61cb8b88b4c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457909, "uuid": "243e4fd6-63fd-4190-8187-f181adb82c3d", "value": "cleaner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6228d2d3-cd21-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764420371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420371, "uuid": "b629c703-103f-4845-93c3-d57eb798724a", "comment": "Malware payload", "value": "ad880eefa6cd983b19e608b6795711ad", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420371, "uuid": "7a6e1961-1448-462c-b75f-4832b69a67c1", "comment": "Malware payload", "value": "d8a84f98d972ced0618141b50d136a732cf613cd9f06138867191ca9cac97638", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420371, "uuid": "b2832a11-be4d-45c2-a7dc-96a227a5e6b5", "comment": "Malware payload", "value": "0697e104a20711fd68e1f87b0b9fd768d93c9476", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764420371, "uuid": "ef370b73-0fa7-4fea-aa41-f0e3056974d3", "comment": "Malware payload", "value": "46fd5aa659fb3f8e201f4b2d4bc9007216f671ba28e79cf77a58d214b51de20308d06679f86e44d23b475954277bbb0a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420371, "uuid": "87449ab9-d79a-4e97-a0bd-214bc73fb5da", "value": "T1CB5533069372C12DD11652F1E7961CEEDC8C5462939116FF84B122EF5B6AAC35F0B82F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420371, "uuid": "a72decd4-278f-4ff4-9a00-eb8063e54d5a", "value": "24576:c7d0mv45nyMNZLk9HaPtT4I2YIt+ETfH+JK70P+HrgZS431ESD9Mvve6egxzdY3w:c7d0mm3O6PtsIgxvPY9S4l79Wve6xzd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764420371, "uuid": "2931127c-2600-43bf-b026-e64f6a0be228", "value": 1354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764420371, "uuid": "2e707a7e-e479-4c21-a670-8e6b0fa54da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764420371, "uuid": "ec8b6bff-2f4d-49ae-aeaf-083b03a1f201", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33beaa20-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1764412991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412991, "uuid": "a60dc071-c2bc-404c-b585-951855ebb266", "comment": "Malware payload (MeshAgent)", "value": "f6d0209859396816de679f18ba8c1cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412991, "uuid": "4bef978b-f904-4d2a-af1f-4f2954a265bf", "comment": "Malware payload (MeshAgent)", "value": "daa464f738edaa9ac8aec2b174e0dbd1edb7040a380a374a7e62aff90e0bbada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412991, "uuid": "ef246072-e383-47ba-9e3f-319d13416f5c", "comment": "Malware payload (MeshAgent)", "value": "a0cd7e8628bdeff3bfd512677439e02943646211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412991, "uuid": "358b51c7-9f74-45fe-a06d-131db11ac144", "comment": "Malware payload (MeshAgent)", "value": "29ce68a2b83ccbb8dd3d290020d6024e9617e4bb429777098b1e7560f378788853f161b0666581f5b4ad8fe9c7917694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412991, "uuid": "e64e874f-ea75-43d0-a0aa-82b245451b60", "value": "T1727500252484EABFD820043CFC3645B66F69AF1B651DEAC79DB93D5234BE6C3B0110B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412991, "uuid": "7930bae2-913e-4796-b927-ce3cffe101e6", "value": "1b30fa183bfe9ff390e568cb23d331e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412991, "uuid": "026771ca-5f6c-4421-a53f-3f97bb29851b", "value": "24576:2IrWeyV+E6YHxQtJhdp1PWUWA3rqAQQoGDnNMotEHXcoS1iW1WW4Vw8q:cZVnREdp1OE3q2njtEi1i0mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412991, "uuid": "46144298-ac2e-4293-91cd-a2c29b27ea23", "value": 1629184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412991, "uuid": "7e2a44e8-106b-47dc-ae0f-c7ba8b666b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412991, "uuid": "4ef66499-b990-478f-93ec-23ac0a850f38", "value": "google drive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1938af5e-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764412947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412947, "uuid": "dfd623e9-74d5-4a56-9952-cbd3d5f2e95a", "comment": "Malware payload (RedLineStealer)", "value": "189a281ce19c6e8c8131d2f3a5eb8d04", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412947, "uuid": "9ea1e54a-44fb-4f93-986b-55ee9aaccc05", "comment": "Malware payload (RedLineStealer)", "value": "dab57e7fe91f21705a5415e37a4c056e7420232a2660aeeaf9951fcced4fee99", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412947, "uuid": "d5b240d4-ee81-48f1-8138-6184e22d80b2", "comment": "Malware payload (RedLineStealer)", "value": "86981016d47050cd6c6a1fd7b8b484da9ef5f36d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412947, "uuid": "62116dc3-c4de-44e7-80c8-dc30647fa8c2", "comment": "Malware payload (RedLineStealer)", "value": "ccaa3d7e6b3107709c031539325bc6a95fc2685203fdec6cd2384288f28f370284b7881b58cd6ae4cf1883656ea0612c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412947, "uuid": "32cd260a-09a1-4484-9c56-c63d0417c134", "value": "T1F9573392531D79D0C486AFCBB34ECDFA2FA3AD1639968890DE79C5925BC214038477CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412947, "uuid": "ff9b2d92-aa9a-466f-9d2f-2b982e301146", "value": "786432:k7ridHHPBn2WVSWKQxi9iYE94WYtGXnelJeg:1pnxVLKgkEWxtYqJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412947, "uuid": "182e8c85-2378-49a6-bf66-96e3f186e006", "value": 28604897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412947, "uuid": "9a4b2bb0-a793-45af-a162-2e2eddb187ac", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412947, "uuid": "03568b9a-238e-4a3f-bbad-a9194e23bf5b", "value": "NaLock_v1.216.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5b4392-cce5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764394596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394596, "uuid": "382432bf-c372-4dd4-8ac4-7cca4f8426fd", "comment": "Malware payload (Mirai)", "value": "4feda453c8a96930dd767f0715dcda84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394596, "uuid": "69e63eba-264f-4352-bb5b-634a7aa1cfcc", "comment": "Malware payload (Mirai)", "value": "dae0a2cc79d73d04025f6671184adb0b58cd03ef89277082731b37476b59463d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394596, "uuid": "67759944-afab-446a-8699-f6b1f1659ecc", "comment": "Malware payload (Mirai)", "value": "a20ce746c2e01f87d827fe00f3aeaa3b1a6af034", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764394596, "uuid": "827e79f4-0ae5-417a-85b3-a7394eb0fd97", "comment": "Malware payload (Mirai)", "value": "699881232ef53821119eebc4734e6c3a2e075de13d45010a1849a81112747e885286e25f96cc821b73d98f4677c8ba0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394596, "uuid": "777a3405-4e47-4aa6-949f-14a5220bdcfe", "value": "T115F339C7F804DEBDF80EE73B48230909B130B7A155921B376257797BEC3A1981967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394596, "uuid": "10c59ccf-3084-4a55-96d4-196b02c0c4e1", "value": "3072:RdTncbVJBQT7YWaLh9qyrc5k1jm5avyX5QVtjbiNLNebtk1:H2V8YrqyrOk1y5DX5rL71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764394596, "uuid": "be5f348d-724f-4010-978e-915f2bf35c8a", "value": 162272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764394596, "uuid": "99b78c6f-92a8-4991-a4ee-a1fb6ade7f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764394596, "uuid": "80a9f518-280a-4cc8-867e-b702f7e36506", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3445452d-ccb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764374767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374767, "uuid": "4accb484-dbea-4e2b-95ce-8bbcf698a21a", "comment": "Malware payload (Mirai)", "value": "329f03cb65153b9fd45a20de53e52473", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374767, "uuid": "456c9c6e-ebba-4217-9555-a78899eecd8d", "comment": "Malware payload (Mirai)", "value": "dc6e479ffd5c9f59e7a42062ae09995fe9d2fdf5b60eb632d53d957eea038e8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374767, "uuid": "d3544fb5-ccb0-4700-a57e-9ab5cab5a455", "comment": "Malware payload (Mirai)", "value": "9ea8a7f42cb4c7cb36ee744c38a7b1a2ffc89f0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374767, "uuid": "c5af4fe5-2d96-42e1-adb1-1f9b0f309280", "comment": "Malware payload (Mirai)", "value": "75ae28691764352c358a6a57a68c6b51014fbbd138aa0db9a9df276d4082238a0024f4db9a39469f3c30ee3e9e7a7ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374767, "uuid": "eeeb070a-a083-42a3-9c15-ba444f9abcd1", "value": "T125435CC4E943E8F5DC1916742973F7329635F4391029FA57D7A8F573F88AB42A20A28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374767, "uuid": "fdb2ddba-0c92-4d6a-bb6f-36a131ace18f", "value": "1536:XxvnsWrVyEratU9c1mwY1OjFY2LaMD3NhPxFrpDQ55kR:XxvvrVyEutt1mp1Oe2LH9hjrl85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764374767, "uuid": "9fe51efc-72e2-4bfe-8b8f-08854770629b", "value": 55604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764374767, "uuid": "dd649eb8-bc96-44e8-8683-20c36ad09c5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374767, "uuid": "72e735e0-416a-4e51-8cc2-24b30439ad6e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32fe8b6-cd14-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764415004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415004, "uuid": "e7dcae1b-67c8-4c71-8f30-395cb2c3bdc9", "comment": "Malware payload (ConnectWise)", "value": "d5e38e360f10139a0e41ade72fb67c3b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415004, "uuid": "736aa26b-7974-4a30-9196-bff75b8db412", "comment": "Malware payload (ConnectWise)", "value": "ddaba68dfac28852d3936c8ca86b9061d754e02bd20c15ab36504805f634b0be", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415004, "uuid": "4ef3fd59-2042-4c44-8906-21aa07a10da1", "comment": "Malware payload (ConnectWise)", "value": "a1a733454800d490734faf385f383c3553217071", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415004, "uuid": "f73a7882-ac07-4ea8-93a4-17c4fe11d087", "comment": "Malware payload (ConnectWise)", "value": "3ca221295b5e2d68f097b421d054a55c68193dd38980053e8fe2cd15a93ead4aafe6576e35ac43e7933ea1be25345db4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415004, "uuid": "37079e6c-7322-4d82-9608-f24cb38672f9", "value": "T129D623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415004, "uuid": "29bfc9d8-ce0e-4595-bfae-a31cf2ba6e01", "value": "196608:SHxcp9ym3nltDUJVlHxcp9ym3lHxcp9ym3JHxcp9ym3GHxcp9ym38Hxcp9ym3jH3:gGplp6GpXGpbGpUGpaGpNGp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764415004, "uuid": "5a9a8501-e47f-415e-9337-c5b59d238d86", "value": 13434880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764415004, "uuid": "0b28a7dd-16af-48c7-8650-dbf15f72ba08", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415004, "uuid": "b2a1ef9f-d38b-4555-af67-ad0c56667285", "value": "MSTeamsSetup(1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6888ad0e-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389887, "uuid": "6bd94ace-84bb-4fbd-a72e-37f294faa10a", "comment": "Malware payload (AsyncRAT)", "value": "5a7b7b301e287d26bbbd3472cb38fde1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389887, "uuid": "80b9f13b-9c78-4ff1-83a6-fc9845f90204", "comment": "Malware payload (AsyncRAT)", "value": "de55894064ac56c271ea159290b2ab4a54c13131a2cce8c1e824b988e117fe4a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389887, "uuid": "7a2f00e9-60cc-40c4-af2a-01ee2eaac42e", "comment": "Malware payload (AsyncRAT)", "value": "49c150333a3b73ea285b1cefd26c3b91c8992d14", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389887, "uuid": "ed6a231b-f57d-4c1f-94cf-ccb32d0cc469", "comment": "Malware payload (AsyncRAT)", "value": "9b4639459e57e77ea2d647b53ddff83f35614f30dc6526aaa5a77acf1d4eda698d043dee79fb1f37d0c0ff1cbd5ad16d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389887, "uuid": "3cfe7695-6eb3-4abc-8d6f-d4a13c676d88", "value": "T1E045390267FD0199F1F3AB349AB652509AF73D52AB39CF8F02840D4E1DB7A909576323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389887, "uuid": "e9ff7d11-f367-4e75-ae96-bd856f5483b6", "value": "112bfbb18727302cb5425c20a464b02e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389887, "uuid": "da0c3223-19e8-4f56-9bdd-981f158a3e6b", "value": "24576:UKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNI9:N0o5K2MtENm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389887, "uuid": "4118fbf8-5592-4acf-9c91-3b110401ae65", "value": 1242286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389887, "uuid": "4c8ce7f3-9bfd-4a5e-a0b0-cf4d49aa092c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389887, "uuid": "2949a951-914a-4848-9de6-b9283de2a45f", "value": "S5MU5Y9OW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e5274b-cd74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764456220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456220, "uuid": "65b706d8-3b65-4006-a43e-74577478c55f", "comment": "Malware payload (Mirai)", "value": "7ea4fbf887410f5605223b1ac955348d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456220, "uuid": "6847d98e-12ac-4c60-803f-afb10f5df048", "comment": "Malware payload (Mirai)", "value": "df7b430e57703241582c5e2c25be32b317cd4a6d625c9467368379a005898b7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456220, "uuid": "dd871a34-e84d-406b-826f-a18e0dd2fbea", "comment": "Malware payload (Mirai)", "value": "9edd7ef125ad7e50f38bd3ed418aac41c0498056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456220, "uuid": "ce3c959c-c387-4bf4-a1ea-9961ce1d062f", "comment": "Malware payload (Mirai)", "value": "898ed67deb18b0d7158f4922ff28df8e3585a68ad26736e449248ff51509b5524344dccd7420599f70982481791ab35a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456220, "uuid": "872cf9ab-19d6-4359-bc90-8a8a70605904", "value": "T18223021851781351A879503949EE7CB213909B12D1ED44C393DDB91F8C8BEBC7E6C787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456220, "uuid": "13f6fdcf-7540-41f3-8357-5384d5146856", "value": "768:RVGTPhYZRWlqPMSn4SPXrv6t6aohr/tSO6wOdJ+QpLF0nbcuyD7UHQRjR:yTZ+WIPMS4qX+tWVVOHL+nouy8Hyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764456220, "uuid": "2c33f530-c8ca-4fc1-ae8f-66cfc98da515", "value": 48412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764456220, "uuid": "faae1ff8-70b1-4f82-8bd4-1d1c0d7d4a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456220, "uuid": "a2020278-0c1c-440f-bf03-d5ea5e748307", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c234d975-cced-11f0-a129-42010a9c0007", "comment": "Malware payload (Havoc)", "timestamp": 1764398198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398198, "uuid": "58de541e-3ec9-44e1-8ce6-d2dca70c0dd3", "comment": "Malware payload (Havoc)", "value": "743b40aeaa37ba28faa37dd2bb95d8e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398198, "uuid": "9ba646c3-f225-4fae-a190-1006ad06ecdd", "comment": "Malware payload (Havoc)", "value": "e0541ffe19c3ba916db46ecd5096b20edb50e730f295e065eba02a39de97534a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398198, "uuid": "e0044655-e442-4d1a-b719-9e12f7f49c84", "comment": "Malware payload (Havoc)", "value": "44244c1ecb254c6fa62675ec017f99accf6bc298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398198, "uuid": "e6112e76-32f1-4bc4-b16f-d96c986303b0", "comment": "Malware payload (Havoc)", "value": "1787864d61eb1c5072515363be2798583f8bfbd4eea97ee0a6cf1c8cdc36fdfe0477e17b0cc0e60cf6dd66ff5c3c0ffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398198, "uuid": "5ba009f4-6b4c-4371-828b-970244cafe9b", "value": "T147243A83A5D698FBC56DC13886EB8336AB76B5CC165167071B20D6311F23AF07F5B20A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398198, "uuid": "23768122-5f0d-4836-b27c-2cd51b0695c3", "value": "4834d1a001382ca4989bc22fa8cfc5fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398198, "uuid": "23ad7bb8-60a4-4108-b9be-54563799dda0", "value": "3072:gp0V/D2dwv4iZxmvuXMf9g+8O1UR0VuteWWR94Im:guadwvhxmv3lHAlIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764398198, "uuid": "ad8408da-d8fc-4960-8b82-ffb0928243f3", "value": 215861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764398198, "uuid": "e59d8752-4b5d-45dd-83f1-ecd2af005e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398198, "uuid": "39f0c9fe-5b49-4d4f-b787-b36bda66a116", "value": "SecuriteInfo.com.Win32.Agent-BENY.64284147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e4a9aa-cced-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764398196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398196, "uuid": "12a23212-666b-4db7-ab6b-952a02457d84", "comment": "Malware payload", "value": "17869d89e68ddc9c126018a1c758590f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398196, "uuid": "a0b4643b-14ca-411f-af5d-7ccac036382b", "comment": "Malware payload", "value": "e080b0943930d15fe4d323b97b33c09dd22d7310f38b8abe3e1aea1972fc7933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398196, "uuid": "3a5b4079-2a28-4a2f-93b8-d8353670ffb9", "comment": "Malware payload", "value": "a531bf356eb8c9a229896c5ddbde6e908e6913ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764398196, "uuid": "06e6a987-b50f-4a4c-a716-e770cb926542", "comment": "Malware payload", "value": "9f45ebd8e3cb82891acc2a5cf421a6e1156f80813bf7b6779d9d8fce8ecd55c44aadbe051b12d87a5b26a4306c6ee234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398196, "uuid": "188a3657-494e-4b9c-bc73-e39e12499a94", "value": "T1D0B56C17FC9219A7D0AEA231896261827B60BC493F3223D77E90B77C2F72BD45979710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398196, "uuid": "d72d03d2-36fd-4e25-be62-511692c84362", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398196, "uuid": "d4fbd82c-9bd0-42cf-a417-d021bed8e485", "value": "24576:QFbz0EuEMrn7eurEI/I+sOQG8xn51jJrtVkGnWRDLwjFlgWMN6:QFP0EuOurxArJj5P+Qra6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764398196, "uuid": "23450010-38a2-4cf2-a6ba-ec536cffe521", "value": 2437872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764398196, "uuid": "ef5dc6d3-98cc-421f-ae8e-917fc6d60241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764398196, "uuid": "ca4337ef-4bc4-4544-a019-685d4899124c", "value": "SecuriteInfo.com.Win64.Evo-gen.53446353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca4bb04-ccb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764374781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374781, "uuid": "0fa6da0a-e8f1-486a-b039-ef7ef56ffbe2", "comment": "Malware payload (Mirai)", "value": "c91f37618144f18d57671f66f802911c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374781, "uuid": "7fcba8b1-0b04-4f1e-a380-9ab53dbb3b1b", "comment": "Malware payload (Mirai)", "value": "e263d112975347beee8c6842b1e445d5c8c169ec5eaeca2bfeb72470610c5a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374781, "uuid": "ea8ba8cf-f367-4e3a-8e40-08939593ab3a", "comment": "Malware payload (Mirai)", "value": "38cc79a7ffd08ff1a3d3e8316d6bd0446902bd2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764374781, "uuid": "e5188b6f-245c-4fb9-902f-9403318627fa", "comment": "Malware payload (Mirai)", "value": "5300e6dcf498e83a4f467fce4772121103d408dc48dbf8a08ac216d587e5d4d88b8f03c1384d67268b82b4a6253d0eb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374781, "uuid": "9e5b3fcf-0e1c-4072-a57b-092b281bc11e", "value": "T19134E70AABA10EFBE8AFCD3306ED0B0124CC652722A97F7A7274D514F54A64B55E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374781, "uuid": "4c6e64f6-6d63-4777-bdda-591969cbba61", "value": "6144:zYasb+d18vkCYpqDpt30enj/ZOzbSWPVWdY:8su10C1OPEdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764374781, "uuid": "ba2e59cb-e258-47de-85ec-f3da6085bbcf", "value": 235036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764374781, "uuid": "35992ee2-dabd-419a-a712-c9209f644ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764374781, "uuid": "b07ce0b7-9b41-4861-8474-84b3911e8185", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f786d7-cd7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764459112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459112, "uuid": "cbf3ec88-f317-4151-abf3-6074bd4c35f3", "comment": "Malware payload (Mirai)", "value": "b18def58fe6247f2db14a14b416de550", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459112, "uuid": "2a66f011-85ca-4ff4-8481-982b6686e0df", "comment": "Malware payload (Mirai)", "value": "e435885cb86f14d9349084cdeb69fd3129baf098c8720dabcfafc56c3cc2e596", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459112, "uuid": "879d4a9b-97f3-4cfb-9868-44bb5aecdfb3", "comment": "Malware payload (Mirai)", "value": "d908baef4cc06c00c98fca46602c4049f0ec041e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459112, "uuid": "42398c07-0f4a-4e7e-9185-68ee1f42f229", "comment": "Malware payload (Mirai)", "value": "f846a88c43a140faaf4a5094502f7767a1f92661c4294bccb0102473bb8686b24fc375b25d879ce59c8cd18ce0bc97ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459112, "uuid": "e8a2b8f5-ac48-4c5e-8214-e2870f32a3e7", "value": "T1EA23F17C1E49C5D3C95A50752AD54310AC9D2EF3C192DCBFAAD2E6CCB40A8663D83CE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459112, "uuid": "273f333f-a943-417f-b51b-f7342e80521b", "value": "768:V+jm/igUe0HCLCO63QTxr4p8UOvwLD7fgrKclxXhoYs2NxehVT9O3jz31g0kgVhs:VFigU7M6q4m0LXf5cvXhobXt9Ozz1v1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459112, "uuid": "98a169de-37b6-4f37-88b2-4abf8764fde7", "value": 48688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459112, "uuid": "e096a750-f9ed-4e06-b636-4e263aa93484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459112, "uuid": "0ba55ed3-81f9-49c5-adc6-ba7df1bc2396", "value": "SecuriteInfo.com.Linux.Siggen.9999.14984.13009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ab553e-cd14-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764414706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414706, "uuid": "e79190a7-7b9a-4d16-af55-84e25cee8bda", "comment": "Malware payload", "value": "421c26bffb7b7641160a9d1cfb8d7aec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414706, "uuid": "c14ee5e7-8b15-4450-87ea-f027a1deb158", "comment": "Malware payload", "value": "e9248cbfbcf23ca7faabd0c3eadb9119b047296784c45d47f6c6f5bc306366bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414706, "uuid": "e5a17408-5ffe-4221-84ad-877b7c472c7e", "comment": "Malware payload", "value": "156ef0b55686028957f3675f3cf76ab13a6c56b9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764414706, "uuid": "4ac8fefa-4822-4962-b4da-7cd019be75ec", "comment": "Malware payload", "value": "2f1ae82ae7a8af04299caf7901eaefca92cf56950d73ec5c9d18da9509b7c619ba18d211fcfebbb2d7857512b5d1a10f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414706, "uuid": "a7e4e218-de91-4138-8e24-8759bdb148ca", "value": "T16E069D5AB3B800DAD0B7C17E864A4757EBB275051720A7DF15D486A52F23EE21EBF310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414706, "uuid": "662b6b52-eee6-4fab-8afb-8d4a4dc06c2d", "value": "ef20b0ad5a7f93a6be4a9f95b83082a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414706, "uuid": "e7a9fef6-52f4-4b36-a5d8-ae605864002c", "value": "49152:TcPPOVew+LhOEJITKWMgiE7R5aCYcjnDu6213zpO3f2ozDaVSHVxyr:7VvaqfDu/xzMbzDISHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764414706, "uuid": "06401252-4b6b-474c-98d3-9ed9b117f83c", "value": 3773440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764414706, "uuid": "fc50b118-7e35-4888-9a17-61afc635078c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764414706, "uuid": "327dd253-f764-49d6-9d29-bdbe1ed2988e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b741f44a-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389160, "uuid": "6c878cd8-1215-4c4f-9ef3-e13ffd2ef9f7", "comment": "Malware payload (Mirai)", "value": "4df02cc6b3b26f70aa668ad1d862e6e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389160, "uuid": "447f7480-9e5f-4b65-b909-563c98fe553a", "comment": "Malware payload (Mirai)", "value": "ea3c46ba8aedcd54cd994de0ce426e9683a787dfa5bfd52e8d2b9f895eb409b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389160, "uuid": "abf1b571-5af7-48e6-b8bf-b61b13b22e48", "comment": "Malware payload (Mirai)", "value": "632bd2f7bc3b208a1d8ffb25849bc91c3eab58a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389160, "uuid": "c6d20c2b-c569-4e30-b6e0-7074a5b134b2", "comment": "Malware payload (Mirai)", "value": "d082cbaab26f66011aaf7d293ae466b5b08dd2dba955df4f940a18e5dbd39b44459a2825eff01d6bfbd4472445e6ad1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389160, "uuid": "95510470-f569-4a3d-b4e5-6f40a258a7b0", "value": "T18E530220783DAB8AFA7FBC72F449EA8509725B59F271CA00344597932634DB1F345DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389160, "uuid": "adce4187-3ee9-4965-a314-ff6b182a78b6", "value": "1536:4L3hAt5wK2nwDnyMyOVs96Axgi9kTjX6F6AJj4u+qgw09U:kRwKK2wDyrhDmnXG1j4u+qgwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389160, "uuid": "4295ace0-5fb5-47e8-b8ca-c9cd4fe9114b", "value": 66016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389160, "uuid": "30198478-87d3-4a57-855c-a7568e5c7bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389160, "uuid": "34e1fbef-0eee-4171-bdf5-448d40de4873", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da90192d-cd74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764456221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456221, "uuid": "68a6c9a6-468d-47ff-9f57-1fd78d0e9870", "comment": "Malware payload (Mirai)", "value": "5b77627556324541c1a34b8423003708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456221, "uuid": "b972a707-c96f-4d43-ba54-161ed3f50bdd", "comment": "Malware payload (Mirai)", "value": "ea6b9e94dcac8c22f1364cfa9ff4482fe6c224b593443a1604e8fd60e08a16dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456221, "uuid": "d701cfe3-0a78-4ca7-8d64-10a7df70a06f", "comment": "Malware payload (Mirai)", "value": "a65716daafff7cab8d2f049033e8abc29c78550c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764456221, "uuid": "3634ad83-d4f5-48fa-8bb9-e39cae0c0a79", "comment": "Malware payload (Mirai)", "value": "dd544c97f024256d1956704f2367e0e6c06e396e1ff8cbd91277a9575e8359d354fddb07f09a1d7f9aeb29f800ef27b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456221, "uuid": "b22bcb57-5f58-438b-b7a4-17da58033a68", "value": "T15813F133B9CDCF46E18B917959EB29450150FA141F02C7F4A2C806770F667BA27ACEA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456221, "uuid": "5cb4d130-2f25-4f7b-86f2-74fb43317f90", "value": "768:1pf/8KshvtflEvvMYx/jXZTTAUFVQIlBeIYTl+nNi+oHhWpQnbcuyD7UoQRjM:z/yFfKMs/jNTAUbhBexwng+oznouy8oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764456221, "uuid": "de075244-d5c8-4dad-b371-8af250f04408", "value": 45440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764456221, "uuid": "93c36ffd-48d5-4672-89b0-fc62c77657b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764456221, "uuid": "265d5c7e-844f-4734-ba46-3d48518ef043", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76789593-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389481, "uuid": "e7698030-809c-4862-b986-c92a9cb5f4f9", "comment": "Malware payload (AsyncRAT)", "value": "61b026c9bd8dfea0198dfe551f21f95b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389481, "uuid": "2bc38ee3-53f3-4e04-ac20-5cb9af3da87f", "comment": "Malware payload (AsyncRAT)", "value": "eb5ea25936f878900e606d099fc4f3be309a4951e98d4b4ce53d8d8f4d2017c5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389481, "uuid": "bb551e6a-7487-4c05-bf99-26837837220f", "comment": "Malware payload (AsyncRAT)", "value": "8e8560de901425adad11e910d9500335f9ad5bd0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389481, "uuid": "5e6e41e6-6efd-47a3-8524-8b9cbc2a6b6c", "comment": "Malware payload (AsyncRAT)", "value": "43d48265134a43d7cc1071c65e55113e37d832d704dc3d0466c06bd07dbae73ab9da929ad9627a86b40c6bb5ce24aec5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389481, "uuid": "e7282508-48e1-4796-9bc4-5d972d2c3abf", "value": "T1488306C76E4951FCF299BABF979BC17C0CEA6C4209FA5E1E16CCF14FA622D8149401B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389481, "uuid": "92fd8107-e3f6-4376-be5e-ccd0d84900eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389481, "uuid": "ec3b3b26-c986-4207-88ee-17ac0f4066d9", "value": "1536:QOn1ABYKjF79/KOjDlvJfcFUgZ6odzz+BREZVJ3bd8sF:91IYMF79/KOjZQUgZ66z+n4VJ3bd8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389481, "uuid": "fb81d168-143a-4c9a-aeda-c21340b12007", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389481, "uuid": "83a72163-c26f-4051-9a8e-82833bdbc2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389481, "uuid": "42a69a8a-7996-42e7-b4af-8d9eb366f755", "value": "regedit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff64b59-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389148, "uuid": "23432c47-8502-4d10-b4a5-3628d6dee17a", "comment": "Malware payload (Mirai)", "value": "eb828d70970f8b2ba9df3c5a408b8c7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389148, "uuid": "f5b51aef-336a-402c-a2d4-9806014693a0", "comment": "Malware payload (Mirai)", "value": "ebcc245b29f885b942713d2d857e2d522919465bdd0ec28754115b66c5baa8da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389148, "uuid": "8af6a05c-525d-4ec5-ae7e-f76fe000411c", "comment": "Malware payload (Mirai)", "value": "4c35b0ff9cc7410e9c5273d7949cf057ed2fe94b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389148, "uuid": "9a8c71b6-6953-4b84-9164-07b88ae4f18c", "comment": "Malware payload (Mirai)", "value": "092768b36db0daa46566c81cb271c91a1eeea029d2076282ca7e7f1a9859271c9937b907345eda703109f4c57012ab6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389148, "uuid": "91737fc2-4a4d-4cce-b3ca-cae132972c87", "value": "T1869329CAB400DC7DF81FDABB4463490AB931E3515A931B277767BD93AC321A44867E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389148, "uuid": "090407aa-30d7-4fe7-91b3-6b359056749e", "value": "1536:c8fF4Jus6GxrbZn/RZ9AI00D4H05Oc3JmWYHa8Y6IXFVPQ8IQv6OHbEiYAT5vCH/:cBrdnXnHM68hIXFtpSTifTN+l0fArazY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389148, "uuid": "028dcadb-3793-4244-8298-f9ec9444a676", "value": 91724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389148, "uuid": "77585fc9-c8fb-477f-be61-fdaf3e94bcf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389148, "uuid": "f8ea59b0-69ad-476a-9750-9df61e4953bd", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9799b6b-cd16-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764415900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415900, "uuid": "3698e822-1281-42fd-a14d-a5e285031d24", "comment": "Malware payload (Mirai)", "value": "ec31872080c8f616f15e0a41978728a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415900, "uuid": "5edce722-cf0e-465f-92f1-f445d215f583", "comment": "Malware payload (Mirai)", "value": "ec7cc4c1b3944c9b9d9d514915ca193206f348a283ef15287a3c363d7c4edb6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415900, "uuid": "bc883a9d-ad10-4d33-a0e6-68d736d540ff", "comment": "Malware payload (Mirai)", "value": "f7a49174acbb521c3c1114ae1ca2d03264880242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764415900, "uuid": "70dcdafc-3f6a-41d1-b939-9d0d940145bf", "comment": "Malware payload (Mirai)", "value": "6eef3413d4d9f3e40603ffeff13e0f206346b37dd50da94a91a54107c930f8d2c1f1519562058f677e5404b970129828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415900, "uuid": "92486f1a-edce-4781-a5e0-9fd9d3bd3e4b", "value": "T1F68312154D15850282B02E75EE18028F1CDB5EB664BB207B53E41BFDEBF26C32E9C85D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415900, "uuid": "815e4b1f-4403-48ac-a234-08db813a3d16", "value": "1536:7u3dNC26J0gBpfX9PV/aVmKaYHNcAdXIjpZaT0VoxSHL7FX0Fknqy3rg6tWGSqlc:7MD8L1VSFHNojpokKSHL7AMUPGSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764415900, "uuid": "9b27d9e1-ee61-4fb2-a0fd-8dbaa3dacebe", "value": 85756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764415900, "uuid": "ab1008ee-9584-4969-81d8-5be49ecd7d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764415900, "uuid": "0866135e-b3a6-42ff-a012-c6b4103993d3", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5009705-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764393451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393451, "uuid": "d51ca929-8d25-495b-842d-a461acebe454", "comment": "Malware payload (Mirai)", "value": "e385a5e29bdaf2e37b61bc9d2b3316cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393451, "uuid": "341262aa-c6d4-4928-9774-987c74133ce0", "comment": "Malware payload (Mirai)", "value": "ecf85d6b0d40e36d86fbe971aabc564cb35273a98972765e84793e6d87504c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393451, "uuid": "0eb290b3-3a15-4775-92d4-8e9dfcb906de", "comment": "Malware payload (Mirai)", "value": "93042d56b578896f0b0afb1de43321213e8ccd2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393451, "uuid": "766aa16e-a0f8-4330-8671-7328a713904d", "comment": "Malware payload (Mirai)", "value": "d747e3d8eeeb105ac68e3407526592564e9d076ef4350f7f2b270c6e67e296a2b2fdd7feea0fc15c90a03ffcc753a853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393451, "uuid": "a9f61898-60be-4a57-ba69-9d931d449c56", "value": "T1FFE2E140DB8465B4CBA45DFDFDB44F59AB68077CB46AB00B0E401A086D93A5793FC4E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393451, "uuid": "6d463e8e-1837-41fc-85e9-594b4391b826", "value": "768:PtOpnZLIbZfMf6M6EDjQFKSjXkXYLW/tU3J0hUgD9q3UELUE:Pot2tUf6MhDjALUXYLW/tlUTLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393451, "uuid": "9f3ec7ef-99a1-4c35-9fb5-033ad14f2e77", "value": 31764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393451, "uuid": "6609c7be-f2de-496d-b4de-0b03cdf72f65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393451, "uuid": "7ca28ed6-82b6-4812-b975-23d77e2d4042", "value": "niggah.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a63798-cd7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764459860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459860, "uuid": "4ae7de50-6700-4c35-ae67-fa8fc82c57fe", "comment": "Malware payload (Mirai)", "value": "86183ebfb5d7f155c3b5fa433b4af744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459860, "uuid": "908a0469-bf86-405c-b5aa-b68d89461ea4", "comment": "Malware payload (Mirai)", "value": "ee5e3a824668de1ac30309b67d7e01c05bc1049f690d36147ea253878d7e3885", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459860, "uuid": "30a7a363-d887-4d41-8d5b-6524c7303f9c", "comment": "Malware payload (Mirai)", "value": "1a803a88281d8cfdb64ffb229fed5d42d27b9352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459860, "uuid": "fdcdffc0-b029-49f0-a555-28d596b59abb", "comment": "Malware payload (Mirai)", "value": "4d44cc6c266047bcca6a9ae7043aecf0fe699a0f9b1a933b0b0bef9dc20f68c1188d5566e0497b1cbd909426ac37c136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459860, "uuid": "b15d254c-a900-4be7-9aa0-f10d4370efed", "value": "T1F7830842B8828B3BC6E0237AE66F658E37A167E5D3DB3117DD208B21378111F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459860, "uuid": "0a05e7e1-fc95-4ac3-9c9f-63a2ec16ce4e", "value": "1536:I7oPJ4qi9ls26tCtp2ASkwyxFXyI20sh+oXBmKgNb3WHC2:I7oPJ4qi9ldTs+oCWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459860, "uuid": "10270713-0ed8-42e9-ac74-da19a831b6fd", "value": 81496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459860, "uuid": "b04db4a6-7049-4c5a-8775-a1ff9f54f89e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459860, "uuid": "07deb425-e48a-4685-b327-86bfac51e251", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73209678-cce7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764395488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395488, "uuid": "1c76e1f2-d16e-4bf8-814e-e26fe5038eec", "comment": "Malware payload (Mirai)", "value": "05b8181dfc97dd6455224d10bed5d549", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395488, "uuid": "b924ca82-bfc1-4aa6-b342-5de12a411a45", "comment": "Malware payload (Mirai)", "value": "ef3c847353018e42ace6a8b183d5f93191a821311a536a3b30897aaefa0e52b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395488, "uuid": "d23650a4-b87b-4f18-b63d-dca28fe20d36", "comment": "Malware payload (Mirai)", "value": "be17d1e23b7196e542c7173a04881406a88ae92d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764395488, "uuid": "4a1eadd5-0fc1-49b5-9c14-9ba2fd93e452", "comment": "Malware payload (Mirai)", "value": "e2ee46c9fd46ea414247fe586777d58db06822fcb6d9569c1838587f89e4bca703e12bbe444b058c137167d98d20fd65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395488, "uuid": "072541b1-63ae-4b87-b53e-e8620cd68330", "value": "T15BD30809BB614EF7E86FCD3706E9070521CD655622B83B763A70E82CF15E28B1AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395488, "uuid": "8c1c4c2e-b901-432b-8bc0-0e3a30bbfe94", "value": "3072:4EyN7Oeq6wx9Sa7cwTgq+VeAY6KIOOg2gy+edSjQsyA7QuRG2qVFY8c6:qgT6wjSa7cwTgRA7QupqU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764395488, "uuid": "43b3103f-dcb9-4896-8c18-d973311b474e", "value": 131224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764395488, "uuid": "3da5f9f9-0ec9-48c5-896a-fac2468b2a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764395488, "uuid": "adab589d-ede9-43ab-a38d-c9959836888b", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a5d6ca-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764392134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392134, "uuid": "a968ba69-fb10-4dcb-8c71-708eeaa899f7", "comment": "Malware payload (Mirai)", "value": "138afc45407d180ce37986c1f231b1dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392134, "uuid": "5a846069-7699-4e1c-9f3a-5270117f7067", "comment": "Malware payload (Mirai)", "value": "f08c5f12ed5862443772709ea5444c82440aa8e10bfc03ffa6cbf8ede64ddd3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392134, "uuid": "5744dc42-a0c2-4afe-8b78-048d6f728e74", "comment": "Malware payload (Mirai)", "value": "ddeef1f3d12c44865665ad85e95927eae5324870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392134, "uuid": "6c201e23-2c42-4d02-955a-969b44e04310", "comment": "Malware payload (Mirai)", "value": "baae130cea35e682932ed6f10abd94b3687f7867b6fdfe9348765403543c5040da89963464a73d57668c9dd5d19318ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392134, "uuid": "1ffab56d-f7f5-4d8d-9fe3-d7b4b077463d", "value": "T1D863127481A99830D878DB7C48714D59AB6169BECD7B35B3BC200E19FA8775402FB4CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392134, "uuid": "9526a0a8-8652-4e12-a99f-e2d04754cee2", "value": "1536:obgwNwwB8YByGy4OpK1asRcHLwGXLHh97sQ/D56hZ:UNheHK9cPLT7sQ/0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392134, "uuid": "e2c0729f-ab15-4dc7-a17e-1c1aec78080a", "value": 72292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392134, "uuid": "db7eba51-86ed-4555-8cf3-398d20e7dec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392134, "uuid": "f6803e91-b451-486d-9516-17c814faeabe", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a835fa1-cd04-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764407929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764407929, "uuid": "8dff8850-0a41-4f3f-b788-eb1b3491ab26", "comment": "Malware payload (Stealc)", "value": "3f93ef3a219d04bf4f1b1f8629d21b84", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764407929, "uuid": "e04ba8e9-05b3-48da-94dd-b70c78f4dd82", "comment": "Malware payload (Stealc)", "value": "f0fdae9b8bb551701c88e1150f55f8896c0bbe18e3752cf5a9873713e4673303", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764407929, "uuid": "e07d9c59-10fc-4815-935c-3a444aecbb2b", "comment": "Malware payload (Stealc)", "value": "5c01a610a2a7489f7eaeb3bcfa3d83b43911b793", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764407929, "uuid": "2c98572d-7c8e-4ea9-a922-df9faac777c0", "comment": "Malware payload (Stealc)", "value": "c022fbc3f5ce4c2f8d7a785061e7e6e25dac1fcd703d9c24c18889526c627be55a5c4b51803c56972f6b8c401456ac36", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764407929, "uuid": "ba065a81-9db4-4017-83e3-6a5d198be767", "value": "T137162A036D91CA95F05AD236ABE2718176707CD40BB17BC71A84267A2D3A3C85EF7F18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764407929, "uuid": "73d1fb7d-fee7-4e90-865e-dd0ab5876837", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764407929, "uuid": "5de27bcf-afdb-441d-bbac-82df763776f6", "value": "49152:8BfulaBmUbjkSMjlV+DZuthAlqj2GDK4E7CJ4P8f+00BU8/7kkHkrQ7WLd0pyX+b:8EiES+l3mQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764407929, "uuid": "2216f105-d71d-4e56-893e-3e99c9c9e26b", "value": 4271616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764407929, "uuid": "832db5a4-c5b9-4e55-958b-60cef61a19ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764407929, "uuid": "cafbf099-81ec-4e0b-832b-516ce81b1d4a", "value": "download autodesk fusion 360 full crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365b3736-cd10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764412996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412996, "uuid": "38a1b983-a9a4-44cf-98c7-d5bc044f1b01", "comment": "Malware payload", "value": "1dfe74a2101410348f4265e1f61fd176", "object_relation": "md5", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412996, "uuid": "8ec634b7-5b4c-4cdb-9736-bd2b2d5d4065", "comment": "Malware payload", "value": "f1672e6c5bb66e027c43d49a38c3e7029f474fdada3cc879e8034601a7c5e6a4", "object_relation": "sha256", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412996, "uuid": "69a20c2a-7881-4c50-98bf-bd7e363903ee", "comment": "Malware payload", "value": "d10230083492b6864ebd48c9682e2c5f9c86923d", "object_relation": "sha1", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412996, "uuid": "d8f6a631-7122-4a39-b986-03b3300813c2", "comment": "Malware payload", "value": "918f0b8b1153b5363b094ce9201db1bd8e2b74c9fadb01381a5291e2753ec3024de7b201a3eee731ea1202b873ebf2da", "object_relation": "sha3-384", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412996, "uuid": "01f40e73-36c1-4cad-8d98-8231a8a5588f", "value": "T1CF51F7C53E50F8AD932154E9243F3029F1292D39493AF8D0D389D4F56C78E49891AFB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412996, "uuid": "8667b773-3449-4c42-b70b-e96b26dd8fa0", "value": "48:0eUpI1GFO7C7ReT66GHBYPm6YEOyGvVpeuwTLHii3Ik4X6qPHn:BUm1WO7C7Rem6GHeu7EO7zeX94X6qvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412996, "uuid": "2fe062cf-7f7e-4238-9bc7-cc215c3a2867", "value": 3150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412996, "uuid": "85215e21-ff77-4ac1-8b5a-5d688f84477a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412996, "uuid": "49cee468-baef-4e45-8483-4fc11a8e00eb", "value": "photo.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2bb832-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389494, "uuid": "343c8f22-c375-4609-9951-631af8b81402", "comment": "Malware payload (AsyncRAT)", "value": "b4516d06ef5cd12cf7d46210c45d9261", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389494, "uuid": "4322d748-061e-4b33-870e-859b73da529c", "comment": "Malware payload (AsyncRAT)", "value": "f36fd5e030bf937d652fb5614165494b41790133b585329096b9b1c3b26b9268", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389494, "uuid": "7ff209b6-6d45-40db-af35-c44b6339758a", "comment": "Malware payload (AsyncRAT)", "value": "45c8051ce1382fdb9ae83b242c91d76748772718", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389494, "uuid": "55a08cfb-e31c-4410-b886-83c2c8b7d839", "comment": "Malware payload (AsyncRAT)", "value": "8203fabb1ed3450b339b6ebc78fcf3773baa2d6ebc145a70ffacd3eb9626f986eb5eb0873c4a4596d448cf2bc612f677", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389494, "uuid": "58870c28-7baa-48dc-bb38-72aa7aec76cf", "value": "T16B05AD11F7808039F4A359358ABF9725993DB8A61F75DACF53C8032E1E726E09E34726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389494, "uuid": "708b0283-7e49-471b-9df4-09339397f23c", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389494, "uuid": "7a917fb1-0b71-4338-96e1-def6751454cb", "value": "12288:pYyDi5eNiQ7uysMFZzN/E/msumGm13a0wIk0BX3RKuemGd70ioGuVWW6oIv:6bvgUGmafDd70iTWCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389494, "uuid": "c1215f16-ad3f-44db-8158-2ca37033b15f", "value": 811304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389494, "uuid": "1d27e452-78d3-4f6f-b4a2-2d952b69c642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389494, "uuid": "758a58b8-8330-42dc-ba31-a595b0300d85", "value": "vazm42r9y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7df85b-cd59-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1764444307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444307, "uuid": "2177546a-72e5-4f4b-a17e-d24ac2739a2a", "comment": "Malware payload (Adware.Techsnab)", "value": "6992669b28def409f65e9813e9978a96", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444307, "uuid": "ba2ddeac-9d49-49e4-a33a-d0c974acd65d", "comment": "Malware payload (Adware.Techsnab)", "value": "f49f0fd5047c0f394ee85aa18c1ce0c47f7a1d06daaa8618afd1aeda8a4ce685", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444307, "uuid": "2a6ed862-d818-4a6c-8d86-d4874173bd9a", "comment": "Malware payload (Adware.Techsnab)", "value": "867db8e1af064e03ddfda3b2ddd9ef01cd147512", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764444307, "uuid": "d68926bc-014d-4f33-8129-6bc0effa34af", "comment": "Malware payload (Adware.Techsnab)", "value": "390a39b958d022d19dfbde3d09d1810b8094bb5cc851b3005ce11d94fedf70a6dc765c0f5b934c6ae52c638563e1be0c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444307, "uuid": "360dd7ed-1e3f-4f81-9db0-87e34edaf03b", "value": "T15FA6E70173F841A4F5B69BB4BDBAAA2A9A37FC615F2183CF1154564E0E32ED48D34732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444307, "uuid": "04c29b02-98e8-4649-9fe2-3fe8b17352d5", "value": "e59e2176b6396e3a4c2c408e3cff4347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444307, "uuid": "064e2752-f594-448c-8755-8b14ebc88231", "value": "98304:k2Qeic2dgzeJ0zY5sjW83S3/D+GlNyi2C:k2QA24zYAW9/Co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764444307, "uuid": "7bbcaa1a-fd62-46a1-b0b9-894996ee340c", "value": 9550160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764444307, "uuid": "4c3b955a-9237-4fda-8fbf-ca7225972dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764444307, "uuid": "ffacccc8-5e24-4d82-930b-ce544f46b631", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80636995-cd42-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764434595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764434595, "uuid": "df85b6c7-566c-4e54-bf1f-ce1070b3984b", "comment": "Malware payload (SalatStealer)", "value": "9ebb2f374bc2289c6eff49bd23cebcb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spyware.Stealer", "colour": "#F45305", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764434595, "uuid": "2c8a5e13-b71c-44b9-ae83-9ccfa457117e", "comment": "Malware payload (SalatStealer)", "value": "f5026b9a4f474dfde97e7fcfd45d330ae43d8aeec64ca979af639621b49fc9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spyware.Stealer", "colour": "#F45305", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764434595, "uuid": "a4c83e53-4339-4bf4-8169-1af83d15e64e", "comment": "Malware payload (SalatStealer)", "value": "7c6c842fc62fb8590ba64682d3a555d03b0701e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spyware.Stealer", "colour": "#F45305", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764434595, "uuid": "2e797cca-c51c-404d-a93a-a762b4fdaac2", "comment": "Malware payload (SalatStealer)", "value": "6c4bb93a70c59e27a90f0f842d2f7ffe94ddb3f8aee43febd7e500c596f2881cfccdb933045c6338d8de15a8f43ba2ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spyware.Stealer", "colour": "#F45305", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764434595, "uuid": "5fac9deb-ce49-4850-87ae-60702f07023d", "value": "T11FE5334CE0292D33ED9EEC375A2B5B27014FDCA090A9D3DB3535A425ED910E774C63AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764434595, "uuid": "f4a5a969-54dc-45b2-9ffb-b30d144ab332", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764434595, "uuid": "d8b6ab56-6487-40b8-9fcc-60f6d7803752", "value": "49152:lZLwVV9RFvszodjM9/GxcNEGdZG2sx4O5p4DIjVMNEGuu7r3K3/TQXV4mfKG:lc9RF0kdw9/wUdZG2m4A4DIZEMLY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764434595, "uuid": "2b1262f9-7d1b-4d30-bdbc-5ca36e7131d0", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764434595, "uuid": "42143405-4bb5-42c3-b61d-883c3b4e26b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764434595, "uuid": "420bdbec-ae01-43b5-b571-fd0b86aca6d1", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f7d9ba-ccdf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764392190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392190, "uuid": "9a23465a-ca92-4fc8-866f-94a62e5672a2", "comment": "Malware payload (Mirai)", "value": "1f7946b3ae524aab4ba73b3af89f2272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392190, "uuid": "ec8bc890-de95-44c0-be13-cca1fc167cac", "comment": "Malware payload (Mirai)", "value": "f5185ead8952444b0e6eef5faaafe66ff8d06f928f0277c6fe40a486b6cb1c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392190, "uuid": "12cc3242-c74c-4009-8888-20626ef523e5", "comment": "Malware payload (Mirai)", "value": "633fc90869954f6d457f26b55584cead48e1c89c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392190, "uuid": "856f2594-e5c8-458a-9973-36a22cf563c2", "comment": "Malware payload (Mirai)", "value": "ac7d2409195526335831db609e439799af1d6087b37b1e4e24d919314cc83b823bccb902d2d120d722c6107efa403232", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392190, "uuid": "4f0bc31b-433d-46c2-972e-936452917f14", "value": "T18B63A50AFF650EBBEC6BDD3705A9070534CC651A12A93B393974D82CF55A14F49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392190, "uuid": "1aa87374-0ec3-4f46-9885-85bfdb5b345d", "value": "1536:LbnXBb/yk74QSIa1ECVYZ2ZEhNH+9BxJ1Eqqe:LbnXBq3J1EdZ2Jj1Eqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392190, "uuid": "1a1a6b28-bbe2-4279-b226-06e649fc3bc0", "value": 72664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392190, "uuid": "ff7ee66b-8c07-4b81-b9c9-b8f538f7fbe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392190, "uuid": "dc8e8cc7-8038-4dd3-bb4f-e66e479f1798", "value": "niggah.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78a340f-cd7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459249, "uuid": "5755110f-bf18-4a72-bddb-7e0cd1da4727", "comment": "Malware payload", "value": "79510d55e057f411355b65399c7beae0", "object_relation": "md5", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459249, "uuid": "3ca2078f-5445-45e7-adf9-19f79e3b2fd0", "comment": "Malware payload", "value": "f57603d7f91750f8a993f1de69464eab005bebdc5756edebafb1f77039c3164c", "object_relation": "sha256", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459249, "uuid": "eaf0b12d-9e27-4cfd-9f9f-9d149500a289", "comment": "Malware payload", "value": "00cb9a0139790f5bfa6912a8bcae09117b8a8c00", "object_relation": "sha1", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459249, "uuid": "132de716-12f0-43b1-80d7-d29a5e93622c", "comment": "Malware payload", "value": "c5225a613e5cad23344821d3d084e27da2829e124a24c64d4e8b17cac637cf8019244e45f18d00d792849323944c0792", "object_relation": "sha3-384", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459249, "uuid": "ecea8cbc-0513-4dac-9907-17e299a85ea8", "value": "T1C7A59E317E4F8163DD9552B2516C7B76829CE8744B342AC713C81BABAA546E36F32C33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459249, "uuid": "b52508ae-e42d-4283-9e7d-43274364053f", "value": "81db3ca17da7163336eacc95d0b0ccf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459249, "uuid": "ca958312-6963-4a27-abb8-cec77534c0bf", "value": "49152:0aTdr4Rb+8f0/IbunJ8p3YtliYQJJdkjsl82ot4+Ej2Ez+lneVqkPQETxhSGR7oF:n6lbuJ8p2QJJdkjsl82ot4+Ej2Ez+lnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459249, "uuid": "27b3a8a5-8abc-48db-a5fe-4b05739769df", "value": 2119520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459249, "uuid": "35b30011-fe44-4cc1-a744-b9d045dc745d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459249, "uuid": "ca15a300-0fb7-41e8-8263-bfc1ddccf583", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3ca9e4-cd38-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764430404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430404, "uuid": "c42d4f3e-8d6f-4159-b1fc-2583d3d7c8e5", "comment": "Malware payload", "value": "5c60a113f306a61212b23bc25e82322f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430404, "uuid": "f90c01c6-5bfa-49e0-a1e4-0b6565eeab82", "comment": "Malware payload", "value": "f62ec8d78fcfb236e4bf1f0f92d44ae53a187af46e0554646f2726ea6bb17a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430404, "uuid": "af996c2c-daba-40cb-95d6-4b1421aa8f28", "comment": "Malware payload", "value": "f61bde5a0ab814ed0330c26b585c5725b71175f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764430404, "uuid": "172f7be7-e8fd-46a3-80a6-86d8245cbbb8", "comment": "Malware payload", "value": "e3b3f72b14b6f356b085b500c6bb2088ff258e84b4e44b65cb0eafc8279d329b16a8b156d698b6f6330efa13e8c7e617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430404, "uuid": "0683e6b5-c899-4206-a017-0b8cb7f47ece", "value": "T191441862BE955400F573C07C0667DB57E2737989279CBABF06ECC60B2326947B58CB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430404, "uuid": "74bf3f75-9073-4d2a-980f-3711bdb4c795", "value": "820af234f193b87222900e687f0de71b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430404, "uuid": "ddc5a219-738b-42f9-b078-d417e1fce68c", "value": "6144:22BiIzxweJtAMfDb9yMn2F8TtGTUbnAs94vc:22BfS4FKIbnN9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764430404, "uuid": "a47e5bba-67db-4e48-b98b-847fc7457df9", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764430404, "uuid": "6e7f092d-fab2-42be-b4fb-2daf93b0ff31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764430404, "uuid": "fc3907ff-6609-44a2-9d3b-691f0f53a10e", "value": "ore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b60cf58-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389516, "uuid": "48eac04a-c48c-4add-83c9-3c830dd19584", "comment": "Malware payload (AsyncRAT)", "value": "7ecd228f5503c2fa4ae8d1ece0d004d9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389516, "uuid": "9cb6c2d6-3a1d-4d70-ad52-98c75ac4a433", "comment": "Malware payload (AsyncRAT)", "value": "f6741bb0a3ec835dd733efec2a96b92ff83d4454a5e62c3e75e3966c40f66a60", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389516, "uuid": "9b181402-f934-4a0b-aae0-919998c78151", "comment": "Malware payload (AsyncRAT)", "value": "b66edeb163929869186f7f1f43a3f9f36ea5fcf5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389516, "uuid": "d2a5be4d-84b9-482c-a8c9-c4c1059347ca", "comment": "Malware payload (AsyncRAT)", "value": "cb6951b4021fce117a0932cf555386ff967fbc834b6dac1438055715409ec295d953e4901d05596493ef1294f61b207f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389516, "uuid": "f7fffad0-97f4-4ad1-bdde-4a6a8e4b572b", "value": "T100835B246BF54169E4F76F715DF472A2EB3EF76229128A2F3045034B0922E49CE507BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389516, "uuid": "c24579d0-5f1f-4e14-b6b4-71e58eb9c8fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389516, "uuid": "6a3891d4-33f2-4fde-91f9-21fd0cb8e9ad", "value": "1536:RnA3asSkD6nFHbAVecYpVwaExJO1EA+Bdd:RYasdDOFHbAMCaExJO1Ebdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389516, "uuid": "0545b80a-f261-4d83-bd18-e3d3dcba254b", "value": 81932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389516, "uuid": "c87c3696-66b1-4845-b9c9-f27f0742b5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389516, "uuid": "b121032f-8955-4426-adbf-9a19459323f5", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4243bc4b-cce2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764393259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393259, "uuid": "64dee823-f40e-4160-aff9-7ab08e187566", "comment": "Malware payload", "value": "f3dae8e1dacf70c24ec61a2767ab2099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393259, "uuid": "7ad4b18b-e83b-4ab9-8deb-24950aefce02", "comment": "Malware payload", "value": "f6b107d7d0681db56fd75f472b43e4b8190ec53af823a7fc455c9e2ad802aa0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393259, "uuid": "1f2e3eb5-f72b-451a-a408-8a2b9a98bdce", "comment": "Malware payload", "value": "661a0e51376446bc11b01f7c8e50d8c4ad5e49aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764393259, "uuid": "255c7024-4d23-4fce-8411-d61a26213b7c", "comment": "Malware payload", "value": "48d811ae4a1f05bcea5270903a685dcee20f4713d485341af987402521c50cfc4a6dc228e02ce422ae2dc2303e0e5829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393259, "uuid": "030ff091-1fc7-4614-adf8-a1f2231b9730", "value": "T169333B41B31C0543C5B36EB03A3B2BD0E3ABAAD122A4E385751FE68DD0B5D369546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393259, "uuid": "510015aa-353f-4631-b744-ee571ce4a90f", "value": "768:zKelPHJI7SAoWXOGwRCy9L/TYAGjpWvDfnmux+FF8tVGiEoIw:OsPpDW+qsLbYjw7fm+y8/1Eoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764393259, "uuid": "039c6c05-3280-4b5b-b3da-008487ceabfe", "value": 50652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764393259, "uuid": "7978d1d0-0ef7-45e7-932c-f27356ce5d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764393259, "uuid": "2673b178-65f4-4270-81dd-794719008b02", "value": "niggah.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a295632c-cd1b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764417902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417902, "uuid": "1b0d2fee-f764-4515-bc35-d9cdb58aa254", "comment": "Malware payload (Mirai)", "value": "8ae482f904a869dd2ccc610f88bc021d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417902, "uuid": "b160f4e7-a4b2-4774-999e-57f195976d27", "comment": "Malware payload (Mirai)", "value": "f713a62d34a2d645e9c491501ef597b6e5b991f022084c327d767cf10f169629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417902, "uuid": "1962d2f2-b478-432c-8918-26dc4ec6ca83", "comment": "Malware payload (Mirai)", "value": "f5b28b5f62ab5fd187d14149583c80fc41a29c0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764417902, "uuid": "f7aa802b-3df1-4917-8036-ec3c108d18be", "comment": "Malware payload (Mirai)", "value": "9ecb91b0d33896e99fae54ad3b20fbed31ae838593c872d51c5ea2a23903591821045921e7a806344b595d0fa552fb7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417902, "uuid": "a4cb2e99-fc64-4dee-83b9-8eb692e84167", "value": "T18C4319DAF800EC7DFC4ED73B8457080AB171E39945821A362367B967EC3A2A40977F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417902, "uuid": "de15817a-b2fd-4ecd-ac91-000a7f6f02bd", "value": "1536:0NYtujh9MFhs7e8p53Ggn24A+T25UXvxFZZH4E:VaqFhs7n3HA222fH4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764417902, "uuid": "04669b59-c4e1-4bf7-9cdb-d5006fe49e0a", "value": 58032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764417902, "uuid": "8d5515ac-de89-4759-9f27-ad0196229f99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764417902, "uuid": "abb45e8c-c31a-4d4d-a9a7-cad22871167e", "value": "niggah.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdef3f4-cd08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764409784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409784, "uuid": "99294f35-5110-4fd2-8ad7-94c1dfeb3c80", "comment": "Malware payload (Mirai)", "value": "49d4dc29838aed6f5a1256c90af7b506", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409784, "uuid": "cb14c405-3292-4736-8721-9677d8910127", "comment": "Malware payload (Mirai)", "value": "f79f501c76ccb19a1f4d8f2f91b58949f838e2e49d3214a6a787a5288e252432", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409784, "uuid": "dc093890-6fd6-4ecd-a49e-56cb74063317", "comment": "Malware payload (Mirai)", "value": "c0db90d14d1ffefac93bbc470bc0d47a897e9b93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764409784, "uuid": "eb189305-fc7d-4b80-9646-a3ff9a6aedfa", "comment": "Malware payload (Mirai)", "value": "b7e6bb8084e51727ce92c0c68e2ecd209666107d6af90bfa4423f866717dcbfb8c17610693ab7b087b89ccf9a7b609c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409784, "uuid": "ad4779b0-9fe3-4f16-a8b4-587ba87f27c2", "value": "T1D0D22912312C0F5ACAD11535252E03A047BFED91A0F07E8BD85F9B964A35E6B5C68FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409784, "uuid": "b0401edc-29c1-46b5-a55d-bd6996bcc50c", "value": "384:hJ5/GIeODvqI7wl6lQMy0HjYRm2fEMYih14Qzu/dMy4ORcOtH0MqUe1fgrXFyS88:hfOjFcEwMBF0Rcwpr+fUwEiypo1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764409784, "uuid": "603f1f61-92ba-4af2-92b0-37f7f73258c1", "value": 29844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764409784, "uuid": "8a383073-a96d-4522-8d7f-eabcda7e91af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764409784, "uuid": "b7894ee4-1564-43c3-9371-33c288197526", "value": "yakuza.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff48371-cd79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764458297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458297, "uuid": "d7c36403-0893-400d-9aa7-8052f9fc5765", "comment": "Malware payload (Mirai)", "value": "dfa4fef4e2eebcc7b23593fa3d6011af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458297, "uuid": "d51da0a2-e1c3-4be8-92af-cf3b504a2e1a", "comment": "Malware payload (Mirai)", "value": "f7dae6f669ec69a5ee353120dad0cbd2bbc62e3115bfb656b4c9c5e62058e7cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458297, "uuid": "b9db77ae-d9cb-4550-9674-5458397f246d", "comment": "Malware payload (Mirai)", "value": "d8d24d97fd909c0ee8b0801c3dc0e074ad553a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764458297, "uuid": "7cca0245-8505-4d84-8afc-d1dc99ded179", "comment": "Malware payload (Mirai)", "value": "e24d5d43391ccb6b321431a11680f7453dffb134d6307ebe35f3643258a58803a44257e94431a026aadfeff0fe8a7442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458297, "uuid": "c8b5ca69-aa63-4055-bb26-4ee6f41983df", "value": "T18B145A46EA414B13C0D7137AB6AF424A333297A493DB73069D286FB43BC379E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458297, "uuid": "7ca85097-f324-4708-b0d1-3a70d866196c", "value": "6144:9MOgR/fQdiYPIFgaHBMvlZ2Vc0CTMhnG3r5M/9tXKF:9MFR/fQAAIFgaHBMvlZ2VTuusu/7XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764458297, "uuid": "790a8ca9-edbf-455f-abfb-5b42d54f11c1", "value": 201506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764458297, "uuid": "58ae482c-be79-47cc-a26d-60715b92da30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764458297, "uuid": "bf60ccd0-2236-46a0-b48b-e06beaeb6e74", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc0fbb0-cd02-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764407240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764407240, "uuid": "f063d3f1-3620-4542-8a47-9d82ef78623c", "comment": "Malware payload (Mirai)", "value": "e34624be0362c26f5e053f69817d7535", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764407240, "uuid": "699efaa6-47ea-4f18-8d36-10aa31127700", "comment": "Malware payload (Mirai)", "value": "f8bcdd4cbda551dfcd43d4455c5ee1e9ba82aa60066bfbb16085a2a99064800d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764407240, "uuid": "aea552a8-5654-49d3-a1d8-3da16ef4faee", "comment": "Malware payload (Mirai)", "value": "3ebc4e8479eaac43ab3d3f67d38eea00de2aa67d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764407240, "uuid": "0480cb6c-d98b-4ca1-80a7-01c39d1f2ce7", "comment": "Malware payload (Mirai)", "value": "bfd771f9d5b6ea9e6170c351944abd5a094c3205493efeb8159d944cf184918f7b55d07a0b8c38f3dbd9d9788023f73e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764407240, "uuid": "72891edb-8d41-45b5-80f3-9d596a70aca5", "value": "T1CEE32A49EEA51FDBC16FCE74462F131B169D585FA3F2A33A467CCC48358A3485AE3848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764407240, "uuid": "0bca64a3-2d7f-4061-ade8-a8c17b0284bf", "value": "3072:oNPi2DOuWMNb8j0Fs92LqoPuS8ZRqw8bgkDUI9h2xeySdwJjT1wPP3v/VMNKyTBT:olWMNb8j0Fs92LqoPuS8zqw8bgkDUI9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764407240, "uuid": "f5fe87cc-794d-4008-996b-28980e7b4417", "value": 150824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764407240, "uuid": "4e9794a2-c2ac-4b74-8c2a-576ebd4318f4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764407240, "uuid": "14404b24-3669-48c0-b51a-7524e09e67fc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a3eb04-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389191, "uuid": "c6d15e15-adec-43a6-b7bf-0e949904a030", "comment": "Malware payload (Mirai)", "value": "e004048f42c3628cc7f04c0d78236905", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389191, "uuid": "a7ab097c-f994-4321-b204-c3161c73793b", "comment": "Malware payload (Mirai)", "value": "f8bd4cfd5fa1370ffc124aced50648315cabdc9d0f1207e90f62d9f4c36ca41a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389191, "uuid": "e9291ef5-958c-4925-8a39-54580517c760", "comment": "Malware payload (Mirai)", "value": "24c2a7b19e68a5f4fd24ceeb45913504171dcb61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389191, "uuid": "3a429574-fa81-448b-b08f-27cd96ed65af", "comment": "Malware payload (Mirai)", "value": "2fc304d877b78cb2d51308b5f46b9c7acfb29b9671b693ba6947c106c7d7553c722f471d735bfe6d76d052499b552dd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389191, "uuid": "1265ebe8-fc5a-4ee0-bd99-eee233c82334", "value": "T142042906B5CCC0FDC896D1745BEEB136D971BC6E023C715B2788AF222E8BE605B2D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389191, "uuid": "dfb0a45e-240b-4aaf-84b1-6895bc570e22", "value": "3072:7r4la+KuFYCIUWpUa7vq3ANxfVpGosDMxf/o5+g2gATr2bsiz4d:X4YwIU8ZDNS5L223Ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389191, "uuid": "35da47b0-4a26-413e-a2b9-2d8aa75ee9c0", "value": 182760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389191, "uuid": "e945eb20-8ce8-4d87-a820-966b66039447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389191, "uuid": "b036142a-9bcf-4315-bc3b-9c79f7a78ac2", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7326a322-ccd9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389476, "uuid": "b5b7dfa1-344a-431d-b4c8-0544327b6107", "comment": "Malware payload (AsyncRAT)", "value": "a6cba18049d6da05ef0359b6bb5436c5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389476, "uuid": "578637d5-5cd2-4773-b29f-2488f0f7b07e", "comment": "Malware payload (AsyncRAT)", "value": "f9c8caf1201c8132eaf90233e8449d40c67be84d19b4c85e7e35bb2668adeb15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389476, "uuid": "ad647d3e-ce70-441f-8196-cceb060d62ad", "comment": "Malware payload (AsyncRAT)", "value": "1cd13443c2f5cde24b783f782e4ad6ef9854933e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389476, "uuid": "708f7925-ea49-4fac-8ce3-6dcf753dc1eb", "comment": "Malware payload (AsyncRAT)", "value": "b16c81ae58f9026e1ba40d8f10ce288c8c897bab5abd0394c32ace53e4528c170385cb066ad8ffd1f85ea1f315a95620", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389476, "uuid": "e03a8c0b-f0ea-4b98-bcaa-23bb8541bdb9", "value": "T145A5390267EC0169F1F36B71DAB952649AF77C61AA3ACF4F12800D4E1DB3A909935733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389476, "uuid": "03fa0916-b0fc-4d00-8d75-c533184dca45", "value": "112bfbb18727302cb5425c20a464b02e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389476, "uuid": "043a061a-ec74-4d84-9ea1-518cdfe7bd75", "value": "24576:UKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIa:N0oKNZCWOLT4yXGQ6m6K2MtENK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389476, "uuid": "0af763a0-c116-49ec-b804-38b8607d3a43", "value": 2080383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389476, "uuid": "6642a5ee-52a6-453d-9cb7-2f52c4dd9f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389476, "uuid": "3d1a44b2-075f-447f-ad8e-7f0e85b1de76", "value": "iolvlopd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096fb3ab-cd7d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459736, "uuid": "e20d68b4-4ac1-49f5-8466-9ab3339b8ebc", "comment": "Malware payload", "value": "9759f4ae387ffbc53e1ff7a5e82439d3", "object_relation": "md5", "Tag": [ { "name": "213-176-79-34", "colour": "#4E6AC2", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9474", "colour": "#884542", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459736, "uuid": "c8189266-0cd2-446d-b8a6-9c6682b6dd75", "comment": "Malware payload", "value": "fa0d0d108f76ac4e015b52384b26cfdad50e0b2b6d8f333580fce7201030d2a4", "object_relation": "sha256", "Tag": [ { "name": "213-176-79-34", "colour": "#4E6AC2", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9474", "colour": "#884542", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459736, "uuid": "a4b4b880-fc61-4a1e-9e0c-46536c331abb", "comment": "Malware payload", "value": "7c35c14ca000fba9f56a2b8bafc06d3cacfee3ce", "object_relation": "sha1", "Tag": [ { "name": "213-176-79-34", "colour": "#4E6AC2", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9474", "colour": "#884542", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459736, "uuid": "5743945a-e414-48ef-b233-84a49ed62246", "comment": "Malware payload", "value": "0d1c768b59f0b6e599012fbea40714b0ac8d43c93a19ee2d2a9a1cd1692a1c313d4a53fb53e5f4ebb7a9712508542625", "object_relation": "sha3-384", "Tag": [ { "name": "213-176-79-34", "colour": "#4E6AC2", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9474", "colour": "#884542", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459736, "uuid": "4de06647-73f5-47c6-8730-5f4e00be94ce", "value": "T1EAE6337C9B1E0D123B8A5C9863C9A6E04B4F1F92DCE99E2149C4DFC4A27427137EB749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459736, "uuid": "b63db075-311a-4a1e-bee1-fa367cd9547c", "value": "393216:b+mdSmJXFgnYLnzpiqzBFQKELhP2TQjMkL/RlaGx9u:bwiXFg69iqzpTQjPZlFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459736, "uuid": "fa5f1898-781a-4be8-b49a-e693ff32d65e", "value": 14814019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459736, "uuid": "e0ccb975-1768-4d7b-af4f-2860ccd1136f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459736, "uuid": "0aabf723-bc69-4e3c-aab8-ff74119f4361", "value": "download autodesk fusion 360 full crack.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4114b45c-cd73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764455534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455534, "uuid": "f46cd417-b589-4b41-979d-88160cc52fb9", "comment": "Malware payload (Mirai)", "value": "aaeba803f0f9a6a308482b873e8b6604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455534, "uuid": "17335446-f6be-417e-8c9c-9475a6c448c7", "comment": "Malware payload (Mirai)", "value": "fbe95433e9731f5cc3f50cbe3cb0aa4decd6ec77a08d2dd77dd3824348e76436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455534, "uuid": "cd3500d1-a4ff-41c5-9d63-feefc17ea892", "comment": "Malware payload (Mirai)", "value": "bbcbe5261c4e6a22a3965113da95a8889e9139cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764455534, "uuid": "4d9ead0d-bb6b-4ca9-9d14-2d0f93655c23", "comment": "Malware payload (Mirai)", "value": "33dbeb29322eb2ac245f03ca0b54f90880667f62cd4632640bbac42666c668bc992ffca35143368d2c377d1b66f7e4ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455534, "uuid": "91c64496-0b27-42d3-8968-8ff5081de4eb", "value": "T104E3E709BB610EF7D85BCD3B06F9170228CD595622F97B3AB530D418B64B25F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455534, "uuid": "0140cde0-dcf7-4bed-9acb-0b925798ae65", "value": "3072:JjpvwdERKjZyMk9GBeREUZraCX4Dq9re:JjFwdERKjZyMRBUEUZeCX4Oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764455534, "uuid": "174d718d-2bb3-41fd-aaed-37320cc3bc7e", "value": 148796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764455534, "uuid": "facd19d1-8c43-4b99-9c22-8701b6734815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764455534, "uuid": "bc9bf21c-0628-4b36-9a69-7f7a8788c1fb", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf82b29-cce0-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764392311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392311, "uuid": "fa66b957-7ca2-4fc8-8d06-496e5c7b7bc1", "comment": "Malware payload (LummaStealer)", "value": "f2749c7f526e5974b59042740b6c4aa8", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392311, "uuid": "5bba176e-afc3-48ba-b2a7-ddf78c4ad115", "comment": "Malware payload (LummaStealer)", "value": "fbec007daf4e233ad1e3d79cd16d0db1ead0d3e47b5b617e68424f324dbd3c35", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392311, "uuid": "78c3b001-ed74-4c90-ae82-2a235a51297d", "comment": "Malware payload (LummaStealer)", "value": "727f65532b780e3f9056b3c08070dc19ca1cbd7c", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764392311, "uuid": "e3b46b34-053b-4600-b46c-7c35b45ba5d4", "comment": "Malware payload (LummaStealer)", "value": "713b2c0a6ce5449e38654fae42f95b55913dfce4925569f6a44ee8ce6f5b507e30df223286384058740b00ff7e567954", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392311, "uuid": "7ccfb9fe-0634-45ed-8100-970a5fc90d09", "value": "T13EF0AB18DE2AA2D6173229D9E449470BCDE3F86360679825B600DC455F388ED26681F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392311, "uuid": "2a88d5fc-6968-4f71-b537-4bc19d32ea56", "value": "6:j+RwQ9vDzFsJgg2gAC3NqhLx0HGFGH/tCOBaiS0LSyjFaYZiXMvvel3t/UC1l3ED:K3vDzEcCYhLGHMw/opjy4wiPFUc0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764392311, "uuid": "bab1e921-b773-4ac8-8335-f3bc95b8ce73", "value": 442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764392311, "uuid": "91b0f2e8-7958-4721-9cfd-a36db0c64fd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764392311, "uuid": "f17ac17a-d434-4816-b5bf-95c288623f91", "value": "ex.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c563f606-ccfc-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764404646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764404646, "uuid": "cff40efd-b723-477c-b117-6515de2bc299", "comment": "Malware payload (Stealc)", "value": "5df29c92375f066697de912a8daeb5fb", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764404646, "uuid": "c77ab675-1313-4e5a-b420-d36f60388e49", "comment": "Malware payload (Stealc)", "value": "fc053f70a137d4501bf1cb9981d6a754e55054707a5d605dca3d462f2b009d01", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764404646, "uuid": "ab5d5fd0-fdbd-471a-9590-196fec0ad149", "comment": "Malware payload (Stealc)", "value": "c09f5ac739d189779dd8eb121696618c1586779e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764404646, "uuid": "7a103032-0cbb-4671-9c3a-21515e2ac16c", "comment": "Malware payload (Stealc)", "value": "abcaa49472028682fa43035ae3089afce186da2e636ab238f6ec2255f848c869e68983ccdeee7895e8c212df5fb070f6", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764404646, "uuid": "1b14770e-effd-4b43-bcd1-fc17ad242672", "value": "T1C395238B23E048E3C1B5AFF9D5F641A795327E600B7646AF50C9D1AC1E03AD5A93072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764404646, "uuid": "47eb4ed8-eba3-45b7-88eb-05c8e13dfd4a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764404646, "uuid": "8084cdb7-802b-4012-8aab-c5a9706597c5", "value": "49152:jikq5V8qzvnJexu1hJHAuXKLfd4pZqXaN1MRef6rM:juZTnJeUziMWd4pMqDMwS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764404646, "uuid": "efd45a65-1b7d-4eb7-bdf4-e0b334fab21a", "value": 1947648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764404646, "uuid": "aabc6fce-6919-4717-a4ea-4893776816f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764404646, "uuid": "0640d937-fa4d-438e-a4a1-b13db100d962", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99204829-cd78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764457829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457829, "uuid": "232be53a-cce1-4658-bc6c-593fe4017eef", "comment": "Malware payload (Mirai)", "value": "627d25af40d90e69c279a402736da6cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457829, "uuid": "76446e74-c5e6-4a2f-b623-98ca524771ff", "comment": "Malware payload (Mirai)", "value": "fc7e52d38743d7b07a6af6a8ec921e2e2646cb87c32a4c1a3db209fc79f80243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457829, "uuid": "ce810963-4f80-472b-b417-a3ff2d7a57ef", "comment": "Malware payload (Mirai)", "value": "e66ef785c3f552a0f2b0a770d91dec14c6d18e5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764457829, "uuid": "079635df-25d2-495f-8dbc-d4b48e0e76d1", "comment": "Malware payload (Mirai)", "value": "1509f9bd79e9d45dda6a8a3684bf56e30bfc6acdf0f77070c433e2775f691d6051384f2448fe1a50a59afddab962057a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457829, "uuid": "2e1ea854-fb0e-4bd5-ab01-2622a4aff0d5", "value": "T110C31986F9824A22D5D7127EF92E118E331317B8F3DE72129E245F2133C652B0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457829, "uuid": "58be3bb1-e5de-4441-9263-9cf5ae0c3ae1", "value": "3072:HDqrFoeatGA5YfGd4nTzaF6kkcofw2NGtK:HDqJoztGA5AM4nXaR0fwRtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764457829, "uuid": "49f1bacb-f458-41bb-bd35-04a1ec2d1258", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764457829, "uuid": "958a92ae-9c85-4312-8e52-5906e77148cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764457829, "uuid": "fa07abdf-b098-4e01-851b-3aac2a4d1d30", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ada9fcc-ccda-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764389864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389864, "uuid": "e7b74d9f-19c7-414e-b1fa-c193dc8f2b93", "comment": "Malware payload (AsyncRAT)", "value": "baf74b3afa70b044211fffbccc5a80af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389864, "uuid": "42d42acd-2c28-4fd4-92ff-b2910ac077e7", "comment": "Malware payload (AsyncRAT)", "value": "fc95e50c1ca3372bb4b9dbded1bbf67b72626948f358d8c24bba7835011b14fe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389864, "uuid": "ba9671da-0e91-44ea-8b64-129f9ffdfc82", "comment": "Malware payload (AsyncRAT)", "value": "1be155bade4755328dfa57f5e4a849d2c1587852", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389864, "uuid": "4dc8e02e-3db9-4ebf-a301-13c013e4e5b1", "comment": "Malware payload (AsyncRAT)", "value": "993d9692d8f76b079c151e8c8cb3c63a1eae29542b8b48d960f9a47e5b95d134f8c2f241881894ece7778fdf08c60517", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389864, "uuid": "eefd9ea8-7908-4dc7-af78-e9e0ba741b5c", "value": "T1E4947C16F79408FDD897C57489924546DA3A7C8E1B71EEEF1798422A2F237F08E39720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389864, "uuid": "c01cd589-ec93-4b3e-8dbd-54c1dea77914", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389864, "uuid": "0e9ffef2-30e4-4ce2-aa76-870f3c939b58", "value": "6144:G+GYnA0zeWiDi5eJHQ8kV3f+RysMFZzN/EOtbMrtYNsNrwj:qYkDi5eJQ7uysMFZzN/dmB11S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389864, "uuid": "94e1e0f4-02db-43a6-940d-51249b1bbfa3", "value": 416140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389864, "uuid": "f5c95b64-45ba-49b3-ba7b-7e3182488fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389864, "uuid": "51efaa98-5623-47b2-b2a7-ab0c5c685eba", "value": "n16cijba0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd89d560-cd32-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764427852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764427852, "uuid": "cda306a7-c669-4b78-a3a1-e28ebc61ac39", "comment": "Malware payload (Vidar)", "value": "12f82bfe5631508826194b31668f27d8", "object_relation": "md5", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764427852, "uuid": "cf343107-26b4-4990-9584-8673b499393a", "comment": "Malware payload (Vidar)", "value": "fcceed038b40bd8e915d07dc064ee0a9cf484f751fde547b231eeddaccc7a561", "object_relation": "sha256", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764427852, "uuid": "c0bb4508-6f33-473a-ad73-44db0fed50f8", "comment": "Malware payload (Vidar)", "value": "cc85d15760341ac19bd700d6b642c68aa495989b", "object_relation": "sha1", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764427852, "uuid": "c96a182d-9c49-40af-a85a-d7ac28a9f465", "comment": "Malware payload (Vidar)", "value": "7bafb20f88e38464712bc2c34270944f1227a99290df6cd9ce73898a30bce6c5889d7346a2a43aabb0ac987484596a7d", "object_relation": "sha3-384", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764427852, "uuid": "d9ce38a1-bd80-43ec-a953-0e4ef6b73ec1", "value": "T1E8C5331D57DC42B6E23B6BB8A1710582CB3672E21BFAA39F0845D1EC4ED36C129B1747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764427852, "uuid": "12677b9a-b9ef-4123-b76f-69a7d60844a9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764427852, "uuid": "8028f84e-c0c0-476e-83e7-95741c0df5d8", "value": "49152:ODE8bTqPdQ+yxHqMWuZzmwmDO8hIl//hqLUPlGL7i066vpy/OYLllvR:OD6GHAwqLUIiIM/1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764427852, "uuid": "cda07484-2889-4d79-9cdd-b632093ed532", "value": 2695096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764427852, "uuid": "e0f6a875-65cb-49d8-a1ad-314d82f3add7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764427852, "uuid": "5f3a53d7-c32e-4717-8d15-3d2ce724e21a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0deffa-cd1e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764419077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419077, "uuid": "763edc75-2e2b-4dbf-9ca7-87eed92795dd", "comment": "Malware payload (Mirai)", "value": "264bb2ba5c7677a676350cc1799d84b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419077, "uuid": "8ea0293e-8ec3-4784-a786-824b8ff45792", "comment": "Malware payload (Mirai)", "value": "fd55b292b883cf65fdcb23f2dea48518dcc0a21da54b840dd9f77e6fe29f2986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419077, "uuid": "1227d731-5178-4992-9ab0-101ee6a951e6", "comment": "Malware payload (Mirai)", "value": "56dfd3a387c53c68e6c776d791fbcde17d46bedb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764419077, "uuid": "24596510-1258-4d44-ae87-6fe3d172574d", "comment": "Malware payload (Mirai)", "value": "43fa99d6fb413b174924252134dec74a5657c6f2e9903353a0aedd71b58e78ef04075eb6a0b0f9ddcf715dc6f842f480", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419077, "uuid": "378dcce6-c2b1-48f4-bf8a-4ad0c36e9463", "value": "T12C136BA3CD3A2F18D2588675F5255B7D5B23E914C64B0EAA8076C279D103EDCF4893F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419077, "uuid": "e3c1b3af-9ae2-4436-ba97-73125df84c37", "value": "768:LrBhkJExiSAnp4PkZTpIvc5J2fO1K3GBs7/amqo0ZdczC5tDFTfcEsE0I:xhviSAfZB50iK3GBs7imN0QzC5MPE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764419077, "uuid": "c7281f4c-3623-4568-a9b1-8164f2a193ed", "value": 44204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764419077, "uuid": "47fd9f4b-bccd-461c-b764-493e9d78fd53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764419077, "uuid": "ff238291-24be-420c-ad3b-639416f92b7c", "value": "niggah.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cc3859-cd7c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764459516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459516, "uuid": "a9984289-dab6-4128-abb9-e23b5040ce7f", "comment": "Malware payload", "value": "5f9189e0a71aa93f49cdd9ceb33a8509", "object_relation": "md5", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459516, "uuid": "c021b9de-8c2e-4a8c-ba62-81426eaf37ef", "comment": "Malware payload", "value": "fd693437257c90420fdb4655ca24afbf90edec474e727643dda46c77b25f711b", "object_relation": "sha256", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459516, "uuid": "bda2f77e-07ca-4397-8d69-f74ac04ad4a0", "comment": "Malware payload", "value": "1e3422b15f6f174d7253bfe7c0b1d9407fc48ed9", "object_relation": "sha1", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764459516, "uuid": "153a04f0-21dc-4dfa-9d6f-5e23b2b392a6", "comment": "Malware payload", "value": "6cc139e4243722f68d0df72ee490684c4027bf079b5a5641ed453ba70915dbe42f5eee3063c8f47ee9058092022593a3", "object_relation": "sha3-384", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459516, "uuid": "f9717363-8977-40f9-8877-aa351ed8bee4", "value": "T1C895CF2CB2782045A4576EF396E10D63ED34B942F71028E9C56DD02C73A2E937A3B767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459516, "uuid": "4867d3b0-998d-4cba-b4e7-75832579c345", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459516, "uuid": "8d376f2b-fbe0-4a1e-b22e-4acf18435582", "value": "24576:iuPgEZ5cJ0Tyuw9QdtzuCf4k6PgDdZ59HFIyPu:KMcyTyREzRDdr9HFI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764459516, "uuid": "da254fd3-fd4b-4fe2-b1b1-c14d84745ae9", "value": 2025472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764459516, "uuid": "74ba5700-c468-4890-94d5-b83682df5ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764459516, "uuid": "27742411-23e3-40d6-a803-6b7e7f414f96", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad674f02-ccd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764389144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389144, "uuid": "afa63bd5-277f-46c7-a7b6-11ecab264b69", "comment": "Malware payload (Mirai)", "value": "f6e75e6b5e58fd3381a0e41296038e8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389144, "uuid": "191e7c2b-4e65-4554-9725-c7b7c6a35bae", "comment": "Malware payload (Mirai)", "value": "fd7d5e22247f11b8500449cab94762731059e68e8aba1bafb84f8325d9e601d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389144, "uuid": "26ce1e27-5fb8-488f-9582-272493c3a8ec", "comment": "Malware payload (Mirai)", "value": "6d3f62387e7cf6ae33c933d67a59addaf1ceffea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764389144, "uuid": "45ea9233-64a0-4ee6-a12e-72bf0eee02c7", "comment": "Malware payload (Mirai)", "value": "2fd1bb6060e022afc62e2d421d1577240de0cb3acf3f88956fe300a9ce793eca89c8cbdd5bee3264ae0808d7bab67506", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389144, "uuid": "d7fe65ca-d563-4d71-aaea-26518fd8e4be", "value": "T14503F1EFCDB24F51ED60A37B93C2BB0B01256102959A013AFDE9F03B4861F461A1D7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389144, "uuid": "c6bda07f-3f90-4dfe-8d4c-05dbfc2c9e0e", "value": "768:9pS+nJVhHnxQDloTZGpryTVON7U8lkOajcfaJN85MnbcuyD7UHQRjFb:9pdnJnOhoTZsG8NAUNo4Mnouy8Hypb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764389144, "uuid": "56b28b2e-95ad-4154-9e6c-097e61e43054", "value": 37820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764389144, "uuid": "8797a59b-5632-4163-9d34-b1674e5b3b27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764389144, "uuid": "de8e0090-d220-4384-9d5d-44297bbcba21", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e4918b-cd0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764412061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412061, "uuid": "19986c8f-ad2d-4ff2-846a-9eadd03701fc", "comment": "Malware payload (Mirai)", "value": "aa04ad00b984d34b4f54abbc44703e4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412061, "uuid": "17371269-3f33-48b7-9bd9-7cbb0ac30247", "comment": "Malware payload (Mirai)", "value": "ffd18fe19ad8d5d4eccbddcd513f914667b0d24a8cb33ba337621a0f5bf3158a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412061, "uuid": "4d92af91-b413-4012-bb5a-aef757757d61", "comment": "Malware payload (Mirai)", "value": "fd5543e6e1be17a5f665e3dfe6d7a8c1a5dc2858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764412061, "uuid": "9a325aa8-0bda-4552-8a70-f35fa5f77224", "comment": "Malware payload (Mirai)", "value": "8d1463a5a94a77454c806ac6318f4cdf307f3c2e67340ade97c753dae35264a3fc68c90c6a69eb21f84a9f7c11808474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412061, "uuid": "63cb08f6-ad62-4a19-b774-b605027fc9aa", "value": "T16C43F135E35A2060E8F16835D98406509F034B7DECFE9EE771F5AA1838D3017ABEA096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412061, "uuid": "88db93f5-2fc1-4c6e-ac9a-d3240134bca0", "value": "1536:cpT1j7s/SB5YatUNUxYIFVpcxJCghQ1v0+yg/cNL8:cpT1j76s5bExk5v0++L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764412061, "uuid": "46d80663-8006-4797-9902-75d6d4ce2eee", "value": 60368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764412061, "uuid": "e8a14690-a4f4-475e-8568-8d8f73bcac8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764412061, "uuid": "0fb1bcfd-fecb-4d6e-9d80-f3b8eede43c7", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }