{ "Event": { "published": true, "date": "2026-04-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-04", "timestamp": 1775347381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c626f543-adfc-4197-a13b-67ea80cd3031", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f5e264-2fdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775276125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276125, "uuid": "c9a4c336-5a54-4b44-a04f-a830ed1f1a21", "comment": "Malware payload (Mirai)", "value": "9f2beaadfb1b4b1287a912824c898420", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276125, "uuid": "2e2077d0-557b-450c-bb2f-b990a545baaa", "comment": "Malware payload (Mirai)", "value": "02ce55091a657c68a8f4509cd3869e2d386f9a12e7e26210b64fe870766c0f7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276125, "uuid": "3753d052-99d2-4fd6-9178-5e6f143aa85b", "comment": "Malware payload (Mirai)", "value": "e6e629ccbaaa87ae321d625ae0fade1eb3ecd6b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276125, "uuid": "f66f0e4b-a5bd-40e8-9b7d-3c15c7a4152d", "comment": "Malware payload (Mirai)", "value": "e4f676be6e74446a5b49feb2ea95870f0c73ddadb79f372a20aa196edd8c74de0cf2fbf8883f91fb930f41d7587109e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276125, "uuid": "bb332466-4174-44a1-9517-3e443af6b016", "value": "T11B633A02B31C0E57C1A319B4253F1BE187FEEAD022F4BA49291F8B569A75E371485ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276125, "uuid": "c3e65a63-4751-4f74-945b-8a8680aae2d1", "value": "1536:oJpwlXR4kzvr1phh0tW9SWZa7KLqbM9LNpP:oJYO+vRph+ts/bLqo9ppP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775276125, "uuid": "a81a1dda-926c-49e5-b887-6e04f3430be9", "value": 68808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775276125, "uuid": "21a9a7b8-1e9f-41f6-877e-646825f491f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276125, "uuid": "e8c555b7-29c9-4d58-ac4d-b4a5317ce6c3", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cdf351-301c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775303522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303522, "uuid": "1c78371b-4113-4947-be8f-bb32b8a0898a", "comment": "Malware payload (Vidar)", "value": "06e907179ea6fd33a97a0f27a8d33055", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303522, "uuid": "eaa781a3-d302-43b4-90d5-99029dbb8725", "comment": "Malware payload (Vidar)", "value": "02d2ea8fbfdabfd59799bfb586a22c2281657d71bd77c22bdbc6a269535ce15c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303522, "uuid": "4a65a597-8783-4007-96ab-d1907704b96c", "comment": "Malware payload (Vidar)", "value": "785077fb790c804ab921465ee5a250a6cc8de017", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303522, "uuid": "ff23993c-aae9-4e2a-895d-4fbd0d932aea", "comment": "Malware payload (Vidar)", "value": "4c98b055b1b862505db1a02bc695f84ae98569732aa3c3fae03c195cad45acfe3d4b50d064a62142d559d6ad486d90d9", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303522, "uuid": "00dc118d-6801-4cef-9bc1-0c9377e441d3", "value": "T1AD858C4B7CD048BAD0AA633288B656927B72F8190B3333D72E50A7383F76BD05975764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303522, "uuid": "e778c08d-d0b5-49fe-b3ea-6fc854178f51", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303522, "uuid": "a68e4247-b98b-40df-8f9d-bac0e855b88c", "value": "24576:6w6cBqrlpWzRtT1ckpejTMSAc4C098ktamG6WcHM3Goo:6Faqrlp21ckpETsVCM8uaS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775303522, "uuid": "3da05ab8-cbc7-4fd6-8fb3-ccecc19c2821", "value": 1869968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775303522, "uuid": "edda0596-179a-422e-b459-8b8044b6923f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303522, "uuid": "39ed348c-33c8-4554-8b04-e34751e4f2db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62227283-301a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302529, "uuid": "30c5cf7c-1172-48aa-86fb-7572e805e312", "comment": "Malware payload", "value": "f6ae302f83bb5e457a1ef3b9cf31b064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302529, "uuid": "90f0ad36-aede-4cdb-8a8a-29bf5b211190", "comment": "Malware payload", "value": "02e0cac4591499d8a4193e47fb9eb8b913d26bf406ceaedf39bdea3fde7c76d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302529, "uuid": "5322d398-faf5-4606-94ad-ca57764be69d", "comment": "Malware payload", "value": "1734336cee4188b51593225b77048f00d83122be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302529, "uuid": "ca5b5c19-f82b-4741-ac83-86cb56499ae5", "comment": "Malware payload", "value": "200e23973145fbddba58c3a1b76a7d838e935cb0a201430ca8836ea596b5232f14663a88ed0c9cc8d65990f5e2982799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302529, "uuid": "a4f621a6-ebaa-4943-80b6-2de07d3d4f91", "value": "T14BD623D22BC493A4C48ACF20524E4B69B1E3B7F9C17A6B2837C71C0656F3F4B8549676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302529, "uuid": "e2b3371d-a779-4454-a9b9-d48d4936bfd1", "value": "22957f71492b1b7c12870d59c6fc9a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302529, "uuid": "a2da6e40-436e-4acd-baa3-bd1ba1fae003", "value": "196608:IbBYna9+H1n9/3IEgbsmeK/LRtEZMdlJp5V9m0RixowXWl2C/h/wmPt9Ih63Wk:IeyunJ3I8k4clJp5zfvww2C55tqh6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302529, "uuid": "74398ff5-f408-49bb-b376-127dde17689a", "value": 13262848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302529, "uuid": "b361b57d-78a8-4577-9e46-4582e4884e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302529, "uuid": "2f845d93-953b-4088-a147-e6aa9865a486", "value": "Nebula.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2e145c-301a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302711, "uuid": "362f6c81-de7a-4def-82a5-6daae1e47819", "comment": "Malware payload", "value": "99d233bd87622d82b8ef48c695f77433", "object_relation": "md5", "Tag": [ { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obsidium", "colour": "#414187", "exportable": true, "hide_tag": false }, { "name": "Ulise", "colour": "#4A7ABA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302711, "uuid": "5cf39065-2351-4e83-8b0b-be951ca13e45", "comment": "Malware payload", "value": "038459495c10b1dc46e3ae4ec050a412f0b7b1f4ff89c19ec991571238e9b5a5", "object_relation": "sha256", "Tag": [ { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obsidium", "colour": "#414187", "exportable": true, "hide_tag": false }, { "name": "Ulise", "colour": "#4A7ABA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302711, "uuid": "14dcc34f-5ec4-424d-804a-f5e500167e3d", "comment": "Malware payload", "value": "3b05f6ae0ec524e934a6718bfac97d1555f2240f", "object_relation": "sha1", "Tag": [ { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obsidium", "colour": "#414187", "exportable": true, "hide_tag": false }, { "name": "Ulise", "colour": "#4A7ABA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302711, "uuid": "ed750d8f-3983-4609-8fe8-6cd5a1126b5a", "comment": "Malware payload", "value": "b66b15b9b38b011825ffa8a8bea262667bd67fdeee047f2e46d8a73a37ba4bf487c9a1cd2c15bd2108d6d499e7169501", "object_relation": "sha3-384", "Tag": [ { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obsidium", "colour": "#414187", "exportable": true, "hide_tag": false }, { "name": "Ulise", "colour": "#4A7ABA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302711, "uuid": "90ceab33-da03-4655-8d77-aeba71871614", "value": "T1FDA42309448D9DE9EB8F7A39139F923B0614AB3C07481BECA5716162EBFFED491DD060", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302711, "uuid": "fb1c6cb2-7041-488a-a3dd-d271a44428a0", "value": "02e0ed46db12978765fa29829859307a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302711, "uuid": "971930e0-7cce-48cb-ae60-294dc7eb37a6", "value": "12288:yd39BCQX3jewcs+IfUYoA9u+PmsdZ3jx:s7CQXze029+PmYZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302711, "uuid": "b28e1033-7dcf-4773-8f58-b220b18e3f84", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302711, "uuid": "e00686b4-b974-4f23-830b-1aa18b97894d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302711, "uuid": "741bcef8-2a4c-434d-ae67-8153f9f492a2", "value": "PearsonTextBookView.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d776e692-303b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775316900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316900, "uuid": "99fc1802-2128-421e-9a8d-63700089574d", "comment": "Malware payload", "value": "6fea5a3e3c2aabb1302f4396894e30a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316900, "uuid": "7600ee41-90eb-4dbc-825f-a01f5c0cc6a2", "comment": "Malware payload", "value": "06785f4f5fdb0bd8f9fba6517c4b736ad984d2033dc3c9421c4587f84f61b89b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316900, "uuid": "d7131bcd-9a7e-4a04-a705-83c3bcd6265c", "comment": "Malware payload", "value": "f74b0df43511c88a886fded5705e671bf026ecfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316900, "uuid": "8ee67552-be9b-4d14-9dde-bc4281ef3c5d", "comment": "Malware payload", "value": "76027287107ea72bddd1626d5fb3f5bfa20d1765c4d7f3296f7add2203cec5466fa9db2ca99acb257800428cdb3f8d26", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316900, "uuid": "f91d4f5f-ac06-46e1-a042-ee123fe8f66d", "value": "T120D1AEA50D9CD6A3D7870D644F68BEB03BCB03C5FDCC5318E294BA4EA14D1868B92B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316900, "uuid": "ccfa3bbf-c9db-4afd-8313-69807ebf4e43", "value": "96:qcMeoH+exgNRoE4K2Es8QfXhKTqQ+l1EbVB/sSaKGXvBw+zF2H3paFZCBOLOB:L8+znxP48Qv/EptgKcnzF2XMFwEiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775316900, "uuid": "ccae77d3-c8a5-4388-8d82-f1482a69e835", "value": 6696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775316900, "uuid": "e0815dae-693f-4e9a-95a3-d32f8398fc52", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316900, "uuid": "5d7c10a2-f867-4417-8cd9-490ebfbdb6d4", "value": "rustchainpoa-1.0.0.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d65230-3067-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1775335739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775335739, "uuid": "32e7ef85-8a5a-4e99-8272-3c34f378ab29", "comment": "Malware payload (EternalRocks)", "value": "098c6cf46cd4eb8a6fd36776bc02b3a5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775335739, "uuid": "9967380e-f887-48da-8510-17c1528edd58", "comment": "Malware payload (EternalRocks)", "value": "0699f0979e59283c54c1c25404ee42e5e31947d3dcf1e82dbec003cae530b924", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775335739, "uuid": "789da882-b8ca-4201-bcdd-8451199e449c", "comment": "Malware payload (EternalRocks)", "value": "82c60bad0d92b5addde1982fde87b66c65f3d616", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775335739, "uuid": "635e2410-e964-44b6-be27-df11aaec6bfa", "comment": "Malware payload (EternalRocks)", "value": "ba27b98195e58562c3439e5cb7d826f1b20308d71dc966d20f147cff87eae89c5d0924b2b837c66654d3450424014431", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775335739, "uuid": "a5caf074-a096-4056-ace6-39e86f69feca", "value": "T120853387F7C71832F839DC39980906816737DECF4450B217692A37676731E42B9AADB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775335739, "uuid": "92aa9d4d-964b-46db-8f87-4e879eb09b6b", "value": "49152:+TjCuW4SDX6A9UAMaQj0gfhNh3P+kvFia:+TjvWJDxIj0GPya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775335739, "uuid": "70f2afee-756e-4a0e-95ad-7f3e9f1926a3", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775335739, "uuid": "58055cd0-2a4d-48ec-b9f1-87f936b4c274", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775335739, "uuid": "8ec5a83d-03d8-437a-9078-4e9d05aa8a4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f08904-2ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287737, "uuid": "a6f9baee-4ba2-40f1-9beb-fe0b0fa06f21", "comment": "Malware payload (Mirai)", "value": "0270710c2b52c06fffdfee5e9282fad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287737, "uuid": "383ce1e7-40a7-47ad-b523-e79fdda21d50", "comment": "Malware payload (Mirai)", "value": "06fd53aa5fb822eafc1c6fde746a003618098cf65efff6352b1567d6007f454b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287737, "uuid": "b2af97e8-4e24-4a24-b3e9-57a7877d105d", "comment": "Malware payload (Mirai)", "value": "278e8b92cb596a7d97a25c1a9f0183e601eb163e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287737, "uuid": "d6d12285-6991-4e32-8f3e-1384f8d1d362", "comment": "Malware payload (Mirai)", "value": "63af678318c04d9e313bb495e274bf2620ec01dbd1b5c934648d30946fb6647ca3e2bdf23941ee40245fd544fe32c845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287737, "uuid": "1212449e-dcd3-4dd5-ac0d-b356199f790c", "value": "T1BAA2E17DFF20C18CF086847E2957127B456FF8A64B98420E6E15D0C701C7ADEE49AEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287737, "uuid": "4fcddf4e-71c1-435e-a915-1048f8446dc6", "value": "384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chiM4HhBJhpExUC03uhHB3QJmRxK+c8:TDZ5Dw7RjFjcU+O24sDS4HhrhpEguX3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287737, "uuid": "fd13da55-f47f-46fc-9f31-e45f37cbda16", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287737, "uuid": "aa7eefd1-1636-466d-bb2a-b19b53ed75cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287737, "uuid": "212b479b-5652-4fe0-b50f-216b069f20e0", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a5bf2d-305d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775331560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331560, "uuid": "1da1b620-e06f-4560-8378-258a072ed6ef", "comment": "Malware payload", "value": "ed029c8a13695830139de2b222827940", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331560, "uuid": "8696caa0-d029-4bc2-8d32-f496efe0e33f", "comment": "Malware payload", "value": "07f2d8f3a9c9430d91620d6a8b83c20dc9d020f00b7066b3ff9bd0fec20b7c2d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331560, "uuid": "cddd95e1-846b-4a13-9cbf-8b6fa9e195de", "comment": "Malware payload", "value": "d6bc109e57ea20cb66361883d7292906c0a0ef14", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331560, "uuid": "9efbd68c-7d30-4467-95b6-9337c0ec3999", "comment": "Malware payload", "value": "f8df7cacc80ce86cb0df76d4b00675118f56852a58f94fe537353ab1b10350eba0e428c05acf1a15aa6731f6f3103d18", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331560, "uuid": "12257230-b6ef-45a0-80f4-c75fea372b5e", "value": "T1E9675B3B4FCDF2DAE8C155315AD8368A9BC5E48D7F99CC56E152E17B234A3A0487A0F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331560, "uuid": "be27bc13-cd74-4bf8-b21c-bd87af69f496", "value": "768:qWEsrg2srgasrgpsrgwsrgMsrgcsrg1srgssrg2srgQsrgXsrg4srgLsrg8srgyQ:qiiqvIM4/w20pklIqE79bC/Il6dNom3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775331560, "uuid": "5eb06f2d-2a82-4e52-8c70-6955cfce714b", "value": 31424554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775331560, "uuid": "0d0c27ff-08ae-4229-8da3-9968b9128947", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331560, "uuid": "e007db1b-f36f-4e9f-8303-78b8c39522b9", "value": "fiyat teklifi.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50f6609-3040-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775319043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319043, "uuid": "62d6a310-b203-4be6-8765-3406d5c5e187", "comment": "Malware payload", "value": "436360a4ffa91718ee9105838af02246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319043, "uuid": "59d2a32c-2754-4b0c-a603-d1b5c46836d7", "comment": "Malware payload", "value": "08307c3ec55d592e95e83bdd6a358aac7ce6b2094d8925225524dfac6fd79e65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319043, "uuid": "9a2af754-f5e4-45cb-8dff-1bb988baf636", "comment": "Malware payload", "value": "c80105ab4a9af74e29da70ae2d243464dfcedb82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319043, "uuid": "e3fec003-441b-4885-b1af-63f6e74313ac", "comment": "Malware payload", "value": "cfffeb431d286c38ebb6c5319d04328f42ab86c1a642c33b7c80a4e6d8eb55b27ea4d50f80d70fbe8adfb9b27cf8c5e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319043, "uuid": "c9c046ec-e887-4c7a-adda-64c88fd6ceed", "value": "T1C826C809FCC42BBAC02C5F7441EB8E5263746D084AF55A2A6264FBD8B8762747F47C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319043, "uuid": "590ffb09-1533-4353-baf2-2b6b13a8007a", "value": "24576:3OYf9hnZNKVhSJXB9XafS/J0JYLZ+oaUJaeLSYUIMVk5gN/dj92bx5j1PACID:N9hxITUqQUrVk5gjjY5j11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775319043, "uuid": "47924138-fff7-4c61-9ec6-ac6f796b66c1", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775319043, "uuid": "739642e9-c1e3-45f4-8fe3-f8561f9b2b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319043, "uuid": "8b998747-2ad2-4dce-86e0-b4d565a5f476", "value": "linux_mipsel_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58db3612-300d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775296930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296930, "uuid": "152cdb00-5da7-45a0-9384-a7d68bb6763f", "comment": "Malware payload", "value": "1de045c89bc242b12f233adb47415983", "object_relation": "md5", "Tag": [ { "name": "CI-credential-harvester", "colour": "#DDA492", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Slack-C2", "colour": "#28B5E1", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296930, "uuid": "65a91a6a-aa7a-4e38-afe4-dfea539f6642", "comment": "Malware payload", "value": "0b8e586c7a91fce4fac8296a069c1c5e673046261958e9ba519e6b6e3b458933", "object_relation": "sha256", "Tag": [ { "name": "CI-credential-harvester", "colour": "#DDA492", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Slack-C2", "colour": "#28B5E1", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296930, "uuid": "7660aa55-774d-42dc-a6d6-448027d213ae", "comment": "Malware payload", "value": "37db1cfd12d80f31bac3c042b31c8e0da8f7cc45", "object_relation": "sha1", "Tag": [ { "name": "CI-credential-harvester", "colour": "#DDA492", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Slack-C2", "colour": "#28B5E1", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296930, "uuid": "b3860a46-5511-4b18-90dc-9b80117bbfea", "comment": "Malware payload", "value": "4c819325ced6bd98f014f887b8cf09883918454f9215117efb114d68d52246ccee8fb851f4d703c29397ca5e01160ff5", "object_relation": "sha3-384", "Tag": [ { "name": "CI-credential-harvester", "colour": "#DDA492", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Slack-C2", "colour": "#28B5E1", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296930, "uuid": "94db5dc7-9b6c-49d8-8c87-ac3c53f80fd5", "value": "T19F12BF342DCAB7F67592A374D808267B9644BE81F5FA72503A04D8A1B5C9F504C4B626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296930, "uuid": "fcd6036f-11c4-4313-be59-2cddbfbbe897", "value": "192:WPZISQHi8SgOE80hAGThZO1FTA+24u/j8Fyi44c5LML:WPCSWSghDhkfTf24u/Qyi05LML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775296930, "uuid": "a5272616-a623-4e1f-8929-9d91b4415573", "value": 9093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775296930, "uuid": "896bb6f2-257f-4d2d-a8ce-6ac5a646d13e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296930, "uuid": "6bbae9c1-05ac-46d4-85b4-1576583f1cce", "value": "npm_sbx_45.0.2.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0fea81-3019-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775301959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301959, "uuid": "ddf16270-88be-484a-bf29-eb6ae0fb9970", "comment": "Malware payload", "value": "17abd6d4b22b9c5b5da560e37a0b06da", "object_relation": "md5", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301959, "uuid": "61326665-b8be-4809-a582-2c201a67faba", "comment": "Malware payload", "value": "0ba966d1a66b83af6e1630d951988a2be00aeb2ea635d3f9b147189c5ff9dc72", "object_relation": "sha256", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301959, "uuid": "6e50f714-e197-49d6-b9ad-eb4e51b9d102", "comment": "Malware payload", "value": "9065a39b4f57227ad2a5b825498974b736d9dcc9", "object_relation": "sha1", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301959, "uuid": "a6f11052-24ac-404e-a8f9-1ae6c3dbd14e", "comment": "Malware payload", "value": "9aa5e61a6c99b7709d5683babd4248ade56809567a58dc1cb25da645b84fdf6fce8136dcf75bd856eca5507f6c6ce24b", "object_relation": "sha3-384", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301959, "uuid": "e5c200da-2287-4f21-a433-c40d341c6b91", "value": "T11D1633503E40E11EE4A40AB0C12CEBF906271FA5CE5AA2533DE87F1B78B53F58B25675", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301959, "uuid": "979abd28-b7d4-43fe-857c-cb5ac597e4ad", "value": "7e8342eceaf58600612ed0c277e644c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301959, "uuid": "7c83ef3b-b35e-4882-a1d8-3a8fa7df42f6", "value": "98304:NfWnvvVSwdsGC6aTOGgjOcPd0nqxo3xtK1osJpBYLiksA5FPL:akwp3dbeK1os7B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775301959, "uuid": "889b3664-4480-457f-b878-b0be65fa328f", "value": 4343296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775301959, "uuid": "0c58c996-6e4a-4bef-acbd-c4a87e3ec2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301959, "uuid": "072a4d6e-46c3-402c-a90b-e68c95fac499", "value": "BLToolsL1nc0In.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbf9eb1-301b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302842, "uuid": "cc7b8c97-f673-43b7-8e8b-68327d26a427", "comment": "Malware payload", "value": "c1713f989e4ba0df73242942afdae561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302842, "uuid": "7177e086-22d7-4a90-80ee-c301752d75e0", "comment": "Malware payload", "value": "0bbbd09b2652af1f238b654a75f5538e0de54f0f7930627a4ccac577baa41522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302842, "uuid": "14323dcd-cc61-4a93-8231-43f0b763834f", "comment": "Malware payload", "value": "e359535ad25bc62dd69460bfaaa92f48290eab6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302842, "uuid": "dd8e9dde-fb50-4c19-95ac-c0110fa140c3", "comment": "Malware payload", "value": "22e193d29a36829b7feb190d88500b32de2f987ad3bc158a464a635392f2f6829c4989fe699d29d1fe233fca416169b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302842, "uuid": "a167a0ed-51ca-4200-a7e1-436acfe4faf2", "value": "T1CD163350F9A98D70FAED77F51064E71A461649E245FFE2128D4BEDBB4C23EF8402C868", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302842, "uuid": "f318d176-576e-4be3-a3d7-e36fe79d184f", "value": "8fdf4497aa43b75ee60a46ded9c4d87d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302842, "uuid": "037f4a85-bdb4-4f15-9c55-363f8641794a", "value": "98304:Q8aXRNvXPLyZ/9ohxAG4y32RW7DmoYI3L:Q8aXrXPLlTAG4y3eS3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302842, "uuid": "49d8a800-eade-479b-b2e6-b9ad560da676", "value": 4213776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302842, "uuid": "f383a651-7c07-489c-a5e9-0ce9f4cc00e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302842, "uuid": "a3cf6ade-cb45-4b8b-b3d3-e5f4c5c49389", "value": "RETRAC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35871db7-303c-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775317057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317057, "uuid": "27b5faac-3ef4-4124-a38f-41e1547466fc", "comment": "Malware payload (Smoke Loader)", "value": "7d1ff574ac7f9f2e45258a8258403891", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317057, "uuid": "1c620a4c-3146-4c65-aaaa-3af8bb9d9f80", "comment": "Malware payload (Smoke Loader)", "value": "0c50d00bd5b3b9291e08039c10c7c83e0fcb653c4d644f94116e36a959997d71", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317057, "uuid": "ccf593c1-9a87-463f-8839-0cc79ea7204d", "comment": "Malware payload (Smoke Loader)", "value": "f572357e8bd33f466ff91ddaa48ec96c005c4aee", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317057, "uuid": "bebe66a3-38ce-4d70-bb25-5dd9e3aa1102", "comment": "Malware payload (Smoke Loader)", "value": "148892c04767bf8c056946774a2604df8b3a45edd2b427c153fd9803b951e940cbc1150c5aa50d15a4598ab91c79852b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317057, "uuid": "778db573-b7f5-45eb-892f-279a4ed7a63e", "value": "T1C1654A4A7CD148BAD46A933288B262927B71F8190B3373D32E50BA783F77BD05975724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317057, "uuid": "7bdf0400-67e1-4ea8-8d66-d5a046da5738", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317057, "uuid": "edb970d1-27f9-4640-8cd7-ca5eadba5310", "value": "24576:w2bs5eeTPp9TKwAOueqkomI55ijkqG6WcRS6Y2y:w24Aef+OueqkoJ55iQOol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775317057, "uuid": "555c3102-9c03-4331-8e19-c31f4bfbee81", "value": 1430672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775317057, "uuid": "0584cd05-0db7-48f6-bf03-8904f94decdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317057, "uuid": "960ec050-5f4a-4e3d-ad72-612641cfef7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adbe226-3024-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775306812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775306812, "uuid": "3fcc2c7a-474a-4361-b189-2bca2799901a", "comment": "Malware payload", "value": "6f31eb40eacfe7d0a647f179e576b503", "object_relation": "md5", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775306812, "uuid": "031ce006-73d0-4674-ba39-ccaf0d27a673", "comment": "Malware payload", "value": "0d399c4818db396b7b05a90f80362b9bb0c7479db26605b1b0308513615eec46", "object_relation": "sha256", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775306812, "uuid": "82e23dda-561d-4bbb-8680-fe62bd1c51f2", "comment": "Malware payload", "value": "062967dc1d38e6f8e4f28d69186a62775fdc8911", "object_relation": "sha1", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775306812, "uuid": "6ebc1709-a5d2-4a9b-97f1-29584252a6ae", "comment": "Malware payload", "value": "64fdb741aff9d4eb85c715a1f2e497682c7643dc512c0e71c5476cf9edb189c863f9646539ed3d970ae964dd8034ba22", "object_relation": "sha3-384", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775306812, "uuid": "6bb7e1c7-9a2b-49de-846d-f2ab33986a4d", "value": "T182F1B416EBE58596F4FF4FB849A313001730F550AA26EF6E1B94602E3D2276056B0FF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775306812, "uuid": "19acd79c-b392-4e22-9649-e6b8eca52739", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775306812, "uuid": "19302d60-eb2c-409d-aaf1-4cc682d98190", "value": "192:FP8mVgFxsBOdQH1hjZVG3Dryj9DIrDh9tuuAgtaR:FUmYQHxVKDrgvgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775306812, "uuid": "8ec04bce-87b9-40ca-a053-555ff0f8fe0e", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775306812, "uuid": "80b98901-a1ea-4a50-8c7b-62ea0ffdb9df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775306812, "uuid": "dfbd1d7c-4cea-4653-b16d-616f76612ea0", "value": "RemoteControlClient.Resources.GhostInjector.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e8b115-3029-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775308894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775308894, "uuid": "8cffb7ce-01b8-4c78-85b6-f9d60e128c2b", "comment": "Malware payload", "value": "1ac3a8a20b26cdd31f21272efd830597", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775308894, "uuid": "27b603a4-062f-4c4a-bf17-ee0c4347504b", "comment": "Malware payload", "value": "0d74b62b5c4ac836cc07493880d5be80e7f61443e4cc13d209ebb8932342c74c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775308894, "uuid": "1ef3c633-5030-4fe5-9c7e-798aa02525b5", "comment": "Malware payload", "value": "d86a5a283f9cb2a841d16c4ea97924f7e443c45c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775308894, "uuid": "2b39bd5e-9fcd-46b1-bcbf-35482fa8e0bd", "comment": "Malware payload", "value": "04e73e5f2ae27d64aeb4be923d871b503bc45bf6abc127ec23c97b7b51472c702bbe7a8719f24b3f57896acdcabe97e1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775308894, "uuid": "b55096ca-fb48-4f13-a6f0-88c185939986", "value": "T1A175F00756DEF7DBC1921BF60CA68256A93220B217A372BB654745FC0E5E6DC8F31232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775308894, "uuid": "ebe3295a-1ef2-4605-a911-160ea5f1c4d8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775308894, "uuid": "35e3b03c-a519-4760-8ad4-3ed074fff87c", "value": "49152:BWB2F3q6mKbXDvlb1a2d4HHyO6c7gm3LTbtFzVa:BWB2nmUDl42yHHyO6c7z3rtdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775308894, "uuid": "5e7f364d-c53d-4e9e-ba41-c35425a424c9", "value": 1612800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775308894, "uuid": "eb3f1b1c-54c6-4003-9539-abc6e80701c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775308894, "uuid": "b6f6f388-2be2-4f0a-a41b-a91ff81c901e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319b6047-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274101, "uuid": "4d2730ef-c78b-4d70-92e5-20d7c0179329", "comment": "Malware payload (Mirai)", "value": "b8a0eacf75cf958e5feaea0878e9f773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274101, "uuid": "131cf727-97eb-4358-9063-5c0e9140c289", "comment": "Malware payload (Mirai)", "value": "0e574d158de0e356e9bc18dd75bf0c82d216e24ff634ebe95e29af681173e969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274101, "uuid": "b7b11770-ee37-4769-b110-84a93bf5988c", "comment": "Malware payload (Mirai)", "value": "ea004015eca8a963428fb5d0a3cd862ecdd97b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274101, "uuid": "d4a7006b-1ee2-4229-adb0-08c068d54a36", "comment": "Malware payload (Mirai)", "value": "22d862c6505f1933b3e77c68a3e1e0c43b7a774212a57b0aa3031477cd85f59240bb4332c39c2bb44a39c5cd91c159c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274101, "uuid": "dfed289d-b5e3-4699-bd5f-3dcbd8610405", "value": "T117633B42B31C0A57D1675DB4263F27E193AFA99120F4FB88351F9B869272E331186FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274101, "uuid": "60c92c82-daf3-4fb0-8c1f-f63de8f40509", "value": "1536:33/7G/wvl2PThqsjR+UR+bXCI/5q1rFpOq5BMbee:/7tsMYYCI/A1qqpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274101, "uuid": "6ca76f3a-1cd3-4f38-be98-1fc05b1e1c19", "value": 69564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274101, "uuid": "04011492-f53b-40ee-9a72-8ee337b4ede1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274101, "uuid": "42300f09-ee94-4882-a173-9f3b07ed0969", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64916f79-3079-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775343336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343336, "uuid": "34d91768-3bc4-42e1-8aca-bc4c598cacbe", "comment": "Malware payload", "value": "c2c9bc7fa790ddf43f13eb543b5fecbc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1327", "colour": "#2CB389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343336, "uuid": "d9f66287-ec2b-4ce7-a55e-c822c625e6b6", "comment": "Malware payload", "value": "0fdb73497e88ad9f6d41e7e0bf7a9946e3046f6bb3e5aac8c8a80b4e1e01bd0b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1327", "colour": "#2CB389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343336, "uuid": "c36b4570-c250-4e08-9037-5a90eb67c0cf", "comment": "Malware payload", "value": "7bb5d2d3bf64fd1f05fc066da2d3fbc0ff432564", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1327", "colour": "#2CB389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343336, "uuid": "62e478f6-7bfd-4d03-8b79-0a97233474e4", "comment": "Malware payload", "value": "ff3f229ae05899e991538f803caef8c6199dad9d6d2a25979b1e197e589edcd435dcb4c7c70c4fb3a880d3603c25118e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1327", "colour": "#2CB389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343336, "uuid": "4148c185-b98f-49a6-b02a-90e3787d09e3", "value": "T154E5334B15BC160D1CCBF72791D07054CF62ECA670EE5EB1E70ED294632BA288BB156D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343336, "uuid": "1cbe110d-5e11-4c71-a0e3-ebe41abc75a7", "value": "98304:lPyV6CtL9TcYYKzBWi0xRu7m0KPi1IRUTbKn:Fs6CN5X5NTvKCTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343336, "uuid": "a88d202f-f091-43e9-98c8-74676fab7d82", "value": 3261827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343336, "uuid": "89d2db0d-2cc1-4d95-a47b-0503b261424d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343336, "uuid": "774c3cec-d555-40bc-9955-c876d5318848", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db42d02-2fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (ZigClipper)", "timestamp": 1775263008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775263008, "uuid": "67d9d3a7-eb7a-425a-a595-067fadaa3523", "comment": "Malware payload (ZigClipper)", "value": "b7e31b72a11298cc1a2da18ad6ee17bc", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775263008, "uuid": "0e3796d1-5b30-44da-8f89-ed4a6d7d9919", "comment": "Malware payload (ZigClipper)", "value": "113a05106b85844a4fcc943e5b06af75bb45c22cec1e6aa30400a13e00dcfc22", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775263008, "uuid": "15921c93-4d1c-42da-bdef-066fbc1ded16", "comment": "Malware payload (ZigClipper)", "value": "6a8dfb68735ef059845a4925a46626876c0863d0", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775263008, "uuid": "e20cd249-f3d8-46ad-8233-f9928201cb16", "comment": "Malware payload (ZigClipper)", "value": "0cc5fea20c12e0b4550488176ce78dd4f18df491dbe26e1c6852c12ffa5212c0cd3ea675619f34651ecbb19b9846bfe0", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775263008, "uuid": "6bf6537a-5f9e-4157-8e0d-322a800893b3", "value": "T17FD4A9DB6B3861D0F815BAFCA9C06D05BF60AE9876804C9F1186F75FDE3E9935E48084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775263008, "uuid": "46cf1bc0-17a6-4ed3-9221-1c00c8c0ceba", "value": "6144:dRdSjrwJ+J20m9NbMxs9jcShHZBvu3BFulPjD/QbL2WDHqsJwO5EifyuY7AUF:Ynm99ISkWJjbQWSKVIxfyIUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775263008, "uuid": "685d2764-0ad6-4d69-a152-56e178c50db0", "value": 628472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775263008, "uuid": "0cfb150c-8467-4585-b277-e4409cd7d338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775263008, "uuid": "d5c9c714-dfdf-4dd1-bf7e-953d8500e1a3", "value": "Feather.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d6f0e9-2fe0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775277626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277626, "uuid": "2d0b6560-d95a-416d-8da7-bb235ec2d7e3", "comment": "Malware payload (Mirai)", "value": "cae3766e329cbda2d77d975e707e8655", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277626, "uuid": "73e1ae3f-2433-491e-b4f6-ad02f7025a89", "comment": "Malware payload (Mirai)", "value": "123d0b0b0e246646a29a3eeeca3cec00e015ac8d69a9d586bef992c2a1051009", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277626, "uuid": "14320006-1c28-4df9-9bb7-24ce04685ab3", "comment": "Malware payload (Mirai)", "value": "76afccdfc3bc913b820ff83ab9bdd7d467820b10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277626, "uuid": "afb1e2f3-9637-4e81-8a89-e833576c00d3", "comment": "Malware payload (Mirai)", "value": "39eeba6986c044ba6815b97ae78ccc9b2ef5b9e7ba48213ff4b090d915f51bd467003612c3bdd412a3f88e1e5c2ba005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277626, "uuid": "562200b1-a2ba-49ed-9727-3f8350d7a2b5", "value": "T1ABE46D9DFE4E3C42E2D7E2789E4987E1B21771E0D32391A33982434DD5C6AD9CBB1921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277626, "uuid": "b2c5f77c-b055-400f-96a1-1761bcc46abe", "value": "12288:0YUmBOgLvQ3a5M6bJSobEhHL1YO8/8tM8p+XdpBABgiCGw5dOMMCwC:0TmBPQ3apSGEhHL1y/kPd1jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775277626, "uuid": "ad6c6de3-f012-4e4d-a29d-4cb3bb81a7b1", "value": 700800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775277626, "uuid": "539e7c7c-4eb3-47c1-a832-7f662274a0c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277626, "uuid": "04eae825-9303-4742-8221-8ffc3441e948", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f664ba-2ff8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287956, "uuid": "0e41590e-aa3e-43be-90f2-b0cd12dc64c7", "comment": "Malware payload (Mirai)", "value": "aee75d82b883ceff757c9342df635328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287956, "uuid": "8a496250-2e20-4a82-a254-a40b6d93a7d1", "comment": "Malware payload (Mirai)", "value": "12f96d5034d19f76f8e7d8ad46aecdbc40a0c188e7a3a05725559b2f93326e14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287956, "uuid": "e2ce080f-c0dd-450a-bc68-cdcadb5044b3", "comment": "Malware payload (Mirai)", "value": "45ca2d213ef95d253ec1a2fd8a9cd52746a4436f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287956, "uuid": "6db21d69-78be-4586-8a72-7e20342a3f42", "comment": "Malware payload (Mirai)", "value": "25c5cb4a7022d4916623879ebb7e50a53e4bc53d4db2770755d314a7444643e0150d1a8fca242436a46d5a4dcbfad259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287956, "uuid": "6b1ccc13-a763-42c6-a990-b09420dcd59c", "value": "T147C2E0E07726FA31C4206C7DE53B4D8A3A51167C91FF343664258C398FC2A9A67F84B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287956, "uuid": "0ea1a92a-b68e-4eb3-a7c9-1885b404d72b", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrO9q3UELu1:PKy4qfqoeJdXWgzLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287956, "uuid": "e0a14f22-7e30-4e68-82ec-73f687457b51", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287956, "uuid": "2efac364-0945-4344-bd1f-0d22e407aa20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287956, "uuid": "7e5d3430-2d2e-4658-955f-511b716cb20b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b95bf9e-300d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775296935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296935, "uuid": "1729b196-c9a5-415c-9922-7f698b4d7071", "comment": "Malware payload", "value": "79a8d6932af32b26e0f9615d2f078112", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "moltbook", "colour": "#4E87A6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false }, { "name": "websocket", "colour": "#313857", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296935, "uuid": "6bf95980-4027-4ebd-8ece-eafe10fffff8", "comment": "Malware payload", "value": "136cb25f654eec760153852007981109d6e447c5cb762a6d08f10187f8fd55eb", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "moltbook", "colour": "#4E87A6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false }, { "name": "websocket", "colour": "#313857", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296935, "uuid": "3f351799-09cb-442d-9b2a-83fb2cf1c03b", "comment": "Malware payload", "value": "070ffbe76a7e609ff0d7bf9eb2a382f2a37779a2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "moltbook", "colour": "#4E87A6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false }, { "name": "websocket", "colour": "#313857", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296935, "uuid": "247b9967-1810-414b-8880-2d785c3c6677", "comment": "Malware payload", "value": "a48152c45d5a35f249bdffb1980823a7060fc80604e6ab926f902085699b7eb405b7905010f7982496a9c76df3fa86d4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "moltbook", "colour": "#4E87A6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false }, { "name": "websocket", "colour": "#313857", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296935, "uuid": "10ccc9f2-e64d-4fbf-9762-f712b88a05f2", "value": "T183F2F12067EAF0FDED4FA95E606EE7781458E24692B5D0DB0F9600CF7C05A701A1CE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296935, "uuid": "6bdefd3d-3dee-4b44-87f8-a62a2a02faf3", "value": "768:ZilWfx0f1tQm9otunnK/dEwNt00aXN7KFlENNIAnMe/LG9aQDqPrfTXCghFaTV:ZRx0ffQtcnnKS0WQFeIed/LG9HDqDDlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775296935, "uuid": "dd0b9d4a-ceed-4e53-be7e-75cecc545c76", "value": 34777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775296935, "uuid": "1dddd911-0833-4cd4-914a-4187bdeb7004", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296935, "uuid": "91048e7a-f33c-4a5a-96ac-712a3b9d9bfe", "value": "moltbook-health-1.0.3.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841ad7f3-2fbc-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775262214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262214, "uuid": "afb160a9-8d06-4548-8f6e-6d170b7331d3", "comment": "Malware payload (LummaStealer)", "value": "0575625c014de4aaaaabe9dc0100b570", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262214, "uuid": "a07b6743-e587-47d1-9c4b-0a9b6bca8e15", "comment": "Malware payload (LummaStealer)", "value": "13864890ab8482916d1c23ad7296da3ef994315d65b32bfe59f88a48911d9410", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262214, "uuid": "d58b5e39-fada-43e9-b1fe-4542a95d487c", "comment": "Malware payload (LummaStealer)", "value": "0d80d3e0769201fa69b1281e319653862b0fcad1", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262214, "uuid": "a6889c0a-1ce7-4aec-92c9-1bc3acf1f1b0", "comment": "Malware payload (LummaStealer)", "value": "9bdda9f6b13d799530d949ce7ef2ceffb3880125295cb9e07ab2fe4f16d0b990d0f520f8749b1209f245a259af8bcc87", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262214, "uuid": "8865ba07-b81e-4cb1-80b9-8556f7d724b7", "value": "T126655B50EDD744B6E41217324AF726EF6335A9091F32AB8BEA007679FEB72D11832351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262214, "uuid": "4afcfbcf-c3f9-4fe4-9413-02cbc7532517", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262214, "uuid": "7de44730-375f-4edb-8338-07ada3c6814b", "value": "24576:HtFrlKrU2HVz2b+RQvL4cW9Gvt7higoUUyBLFxGmITUCnf61PN1jSUeSr1xPxBYN:HrwHHVzOyWKgDCCRxPnYQooLEuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775262214, "uuid": "0656d62f-b3bb-4dd0-83c6-49cb8fcae3af", "value": 1454224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775262214, "uuid": "6aad2779-7641-4c21-bca7-2220787e7245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262214, "uuid": "cce0992d-56b2-4d25-b3e9-bc37665c3c13", "value": "mixnew22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef2934f-2fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1775266983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775266983, "uuid": "6a5f0630-3b72-4d37-b965-1514fded3e96", "comment": "Malware payload (EternalRocks)", "value": "3279c856604760e4ce3138b47e0f6b4e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775266983, "uuid": "1ff685c7-ce5f-4247-8176-b1668db3d65e", "comment": "Malware payload (EternalRocks)", "value": "143fe44e5705ad84697ce72d3bac8c3f3a990eb4089d6219bcc7f418de6e2c4c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775266983, "uuid": "4944444a-07d8-48a8-90bb-845ed941e477", "comment": "Malware payload (EternalRocks)", "value": "fc02565c28858ba9a9f84f6ecf6e2a75ef629ccf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775266983, "uuid": "a1b9d982-f65b-4778-b7f1-a03aac9f3bef", "comment": "Malware payload (EternalRocks)", "value": "b31a7d0ec899b78a3d45fb6ed7948c8f4064d80af57e2239d0d936463da09b9ac57675395360226cc9316ec0cda8f971", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775266983, "uuid": "2a3d7f65-6d49-4eda-b05c-020b94621916", "value": "T10D654B00FDC745F6E41227325AF766AB7736A9090F32AB87EA047739FA731D11826316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775266983, "uuid": "1ceca4f5-d4bf-47f8-8412-b12dbb660365", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775266983, "uuid": "ce9527bb-cea7-41b9-b016-1b529196d375", "value": "24576:A7UK456dlQQvLdUy2Yarf49x9Hri/Jp0VvWuRh8TO+WrK4am1Nb/t8ZIHCyc:AhL6lTW7fam3p8ZEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775266983, "uuid": "d7ce4bf4-b474-4b24-995f-80f9ea5fa5e4", "value": 1504912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775266983, "uuid": "bedbc12d-da3d-4be3-b78e-96cf78d15548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775266983, "uuid": "5ae9caf6-d60d-4d76-9865-36ceabed055b", "value": "ij5dRHHgS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee598e22-306f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775339272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339272, "uuid": "664a28d1-a69e-4ffa-8659-9fc6259aaed9", "comment": "Malware payload (Mirai)", "value": "501c9b19e1ece528a8dffb8901d983fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339272, "uuid": "87d9f1ec-9e30-4b02-ba78-25fb2257c893", "comment": "Malware payload (Mirai)", "value": "14df0a8f6e7b6f53be0abec8f4b094498476b548d0530748194b8cfb4471eff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339272, "uuid": "7a87c0ce-30c2-45a5-b66e-9d86d8d3fc1b", "comment": "Malware payload (Mirai)", "value": "45b36193ef587d0eaacdd456d7c8f15968ed53ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339272, "uuid": "e6a1b959-434e-4386-8f32-8268b8f030d9", "comment": "Malware payload (Mirai)", "value": "0feddd7fa55e390cb1b265f8019ef1de81f2704516320445ee60f4ba09c0857bc8b7149b30a4eeaeb28a4d2f80d438ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339272, "uuid": "a2a77b8b-40ef-49c7-869e-ab6f4aa7d5cb", "value": "T1D2832982FC819E11D5D8137AFA1E118E33136369F2DEB253DE106F206B8A92F0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339272, "uuid": "1d439af7-cec7-498a-86bb-381bf29be47f", "value": "1536:/Mnn0ghx3Czlc9dff7fSbMpK+AHRcTnv1pobM2ilyc/hQceZA6W9Fxrd:Nux34AfG3VWTnvyc/hQcZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775339272, "uuid": "a76979fe-6f7c-4d5c-b104-cc4dfba3ca2d", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775339272, "uuid": "c648c979-2b5c-4d26-83d6-9ffa75c0769d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339272, "uuid": "38b338ef-b2cf-4f58-9cd0-fae70e2c9870", "value": "mao.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9cca87-2fe2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775278332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278332, "uuid": "272b9b5e-7abb-464f-8eb6-685a5e9e1a30", "comment": "Malware payload (Mirai)", "value": "e6c65f737190a40c27308601db53dc7a", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278332, "uuid": "07dfb7c6-2f53-4922-81c1-16614d96b309", "comment": "Malware payload (Mirai)", "value": "15588e148ce17c6225ffdccad499ddb5adcf931f189355f600e54d861f6992ae", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278332, "uuid": "e6363fd4-547a-4db4-9864-9cdbeec42c88", "comment": "Malware payload (Mirai)", "value": "c8f7ee4c62fe866c9a824646ecf7589f47dd8600", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278332, "uuid": "29f27794-fe9b-4a12-b394-f3c695e0ef4d", "comment": "Malware payload (Mirai)", "value": "1fe885d8072a30248393bf0f5a36dde2928a053314c327a902c72844701e334452765ee7e54d2d2b962b9d3ffb95092c", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278332, "uuid": "f615dce8-9f59-43c1-b551-87b3d00fe57f", "value": "T1F3144A47EEC90EDFC45BCDF086BF836B19A3659B48D2E2F5543C8C0C355D28A56A3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278332, "uuid": "f04c2b14-5bb0-49a3-b2b5-7eadd9bb1e2f", "value": "3072:+L26vVqEAy2jOOJaisBjmAe9kkdoqipAucf8bZzMjwfQx0FKafesv0wxVAq:EtqE+OxisBvkcpGf8bZAeG0htv0wx6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775278332, "uuid": "d991f1d1-2764-4d53-92d9-91716c92ce0a", "value": 204724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775278332, "uuid": "669dcbcf-8213-4c0f-ae52-3a66d68e9849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278332, "uuid": "40e088bf-408f-4a32-92f4-4ca6ebc36ced", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db858398-2fdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775276534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276534, "uuid": "71a8027e-fa5b-4531-b5f6-d21434a64f03", "comment": "Malware payload (Mirai)", "value": "830531f0bd4ba5e14f565d00dceb7d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276534, "uuid": "cdd0819c-a0d6-4fc8-a6cc-71c43c6f7493", "comment": "Malware payload (Mirai)", "value": "160df6128d2423fb414a9b9baf3d4aebf3fcad295caaff8a26e10fd7f9d8cd9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276534, "uuid": "2a9a3e41-1ce5-4b23-bd58-41312601cb55", "comment": "Malware payload (Mirai)", "value": "7ef0f91d8812096be8459e9855da93d185f8b817", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276534, "uuid": "467f3a67-827d-4d06-964b-a25fb820656a", "comment": "Malware payload (Mirai)", "value": "78e38d47af9346569f1856cc9b7880f34e79a2420bfc01b31fa980b4860860154c0581330d699a4170fe7b709e969917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276534, "uuid": "df724d67-9cf7-4996-afd7-3b367e52b9f9", "value": "T16AD2E090BAAE40BFD20E4A7513CF3C6A48169B9A937BF78701AD77915C530D15C4ACEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276534, "uuid": "048b8fae-fdbf-4f4b-8e94-6d0223c63e7d", "value": "768:zEZLVm8X8cQZBe1IFI7xtIWexDpnj9bw1j3BRRgCFIKW:z8VPOBeIFIVtdk1j9slGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775276534, "uuid": "c98a0f24-7345-455d-87a7-9a3d5d976d11", "value": 30048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775276534, "uuid": "fa66ef00-83d9-4d00-a2d0-3d67cab6255b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276534, "uuid": "4fbcf9eb-c6b8-4455-b1ce-b5d337b0e6e5", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92b5d3b-3046-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775321627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321627, "uuid": "7a2dbd1c-7a06-4f84-b410-7757c69761a9", "comment": "Malware payload", "value": "b46c2e6247162e619569b27840c3b402", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321627, "uuid": "63d3ef79-5f79-4d66-a27d-ba2724d69662", "comment": "Malware payload", "value": "16bc6563f45cbd5cf48e6ea4ec4ce1a10ee5b272f8a27c6b3c61670966b526c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321627, "uuid": "9b8412f5-c07b-46ff-ae0d-85a6f094181a", "comment": "Malware payload", "value": "0dca04c16ca25c5d6ddc37f719bf05ec63fdb3af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321627, "uuid": "efdab154-9d9a-4f10-ad87-5dfddc062db2", "comment": "Malware payload", "value": "aef30194e2b8ad58ec61f1207c829ffceb3b97e57328d525c8aabea450fb8ca4bafe717fe20865cbd10d410e211fa75d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321627, "uuid": "4b4be6c6-3bfa-4a56-926f-bd03d0e2e701", "value": "T1EC162B02B6042EA9C8654D3785A74F6137727ED42F319743E744F6BE69B23060F26F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321627, "uuid": "30686aef-33ce-411a-b85c-a49f52a60835", "value": "49152:QHI6ohLFjJCK72d1fSWJ90mz5EjEVEJxpkj1V:QHI6ohLFjJCK72dtpER8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775321627, "uuid": "3054d3ea-5870-4aa8-84fa-361719634fe7", "value": 4325376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775321627, "uuid": "60c1675c-341b-4f22-ab64-8f19b720e3e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321627, "uuid": "226f448f-e812-4ad8-bbd2-b0d5d86d3b40", "value": "linux_ppc64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2c2237-3054-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1775327672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775327672, "uuid": "45076cab-bed3-4e33-9b68-97714a6abaf7", "comment": "Malware payload (EternalRocks)", "value": "de601286853543c4ef8e1b804675f910", "object_relation": "md5", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775327672, "uuid": "505a50c2-97da-4160-ba58-6772a9ab15e2", "comment": "Malware payload (EternalRocks)", "value": "18ea4970eac7cc6539d211acd268c01903c5c999b2fb3381a364fd17fdb3efa9", "object_relation": "sha256", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775327672, "uuid": "7fff2873-f5f1-45b3-9a5a-3092b4f844d7", "comment": "Malware payload (EternalRocks)", "value": "05c17ebf9bdfce1fbed1196dd72885dfaad1d77f", "object_relation": "sha1", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775327672, "uuid": "b0a57c17-ee89-48a6-ba90-728107d97477", "comment": "Malware payload (EternalRocks)", "value": "6411abc56d515d755821f3383be4704a90fad82fc80e04d26b5b20fabd909403f1678e168a4d665a6f255eb204126481", "object_relation": "sha3-384", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775327672, "uuid": "e0f5a358-a3da-4ee6-b861-e2a9b0ed9aba", "value": "T18F653336A0D64610C98581F38F3BF7414EF26CF6AAA193987610F35F1E3B2995374AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775327672, "uuid": "bb4197fa-1360-40a4-886f-e8d77414afbf", "value": "24576:hzV5UZexZcdcRtun7ojsPcrlHaD+yVf66wIp8AgdvY7P4LNvfX60xQJpmc+:vKZexCdcRtu6sPBSyVf66wwLF74fqHmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775327672, "uuid": "e79f01dd-3c81-4bf6-964a-732d7f145925", "value": 1519616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775327672, "uuid": "91cd14bd-2983-4f4a-bb0b-a8ae98aa9e39", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775327672, "uuid": "85ac9a14-6c16-4879-9c88-0276bdac6f6f", "value": "Bootstrapper-Roblox.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad9a49b-3072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775340179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340179, "uuid": "bd819194-e42d-4d8f-ae26-6b6b9f19a235", "comment": "Malware payload (Mirai)", "value": "5ba5050e8be71038c1b30ebf3aeff727", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340179, "uuid": "02914e8c-2406-48a0-bede-cd4aaf0273e2", "comment": "Malware payload (Mirai)", "value": "19c62e4d749a41b4eb0ac670c5fd9bedfd471ee5541064e52e2a1e9bc20e4a5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340179, "uuid": "4f8c3d28-2037-4a41-b89e-346bf5ad8b51", "comment": "Malware payload (Mirai)", "value": "7d1a110eddb7ec99c8b5dafdc21ee3ead0486696", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340179, "uuid": "db7a8c43-f724-4657-a048-1bedaa451eef", "comment": "Malware payload (Mirai)", "value": "a67a14875bafe5c568dd0febb14a93bbf792220d29f3b6e36c4cd5caf8a3953a63a49dbc776a4ab0006a7c3dc2d88bb1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340179, "uuid": "73161f56-b8cc-4572-90dd-ec4d0b83e10c", "value": "T1BF611EBC41E0AED3C881B90CBB34D361634792FCEDB6B13C9D598A2684807157CA7ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340179, "uuid": "50ed5f7e-e0ea-488b-9324-7b5556997011", "value": "96:Vbp5rAkgYzhNnDRnd5xZDz/zVvljx93xjvlbSQ:x7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775340179, "uuid": "5309b61f-7c61-4525-be47-0a47a7740354", "value": 3211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775340179, "uuid": "7cfa0d48-f6f9-44e9-b190-e1421b6ed40f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340179, "uuid": "92eb32a0-ebb1-492d-8540-53138cecd27a", "value": "mao_http.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317d4849-303d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775317480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317480, "uuid": "1fa6e00a-1879-4764-a1eb-9f5f5c320053", "comment": "Malware payload", "value": "aa0dbd401e1f17e9f6439e8a3edb437a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317480, "uuid": "f79484d4-9c3d-4189-b5c9-a1edb90ce305", "comment": "Malware payload", "value": "19d1a129a41d8a60a9ea06a47efd1b4f7ac92d8a666c7c8775c0da0dd2cbe5cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317480, "uuid": "928fde9b-a3e3-41fc-8587-dbb25ebb9d39", "comment": "Malware payload", "value": "af2b9c7ac30e6013d960ec6b2577dbb174e015d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317480, "uuid": "5b6f9e79-2c81-4ce0-b1bd-9ada9f9cad43", "comment": "Malware payload", "value": "517c2ccbd2b85eb72a12349b6db2f64908694821908427d5176603a4a13bcd32ea6f4387a4f095d70d83909c758a243e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317480, "uuid": "09ae1956-bd39-4fed-b724-47a66382bc35", "value": "T1DB161A9BB8914682C4E4367ABCBE41C432A30EBD9B9B13576D05FE3C3ABE1990D35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317480, "uuid": "b9e3e50a-28b0-4457-8911-9ae1f421b218", "value": "49152:2epM6Vd/JpKyC/NJc+Az+/iA/wCOZj11:2epMIH/CLatAY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775317480, "uuid": "219614a0-15fa-4ae1-892f-3d6c02c70ff5", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775317480, "uuid": "2e13b470-8985-4520-8222-532b61f3737e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317480, "uuid": "648651e8-2dff-45a9-bb41-0eec22b23c08", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e86aba-304d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775324551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775324551, "uuid": "31eca628-e1ae-4acc-9259-4df7c6d66684", "comment": "Malware payload", "value": "ebdbbe21bcc86bdf533b479f4aed49a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775324551, "uuid": "08c8013b-03b8-411f-968b-fff0568dc89c", "comment": "Malware payload", "value": "1bf3dd9d65a5424e50366f3f3a95d870e2ff93252e30a8e5964e785a68676d03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775324551, "uuid": "1e0ee5cf-65b6-4443-aba3-b006312b7108", "comment": "Malware payload", "value": "87ac1a7f695c1165c5cf4cd39c8e7bf0809adecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775324551, "uuid": "dc0eae57-24b6-4c58-8b46-34cadfb7e6ae", "comment": "Malware payload", "value": "4042e8479faf45e7003e85a74dc3817b2f8546fc9c3c1f566a686c90c3a016c7d3d4abffd865104dacea391fa4a298c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775324551, "uuid": "28d74714-3316-4409-b108-2382507fb95a", "value": "T142283386BFD2AC36F4DEE932B20436E8315BFD7297E0D606162D606C69701E15AF407E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775324551, "uuid": "05bbe31d-e9a6-431e-a87c-0a5cfe91f10e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775324551, "uuid": "f3304eb0-8805-4a55-aaa2-fc6de50eee58", "value": "3145728:hdTm4vkAkm/pAatqPYJo+sUiflWy3lQsVoY:vC48AkAuYJoxDlQO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775324551, "uuid": "f7aaef3c-3a27-4f1e-bad4-19f5f0492ba3", "value": 101737585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775324551, "uuid": "169eae44-c7aa-4bac-ac0d-3a02f487380e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775324551, "uuid": "60672f21-34ac-4c71-a355-a6efebe53302", "value": "VrChatmod_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166eba99-2ff4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775286082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286082, "uuid": "1a3980e1-ca5d-43e6-8f6b-166d744bf046", "comment": "Malware payload", "value": "c7867533a0b6157a9867a38dc13b6b20", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286082, "uuid": "7e224278-cb57-4334-b994-2d4b94f8cf31", "comment": "Malware payload", "value": "1ca98717ab0c34e0fb271498977f1c67609eafe07a97f4d9d0a36742ebbf8613", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286082, "uuid": "73f9030e-aa0b-41a5-9b3d-5124bd914de6", "comment": "Malware payload", "value": "4614830f9bb89020596f8db9ac79fb09ab3553d6", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286082, "uuid": "7137fc52-6b65-41a2-8211-ad01f4b34747", "comment": "Malware payload", "value": "2b4c42fd26d2478c154973f5b5581c3fc075c33059eb213ffc6720ba8a7a281954ee2c1cccc7c9ee129905f6a5cc8c08", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286082, "uuid": "30b53309-d01c-44a4-9f58-717acc69412c", "value": "T1C8C7AD1663E112AAD577D138CBAB6603EB73B40713308BDB329C43A52F63AE45D7A750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286082, "uuid": "5e6811f5-bd52-4339-9afe-dcc2d2a584e4", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286082, "uuid": "4578d324-d1a6-403a-9589-fb89104933a7", "value": "393216:gI3gBe8bpHCebvYygICa5pbkIM4Lfc5uKEkhxQjWdHkK+UUVXpyNeG8MF8KN/67X:gdBeI7LfOCDsno80dguj3/oyngPV1Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775286082, "uuid": "fb7ae129-a320-4b68-a7f8-4e5eccb46571", "value": 57404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775286082, "uuid": "811cc595-7b42-4b0e-8ebe-f3fdcdca3d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286082, "uuid": "8c6631dc-3602-4678-9535-6be36f72740c", "value": "ChilloutModSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb28bd9a-3039-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1775316101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316101, "uuid": "cb2d26a4-684b-443e-85f2-5ff1dfe02944", "comment": "Malware payload (DeerStealer)", "value": "4c4c8788a9a8c5801942cbb06d6bdb63", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316101, "uuid": "b4f0e4f3-45fb-40ae-84ea-be67088c6926", "comment": "Malware payload (DeerStealer)", "value": "1f73971eec969fa57692f037335896163ba0fcd78011bcbdb530e4212513ff75", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316101, "uuid": "914ce866-d0ac-4963-8a56-10b380e6dc7e", "comment": "Malware payload (DeerStealer)", "value": "b99b4bb818353bce6e4967cff80191293044e2e5", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316101, "uuid": "4b5d0729-fc8e-45b6-837e-6166f8d7590a", "comment": "Malware payload (DeerStealer)", "value": "2c700a3902a53c4d88243cb8a51fe83cd19da50b309386822f6be9ac1dcd005ad06b49b563c30ba91a706433a16dd6e2", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316101, "uuid": "1c1ac373-b810-4c30-b4f6-c5795a259787", "value": "T18EB6339233E4A2B4EBB84C728E04D7625A34DBC87B011F07F1919F179D67746C42BAE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316101, "uuid": "a0eb8a26-dd27-4fb1-b030-f8141cb63d0b", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316101, "uuid": "a23e2870-fb8f-420d-9450-b3f9a3615cc2", "value": "196608:+p9L9ND9J5Q1gkSBYODXAMF/vH7I6xFCCcwpB47hu:+p9LP93QxSaO5/f06xbBChu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775316101, "uuid": "1945bd58-88d7-46c0-a7bb-9d59a6a7435e", "value": 10529821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775316101, "uuid": "8a5de496-06ff-4f5a-9196-9775d32a7d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316101, "uuid": "750469ac-3155-4dcd-8785-fa24348ba463", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d97740-2fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775260876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260876, "uuid": "73358a60-a55e-4b46-a53b-ea8a8cc407e9", "comment": "Malware payload (LummaStealer)", "value": "f0f1d22d3b28400c00a85c926f3c5f89", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-6138", "colour": "#9F2A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260876, "uuid": "67a253b7-d231-4c1d-9691-08ba5c210b2c", "comment": "Malware payload (LummaStealer)", "value": "1fb388ce0358bf8b0b57f7f4510f168797d1198222e69eb6887d76c8be68dbe0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-6138", "colour": "#9F2A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260876, "uuid": "b49740b3-9623-493d-8500-886238b7c071", "comment": "Malware payload (LummaStealer)", "value": "3fba949251743354882f115e388247723ac0702d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-6138", "colour": "#9F2A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775260876, "uuid": "86b563ab-26df-4e7f-a3ae-27bba710e16c", "comment": "Malware payload (LummaStealer)", "value": "8776d9dd3986e82d5bbbe06660ac9007e28b5de260eabf7672dbc4907b85dbe17798c736736193a179aeeb6e8aa0a258", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false }, { "name": "pw-6138", "colour": "#9F2A96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260876, "uuid": "cd2b970b-fc68-44f2-9aa7-da412b1ed922", "value": "T17FE5332C7A95543BC9222890E57A245CD83847379E6F114CF94727EACECBE9C1FA2C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260876, "uuid": "da635847-f3a9-4ba7-9cb2-ddcf30b30336", "value": "98304:/ft9t3fmA3Tub0ZpO+e7jESQ/N7xLbIratwLkATOI:99t3uMTub0O+eEJVtbu4AOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775260876, "uuid": "e7eecf41-360d-4a7b-8423-96805a65c5e8", "value": 3256835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775260876, "uuid": "c39b29c0-d6c6-41b7-919c-50bafe2061c0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775260876, "uuid": "39f8a907-0f81-4484-9153-8938623fff5c", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027ce62a-3065-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775334581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775334581, "uuid": "a5e40c71-03aa-462f-93c1-fdba1a2d15a2", "comment": "Malware payload", "value": "d1dfa6940ddd9a0f652f2fe2d25a3e60", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775334581, "uuid": "1f82de70-874e-4093-932f-11bc49173674", "comment": "Malware payload", "value": "20af3012045290cdced79c306e1fb8d5eac82a09a3771a4552f492ad4fa125ad", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775334581, "uuid": "846901e8-e441-42f8-abd5-605b00964c72", "comment": "Malware payload", "value": "d6d2dc4baa0f951507d20fc86e409c9fd50b560b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775334581, "uuid": "7cbb453d-8cda-4dcc-b759-f16892946d76", "comment": "Malware payload", "value": "a4e50be7a74d80bbe1aa7e0d868ef704b046e22418d321903940a6cfd75e53855d456871ab591ee52e50a0efe0ad8ad8", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775334581, "uuid": "9218a971-b583-47ae-aa50-277fb61347d5", "value": "T101068D5B7CE004BAD06A633288B6A1D27B76F8190B3233D72F54A6783FB67D15939710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775334581, "uuid": "277bc523-8538-444c-b8e0-1d6fc15622ea", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775334581, "uuid": "d3399aaa-b351-49b7-a78e-a5989517de1d", "value": "24576:9BTPXw3svdTuzStLreCbUPyaUxVn+PeDgzpjWrLhQ8M1R1GMmGiWPYZqF:9B7Xw3svXiCwIxt+5pjWrLq8QxxWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775334581, "uuid": "14a6911f-e73a-4bef-ae17-71e3580a44ff", "value": 4007064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775334581, "uuid": "a7c17fef-63d5-440b-8977-532879b4cb3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775334581, "uuid": "e8d28ab1-204b-45e3-a2c3-1fd16423774e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67793d87-2ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287506, "uuid": "1b6c55e8-ed70-4bed-b0ad-4031b81adfa5", "comment": "Malware payload (Mirai)", "value": "4c7b9156bbbd9211f8cfa2bec9026e14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287506, "uuid": "5fdbf4ae-13ad-4089-be70-dc2aedfd95d1", "comment": "Malware payload (Mirai)", "value": "2161cccf6dbd6c09fba21db37bcab2a618912f5e1733da4a52bc4266acaf7354", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287506, "uuid": "e883330d-0c5e-4434-bcb2-d22f58a1e144", "comment": "Malware payload (Mirai)", "value": "6643961631941fa4cf8c17a314c02e7d242e4f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287506, "uuid": "5ba8ff78-31cd-41a3-b78e-4853f96847c0", "comment": "Malware payload (Mirai)", "value": "c7eeb0374666bc4ba371eea481d5654b63abd68d83063e823b253089f957acfff2469f68ca2c6dc704642ae0c2ea3ff7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287506, "uuid": "c3f4553f-0112-4975-a120-708b06397269", "value": "T189A2D1BFE8D64957DDAAE53B011D00CA50BB5C5413A783C23FA575B389778E8F83A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287506, "uuid": "0f86ff4d-692d-4f30-8856-0873ceed1488", "value": "384:MccDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr/ZW7MM+v1RpH:NMkKJFH39CBVQey7qsZoMTM7EpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287506, "uuid": "71148f53-a01c-4637-8e1c-c15bc31e3a30", "value": 22448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287506, "uuid": "4994a4be-c468-4eee-85d7-d1e327110a16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287506, "uuid": "4d91dc19-3cb6-45d0-867b-347396b00d46", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f83edd1-3033-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775313289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775313289, "uuid": "b2c05e9f-a40f-4410-a2a7-6ee72dec99a4", "comment": "Malware payload", "value": "963648b9533afa95b569b58ba2fe78f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775313289, "uuid": "a77bb92e-796a-4e5e-a7ef-c1c1833cffbe", "comment": "Malware payload", "value": "219d879522b3cfc498ab3e2597dcce3b96c41e7f4154fa0205922f1f283f71d3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775313289, "uuid": "b631fa47-f45e-4547-b421-14f49cf63332", "comment": "Malware payload", "value": "46abf19320399147f4381e9d61a53a81768054ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775313289, "uuid": "46915865-703a-47bf-807f-670dfc36e94c", "comment": "Malware payload", "value": "1f3f72d5924ce2eb3222aeafb1570dcd4dee0a2264d65503a65e7e7e58075a86ed87d8d7a9213ba5e981cd5d8d1957cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775313289, "uuid": "5b9d07e2-6e79-49ef-9162-cb24cae6fa9c", "value": "T1BB4124FAB8628E30336DC5BD748A654CA7569AAF49172E74F043743C27BC32470742A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775313289, "uuid": "1348c40d-2f5d-400d-b97c-068b0802e024", "value": "48:vkwvpihneZZn1oBydXEBtonmzEvJGU6ljiPq2MTCki:vkwYheZZK8a2mzIj6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775313289, "uuid": "7277bc7c-d2b8-4d58-b4e3-3af8f9df5cea", "value": 2081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775313289, "uuid": "fd4cf9a6-fe34-436d-aa4f-da0e86a2a36d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775313289, "uuid": "a2c15c10-0710-4abe-b593-63d4a77e0e29", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bebaa72-2fee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775283648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775283648, "uuid": "92b93209-0cca-4b39-aad0-d7179d736106", "comment": "Malware payload (Mirai)", "value": "2ff9d31110cea044f2ccdccc38b92b68", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775283648, "uuid": "d7893c63-55f4-42fa-9e28-f06d1f1c3fd7", "comment": "Malware payload (Mirai)", "value": "23c0fff88fda9fb91c9dcc47a37d51696423ee775742e598c62a5585e6f4cff6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775283648, "uuid": "10ba1b15-deba-41fc-bae1-396eca86381f", "comment": "Malware payload (Mirai)", "value": "b0c46efaa2c9c13b04687ded8f6c97f35b24441c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775283648, "uuid": "ed3d5763-3511-420a-9210-bb670edc02cd", "comment": "Malware payload (Mirai)", "value": "553c72c62f42a83d926afe449bd3269bcff8f98e44aba100ef98b5a3365a76f950776f1c0f2d79a99df68f4cb84812a5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775283648, "uuid": "c48f9ab2-4fd0-40d3-871c-ed2d0c118746", "value": "T1B6E09ADDB0B928A8FC00BE4378D18F946141F29B6E9B4F49584C1E61ED86AB4303AB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775283648, "uuid": "8410ccea-c8e8-4e2a-8654-6f8d8fd1f916", "value": "6:PXr9UCuyU4IUZXr9Uh0yU1BFIUAK+Xr9U4LyU4IIU4hPXr9UeGLyUeGIIUeGhkn:JDIyHFIjVnIdedIIeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775283648, "uuid": "68f737aa-0107-4d09-93d9-6b796cb8fe98", "value": 351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775283648, "uuid": "379fd296-e274-4815-a705-314dd8f46509", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775283648, "uuid": "f31bc362-8ec1-403b-b4d7-4cf61e8e4f38", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9960e7f9-307c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775344713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344713, "uuid": "fb14cdf8-cfd8-42d7-ac4c-91f06ac7559c", "comment": "Malware payload (NetSupport)", "value": "aa33051bb663f412b6270410a5e4b1e3", "object_relation": "md5", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344713, "uuid": "b02c871f-3ea9-425b-a51c-2af60cb34481", "comment": "Malware payload (NetSupport)", "value": "24b887989f17b162ca6137ada754de5fa6fdbccc9a92a1804484150625377974", "object_relation": "sha256", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344713, "uuid": "33a5a493-0ae5-482d-9f5f-6b3f5db6dd9d", "comment": "Malware payload (NetSupport)", "value": "7114adef278b52ff772b2018b95440205b7eb7f6", "object_relation": "sha1", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344713, "uuid": "1f04f48c-10d8-4847-a1a5-56654a904e41", "comment": "Malware payload (NetSupport)", "value": "08ff8d403cefd90906b8e5a3400dc6e03a87aea3f276dd87fad810a0ba391dd6d3be3ec7b66c4d3b8407632523c83200", "object_relation": "sha3-384", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344713, "uuid": "83c7ad8b-a777-4948-a359-64cbca151514", "value": "T16436A4D97AC457E06929DBDC824775DD1394B13E6FBB280D02E048BA381EE1766E0CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344713, "uuid": "c1c1e0ef-1d43-4ddf-bee7-b7572eab4a0d", "value": "24576:HvMxUBFAz9A8VcbKGl+C9Jw6SII8oIV4KU5PBlvsHWbNIbWyzoPB3lCF:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775344713, "uuid": "244ed1c6-fc6b-40d5-8545-620cad4e3519", "value": 4940139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775344713, "uuid": "67e0daa9-434f-4456-9b6f-5079d324b88b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344713, "uuid": "59d1c672-c450-442c-8572-d84319351051", "value": "relay-doodle.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27ef877-2ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287739, "uuid": "bb68730e-8526-4a4b-8436-6f2020988be5", "comment": "Malware payload (Mirai)", "value": "dc1c48cc751ccf9bd76e16c7c7896421", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287739, "uuid": "f443133b-c553-4429-8937-2362742dcf9f", "comment": "Malware payload (Mirai)", "value": "2525a22200d9dd29ba5732ab02ddf094271448a31eab85f57770c3fdac16dc3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287739, "uuid": "49f46ee8-ef62-4ee5-9f6a-485eb1905667", "comment": "Malware payload (Mirai)", "value": "2059926c2e2375b98adde2a536c2b2e9368b3fa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287739, "uuid": "df641df6-b602-4a43-adb8-cebf734830cd", "comment": "Malware payload (Mirai)", "value": "81b9e3fe6fa0f67f272010610a290c79bda81a1ab63771b1dfa04eeb3e8c54a7f4d918518ad523d86444743b84dfc247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287739, "uuid": "9d6dff25-2eb3-48c3-980e-b72a82efadf1", "value": "T14A142C5377224F90D325D2720BB38B5A5EEB01851EE248D5936CCB107B20BE9689FFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287739, "uuid": "55749c58-5d3c-4ae6-b125-f8486dbcbaef", "value": "3072:VZ6+Czqc11RHU9gcl3b/xjFbFTPqLwP2MESG1n3gjcwBfppR:qR115U9fl3b/xjFxqo27Sm3MBfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287739, "uuid": "50f03d46-fb23-4bba-8d28-c365f2300ff6", "value": 200624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287739, "uuid": "718efa64-c2c1-4459-80ff-5a4765fd05ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287739, "uuid": "3578d60f-b4ec-4597-8102-ccf23988a233", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7248f576-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330044, "uuid": "c9f9a9dd-c6f7-4279-9587-e626cef7ac4c", "comment": "Malware payload", "value": "dae80bd043b4a7cac8cf2ede5eb27c85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330044, "uuid": "f5cd7f4d-a7ff-438c-a2cc-755e2355c79a", "comment": "Malware payload", "value": "2596e230dd9075d1b5af526067774f97d078fbd1f34ab8be5cd11b556c6b8c3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330044, "uuid": "36196953-b201-4fd5-a9cf-b6bbbb593d39", "comment": "Malware payload", "value": "0533628869e02ffbe007d218207b63823f65498a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330044, "uuid": "2e15fc9e-0063-41dd-93ca-28a86705b6c3", "comment": "Malware payload", "value": "7240740f5bd8bc9cb2aca064295866ec3bcbabd90088f80f96f122d669e6feb56a61e5e01cf2303f6268a6dd1b03782a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330044, "uuid": "de07e7ad-1dd3-4892-a4c2-2a0cc8e85e2c", "value": "T17D340122F480D726C9D4667AF7BA155C7312076CA3FE3201DC648A7437EB9278E37584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330044, "uuid": "ea5f6654-01d7-44d3-b80a-98c8b02345b5", "value": "6144:mGMCt5Q+7ozo5yp58QUIkAMYr0zy8BKOW:PMueSIEycQZ9ozy8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330044, "uuid": "aa09289b-715a-4f99-8f38-56fac31b7d55", "value": 251170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330044, "uuid": "54f25b7f-2350-4df8-8ca5-1b3c35aa2a12", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330044, "uuid": "d631025a-a477-40f3-9dc4-1b91f59891f0", "value": "rt6l46cwdn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5068724f-2ff4-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775286179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286179, "uuid": "d943e7e0-c045-4d95-b6fd-16c2bfeed171", "comment": "Malware payload (LummaStealer)", "value": "b7e328f9ad70a5a56cc2c12c33dd9e2b", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286179, "uuid": "a3e876c3-ba12-4058-8b22-581cffefbec7", "comment": "Malware payload (LummaStealer)", "value": "25df81baf5757c548006f2936631d95adbb3fe2e20831415a526e2a8a2b35ca7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286179, "uuid": "40e042d9-c3a9-4150-a76e-a783a9ab52a3", "comment": "Malware payload (LummaStealer)", "value": "035fca4b01912a6ba171fdeee2995b3ffd73f8ba", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286179, "uuid": "c026f736-58f6-49c7-b162-544fa8066b9d", "comment": "Malware payload (LummaStealer)", "value": "f3a7db4d419915ca70293e7de771667d52b927933fd4bcb0664bfc3813a095e84e9423c04e82b4b242712f1739b29503", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286179, "uuid": "c1f8a456-4476-414a-a057-6f86e175f0a3", "value": "T118654B48FD9384B5E41A1632A9E716FF2325AC094F3296C7EE587F39B9B72D10C22351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286179, "uuid": "627fdcf7-a8aa-4224-bf3a-992314cdef0b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286179, "uuid": "aa6397b5-7983-4064-8a18-bc0cb15306a0", "value": "24576:ZC44yKr/Wn1z2vyUQvL9Df9VKqNBD5g0ahaFismIzRjnDJP2LN1jSDFK1iiXLZJc:ZuDun1zrlce2mDbiXLzy8c9Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775286179, "uuid": "bdbcec09-5d8c-4c94-af77-09f2f5555dc1", "value": 1546240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775286179, "uuid": "bc08af13-8b40-4f11-bef4-8b2a16b64cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286179, "uuid": "9fd98c28-f2bc-4712-8970-3ba8c1591df9", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b967dbe5-2ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775290220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775290220, "uuid": "9ddd05b6-6b37-4e40-a9a1-83d48b596ff5", "comment": "Malware payload (QuasarRAT)", "value": "4a4df7262fa501df208824ed99c633e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775290220, "uuid": "fa75f548-df96-4901-8dbd-20ef721fb241", "comment": "Malware payload (QuasarRAT)", "value": "26f9bb2c2450b7b10a5e56d760c3ab2c372f225d60456e32f4c25ee779be04b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775290220, "uuid": "e5de8fe4-465b-475e-a091-f3e31817f642", "comment": "Malware payload (QuasarRAT)", "value": "572fc7344565988fc6c44b875bbdbaf2cb1cd0d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775290220, "uuid": "a82d0ffa-273e-472b-8907-e7d83f8387ac", "comment": "Malware payload (QuasarRAT)", "value": "7c7217c2aa0de8049a2a5d2182881aa16f8df8b829f12a9c40aa729546edb944211778c2af5e0212d44982e98a97e196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775290220, "uuid": "329e1a31-2240-4843-b154-3c59a57a6daf", "value": "T1DCF55B0837F90F27E5BFE27395B0811A6FF0EC5AA363F74B5141666D1D63B40A801AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775290220, "uuid": "02f1fa2a-6472-4170-9cc0-b617fea34514", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775290220, "uuid": "b4859c1b-48a3-4747-82de-afa908ba8575", "value": "49152:Pvkt62XlaSFNWPjljiFa2RoUYIEm081JvOoGdqdTHHB72eh2NT:Pv462XlaSFNWPjljiFXRoUYIEm09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775290220, "uuid": "afc62d80-1dea-49bb-ac77-6a790eb76faf", "value": 3435008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775290220, "uuid": "853bc62f-d65c-43a1-8892-a16843f165cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775290220, "uuid": "a3ec7fba-8480-4ae1-afdd-4375f7016b09", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f418fb23-2ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287742, "uuid": "dd2d3474-218f-438d-8dc1-4fdb47ac7c4d", "comment": "Malware payload (Mirai)", "value": "164bbd4b0574b28f73ec15266ce0764c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287742, "uuid": "cd428d7c-9d70-43a7-875c-999473d59383", "comment": "Malware payload (Mirai)", "value": "281d1e0e808f2ffccfcc6b6b2cbb49ece43764f7036c40106a975cda2a8102a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287742, "uuid": "c7988360-2cdd-4bdf-9d00-9c9ebc49a5d6", "comment": "Malware payload (Mirai)", "value": "f393d21c8ae0ac647ac53f0a5e35f49b5c528650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287742, "uuid": "6f12e376-50f6-409c-a0d3-c9087c2d8e54", "comment": "Malware payload (Mirai)", "value": "51e48ccaa1746c6f46584b804b8c1228e6017ff4def608d11a453eee2b632297647124a0bc9f809194dd5b7b2a221267", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287742, "uuid": "f0febcee-99ea-4bd4-a165-5c7e031a83a2", "value": "T1D6A2E019BF58828BC832797455D9F5D21257FCA1F29DCC5D2940C25FF0A33A96434E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287742, "uuid": "2657e74b-999c-4b57-8d42-8abb289a3b1c", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTg:798o08kxofBE+ZkXaITbp2F2TWul0c5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287742, "uuid": "a1cdaa05-aa4c-42b9-bea6-89c5b7b66fed", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287742, "uuid": "f69de846-6740-42ce-8c29-291f233a3788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287742, "uuid": "48d2d903-d959-496f-b5d2-05a88b35c647", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf194d8-300f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775297687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775297687, "uuid": "e5276d62-d4d8-4f09-a452-03465bf45d28", "comment": "Malware payload", "value": "edd046ae91f161f6ab3e5f8d1e8d4abb", "object_relation": "md5", "Tag": [ { "name": "aws", "colour": "#61F0CE", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "postinstall", "colour": "#43C15A", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775297687, "uuid": "97a613b8-cd50-49a1-911b-4c3764310702", "comment": "Malware payload", "value": "28a7249517d9a0a44bf654b42a089ec18249b6536f5e069a40c698f8b1c3a0d8", "object_relation": "sha256", "Tag": [ { "name": "aws", "colour": "#61F0CE", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "postinstall", "colour": "#43C15A", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775297687, "uuid": "2fbb15d8-9835-4161-b6a1-164d26e1b42d", "comment": "Malware payload", "value": "84699d2b7096e90b99a04eb0618be60fdaf17686", "object_relation": "sha1", "Tag": [ { "name": "aws", "colour": "#61F0CE", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "postinstall", "colour": "#43C15A", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775297687, "uuid": "09283d88-c737-48bc-a979-8577d7f7b847", "comment": "Malware payload", "value": "8ce39ceb72d3f6ae8314aae8db49dd8228f5a11fab8f2879a9f7b0f8d708b82cf04b52649db5a39ad36e8f663d620aae", "object_relation": "sha3-384", "Tag": [ { "name": "aws", "colour": "#61F0CE", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "postinstall", "colour": "#43C15A", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775297687, "uuid": "b3a38fcc-549d-42e1-a69a-6bb0a9488e04", "value": "T11531E7166E938A3E80C16C3E47D2462007DA6CD98DB0F711E61D9821B29A7D22832B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775297687, "uuid": "632b67dc-830d-4a41-be55-f9330530971e", "value": "48:XI11hp+gu4asTGVYrMIA5wo0sa5eaVhtdwc91K:GhRwsq1yEaEavD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775297687, "uuid": "1934072f-6cdb-4725-aae2-b4efca7d290c", "value": 1582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775297687, "uuid": "a99d64e8-82a4-4295-a839-2247c53dd735", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775297687, "uuid": "59f5c525-a611-48c3-8400-2a49a2d63ba7", "value": "npm_serverless_env_helpers_1.0.1.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbed1d1f-2fd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775273904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273904, "uuid": "7154cd37-1407-4241-9d37-8ee7d57a244f", "comment": "Malware payload (Mirai)", "value": "3f5fd531cb2a8a9a9ab873f21dd37373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273904, "uuid": "fed84070-a2fe-4224-8bf1-a7825bd08144", "comment": "Malware payload (Mirai)", "value": "2c24953ebd08ebc8219cef505814492033138790f4a51815fd7f59a62830853b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273904, "uuid": "146af5c3-ea3b-4657-a57c-ddb3bbfd2bdd", "comment": "Malware payload (Mirai)", "value": "92d10efd7f4a78f702797adab0d495f5eeb0c0e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273904, "uuid": "614721e0-80ad-4ec3-83a4-6b0cc500b701", "comment": "Malware payload (Mirai)", "value": "2c8ed7c6bd556f7f4f0447de2460ca93160cab4e68345b785785f380d59cfd8d6cf7ad7c3f0b26c3d8966f7fdb578928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273904, "uuid": "f6e1293f-01ff-4bf4-a6d6-c7dc14b07f66", "value": "T166F2F882B883462BC2E423BBEA6E529D336573ACD2CF3327D8115B107B9951F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273904, "uuid": "fe649f5c-6e94-4893-b50b-08fac78d6a26", "value": "768:ZaiDoXWp95qgA6iQFJ/aJBD8JU1u21yIuSFMNP:BaW/5NAjBDsAySs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775273904, "uuid": "c3da11ec-f4b9-4ea3-a3e6-ffe8b04da5c5", "value": 36516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775273904, "uuid": "be475720-0988-4ced-b083-e11da84e22fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273904, "uuid": "c26f2bc1-4b5d-489c-81f7-8ec78f683149", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54087d40-305d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775331282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331282, "uuid": "35c78768-f661-4a27-854c-286ea5e9a505", "comment": "Malware payload", "value": "13a979dc9d0f51d17c2cb7052b4d71d1", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331282, "uuid": "23db773e-3c5a-4e51-b009-dd110dc72941", "comment": "Malware payload", "value": "2e559516fb2fd1edb2b3f9d32c44c6f32dbfe1aa21f6c201430b210cb123bc9c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331282, "uuid": "b2473d3b-607c-4ab1-b903-5129111191b1", "comment": "Malware payload", "value": "06918434fe28eb04d898714453df533a4e9e075a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331282, "uuid": "643fbc9f-9d83-4468-ad6e-ffc628aef172", "comment": "Malware payload", "value": "1085552c93978ad5f3a5c06f82196ae2f843a8347f001548d7bbe5daa1a6f7af0fb568f84530a79612be9c6b4aaf9163", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331282, "uuid": "3e6d5f02-b7d7-460e-8636-cc9a42e120fb", "value": "T128637E76CFBC89A6C514DD6073C87862729135ACB5EE831424BBA4753DC87CBB9138CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331282, "uuid": "91869f20-a80f-4071-8a84-39f53bfe2023", "value": "768:GEArvOO997nxwwwWN2IyIyOoN2222222HrrrrrEgR:GEArznyFFXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775331282, "uuid": "858d7451-34a6-4001-bf82-4e6650f74696", "value": 66865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775331282, "uuid": "e5e1df67-95e4-4fbf-af11-a692bdc10f9c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331282, "uuid": "7be9a8a5-270a-44c6-9b49-65c68f6752ed", "value": "\u0412\u0438\u043a\u043e\u043d\u0430\u0432\u0447\u0438\u0438\u0306_\u043b\u0438\u0441\u0442_2_13_1_1956_02.03.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dba7fd-2ff5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775286530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286530, "uuid": "d40a46d2-68c3-4c28-9a4e-f4e6c52de792", "comment": "Malware payload (Mirai)", "value": "d080f0220af385201f4ee78372dac8b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286530, "uuid": "dcb804f4-6d45-4902-bb98-d9a477b00175", "comment": "Malware payload (Mirai)", "value": "2ebae23266ae5ece0b621baecb1222dee09f02b393d6b4993f6f8b3a81234efa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286530, "uuid": "187cf913-df86-42a8-a13d-b35f4a4694bb", "comment": "Malware payload (Mirai)", "value": "b0683e5330e1d3b245658a6955b7c8b680467959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286530, "uuid": "31eeba05-33d6-480e-8530-393a3a3d3939", "comment": "Malware payload (Mirai)", "value": "52604c645ac3cdc53559a0f2fc226a3848e2af3732d6a758933d8a58a2e910af90985de80bddff2b8c0f3d60bc8f20aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286530, "uuid": "2372968f-e778-4732-8dac-7a7f566c53fd", "value": "T1D6C31A46B9919B12D1C321BAFA9E514D33133FB8E3EE3212DD206F6427874DB0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286530, "uuid": "34a1d551-b4c5-48a8-8eb7-701135f1fc0b", "value": "3072:r2YlyvGm24KpGklvBsbHaOX4hTna0brQO59T:fo+mPa5l5sLakinaYv59T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775286530, "uuid": "24dcfee9-b7b0-4948-a34d-70f1949c98f3", "value": 124880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775286530, "uuid": "3b8325e0-5150-490d-a504-ba3f2cc05f66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286530, "uuid": "fa6f72a6-d36b-48f5-bb9b-76c69fb791ed", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94689eb4-3071-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775339980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339980, "uuid": "523cc127-5e1f-4acd-8286-cb72b9774954", "comment": "Malware payload (Mirai)", "value": "364360450722f98ba455282a7acbaa16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339980, "uuid": "3df8dc36-53d2-486f-99e0-d511dec6e03a", "comment": "Malware payload (Mirai)", "value": "2f1aef36cecf1ee47bf3f41eaf48b5c45f2fbf3277e54601c9d537e98cffc881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339980, "uuid": "4c72f907-6a01-4219-ab1f-1f166519befb", "comment": "Malware payload (Mirai)", "value": "f0a84d8f8b7d01c952415a8697b8e019e6b53af1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339980, "uuid": "e55c803f-bd0f-4f5d-8604-735f812d21e5", "comment": "Malware payload (Mirai)", "value": "17b9b30caa0bd2ca6782f546a16a0808b9ff5a2885efa069fbc1436d0a5be84e9e7378043728299b9cf7e6440169519b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339980, "uuid": "2e1438bf-dc14-4513-9f3c-4ea43a63e9b2", "value": "T144830263547E27C6ADF13EB1CA1293812DA5578CBCF3B66E3E1C5BC528E504A1BD640C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339980, "uuid": "1d3d50ce-5b1d-4529-a927-2d0008edb394", "value": "1536:xvxY2BUO99TTqtuAPsceJy0m4ofF6WsbP5IuL6p2ivUMnZTC5gnFbh:xpY2/e03JytMjbP5C83MnFRRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775339980, "uuid": "292055a5-8be5-40c7-98b0-a2472b6d48ec", "value": 83236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775339980, "uuid": "670c700c-82ef-452a-900f-e3478c48c872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339980, "uuid": "8fc404e6-d949-4168-a52e-af3b89458de2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0af48c-2fdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775276379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276379, "uuid": "d25be42e-eebf-4e48-8c79-fa3665497d6e", "comment": "Malware payload (Mirai)", "value": "b085ebd251a2d83c833b94a60b976a38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276379, "uuid": "a0dbe396-6e0e-4722-9711-3166f5f18a5b", "comment": "Malware payload (Mirai)", "value": "303f9b0b79f0b0dcefbf02c2df90a352ebb28419fd646331fb327c25f8b5fd54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276379, "uuid": "f76ea380-9cff-4f65-a29b-61019e9df337", "comment": "Malware payload (Mirai)", "value": "3e57729c4e2465b361755caa98de6124408c1294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276379, "uuid": "db6f95b3-682d-4c7f-8bdf-2c7c08fd1bd9", "comment": "Malware payload (Mirai)", "value": "67f4af42b6f4f94981cbed339c28e87d918054d4f65097634f511ae358656ec0b1ccc2d69075d30f21727d9280be0879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276379, "uuid": "c45d50a3-ad72-4420-8631-b80e246decf5", "value": "T1BD731A9AF801DD7DF80BD6BA54170A09B930A7D142830B37676BFDA3BC721A94D13E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276379, "uuid": "59d6855b-2fbc-4be4-ba52-31f5cda1ab24", "value": "1536:eChNrVCJwy+k8UcMDxgQp4qSfJnZv3aOU2tcTzzJf:eONrMiy+NMp4nfJZMzzJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775276379, "uuid": "fd44d3af-f983-437d-ab1d-1f463292092d", "value": 74152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775276379, "uuid": "7ff28c02-1bd7-40da-bb12-1eef9f38f27c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276379, "uuid": "400d362f-c946-43fe-a6e1-e04fec7975be", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c526e0-3079-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775343195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343195, "uuid": "91ecc887-e865-4720-aca4-20f02b4a6d3f", "comment": "Malware payload", "value": "4bd9b0d997a72d43f8174cf89420f7de", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343195, "uuid": "c5332be1-0869-4577-8e6c-80317b4c49c8", "comment": "Malware payload", "value": "334b71a5e7f756861bd716781d45235ab28c15fe1142c55facec98ed3d74effc", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343195, "uuid": "e521fa02-3fb0-44d8-9b33-158b979f0d89", "comment": "Malware payload", "value": "aaa12cede2ee368ad982ef494a754a765fb98db4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343195, "uuid": "4d591b7c-1057-44f2-8ce9-edc2cc41c14c", "comment": "Malware payload", "value": "6ed368bf7fc675e4fdb0fcd70b1fb9c2263e2f7ffe0783e98a886982fbeb31d71c62502d4f698165faa68f2e13b7721c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343195, "uuid": "65402379-ca12-4d35-98ae-bc1ab57670ed", "value": "T1F6679E81E68351F2E45748B0416FF66FAA346D0E8220CAB2FFC83B65F973B905769705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343195, "uuid": "4eea59be-9483-44fb-9c2b-3b5d617d17b6", "value": "b2a93297c823b89942d5a78509c4f6e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343195, "uuid": "5a7b49d6-6971-46d7-85e8-5978c110626c", "value": "393216:c/EnW+t39XnZTgY7RIx93w42M8S7iJx00p+oipfk0bodQFM:cMW+t39ZIx93w42Mp7i7Iud8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343195, "uuid": "fa10f853-6a51-4989-8948-05336ca52375", "value": 31984424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343195, "uuid": "76c7573b-8efb-40b2-afe8-1da258f7662c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343195, "uuid": "1490d481-7622-4512-9370-7f242677d6f6", "value": "python36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f3444a-301b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302957, "uuid": "c394d3dd-2c51-4cf1-9216-00d8d36c1981", "comment": "Malware payload", "value": "1896e8365fe13905c9590483d1603f9a", "object_relation": "md5", "Tag": [ { "name": "Dlass", "colour": "#A3EF72", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302957, "uuid": "52727d0f-49a4-41ca-bc63-c351fd270d51", "comment": "Malware payload", "value": "33617c679e8233c6903a472c4a879ce9e9d828f6afd035600c3a974796f85e72", "object_relation": "sha256", "Tag": [ { "name": "Dlass", "colour": "#A3EF72", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302957, "uuid": "4d266f16-888a-435d-a9cc-838c9588425b", "comment": "Malware payload", "value": "7fa77f3d7c65f75d37b3ed431ad142c11cc3efbf", "object_relation": "sha1", "Tag": [ { "name": "Dlass", "colour": "#A3EF72", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302957, "uuid": "cc134975-b1d9-4d4c-91e6-56f784e70058", "comment": "Malware payload", "value": "37249fdb0b1190dd0b160923c6619c2de9521445f098c1a85165edcfb815e60f56609a89ea3675202b7e9081865dfd70", "object_relation": "sha3-384", "Tag": [ { "name": "Dlass", "colour": "#A3EF72", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302957, "uuid": "718f583a-f0e8-495c-a4ba-512ad50d5cc9", "value": "T1A8763378949F52F7D089E6F1CD06B97E2B97CFC18438389A6304F46EE7E1887815B50A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302957, "uuid": "1920bfd5-ce44-45a2-a724-0b00ebb27b88", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302957, "uuid": "b4c0f422-d47a-4958-847f-431935398ab0", "value": "196608:aR7Chr9fC0ceCWf7tomqyZgFdxLcXxhqNVuz+fKJRcO:a5C59a0vztoTeg50xDC+GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302957, "uuid": "8bae6d8e-2fe8-4a9b-be33-a30f9d8cb112", "value": 7214481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302957, "uuid": "8bb29f80-b7c4-46c8-ac90-b6ccbc2c9b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302957, "uuid": "ad867891-1f7d-47d0-a89e-e96d5040da54", "value": "setup_eOm95eFwgS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc46717-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274093, "uuid": "3d46bd3c-a404-49f5-ac44-06744d7bd08e", "comment": "Malware payload (Mirai)", "value": "60be09cc8f433220a8f5acd9046ba2eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274093, "uuid": "62d87c8e-d263-4c4d-9fab-035293afc964", "comment": "Malware payload (Mirai)", "value": "33b1f2396d6714ea216c990b65b044d190e0828ffa61681202a97cc1359d3975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274093, "uuid": "6b5dd06e-12b0-4269-ad66-cafcb12672d6", "comment": "Malware payload (Mirai)", "value": "1b94abb752a209e04cbcaa6d6d9c7955bd478c07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274093, "uuid": "1dcd1ccc-3b37-40a3-af1e-2efb665faa30", "comment": "Malware payload (Mirai)", "value": "d48b8867043aa2317bf5acded8877f8f98154261345dc32ecc015310fdc8125d624ecf5b714d4c9efbe9c7f400ca3fea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274093, "uuid": "83243e37-101c-407e-99e9-5634f682423d", "value": "T1177318D7F800DD7DF80ED77F44530A0AB231ABA146830B366357FA67AD361A50826F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274093, "uuid": "79287088-2271-45b4-9632-a1a11fa2c7ab", "value": "1536:6MjDl/wwmjXnAEOk9Ta8h5yXtZI2Ggikp4XMLMiS+znhhe5cNHpuQQg+:6MjxnuZOkxnyXtZI05uXKMiBKcNHplQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274093, "uuid": "d1e96a1e-63e9-4a4f-a091-2ab7e770c88d", "value": 79488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274093, "uuid": "a88b735b-adaf-4127-96ae-00d009eb770c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274093, "uuid": "9a41c9bd-5534-4c46-a0b6-15f6376681cb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838501d2-303a-11f1-a769-42010a9c0008", "comment": "Malware payload (RodexRMM)", "timestamp": 1775316329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316329, "uuid": "34ed9e05-e8b1-49f4-81ee-33bb844ae9ca", "comment": "Malware payload (RodexRMM)", "value": "1e6acadabf333d7caf8b66e234af3a31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316329, "uuid": "672f667b-c01c-40d2-87f7-7980f1c2eec1", "comment": "Malware payload (RodexRMM)", "value": "34a774a9f08253a41a215b9ec6022e9f3911f2ba15d5c453cf7ef329120c8c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316329, "uuid": "160e731f-4827-4965-a936-3487675fa951", "comment": "Malware payload (RodexRMM)", "value": "432860ca09217e8e48455a7471c107ab81aaf778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316329, "uuid": "65bfb2d4-843c-44fd-b6ec-63d6d909099f", "comment": "Malware payload (RodexRMM)", "value": "d073b567b10b82a6b459b1b18f8e09af212c1ec719aa1551a6af30593d41ab3aa8f05158f48aeeec238c386144321a55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316329, "uuid": "64bd18fb-5850-43a5-a22c-b0913bb5fe54", "value": "T1C1764903EC9815E8C1BD913589779623BB617C494B3223D72B90F6283F76BE0ADB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316329, "uuid": "92b8bd17-53d1-43b6-b811-a5a677521385", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316329, "uuid": "d0b87dea-ba1c-4779-8d42-ca95cbfc3632", "value": "49152:cqcCBuBPfINDUkLB0V3rr4MB62PTRXSS54uX5BonkqzfPcahN1CVrHhDlHbKaK11:cqVA9C9OVaBhoodumvBh8huTWEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775316329, "uuid": "fd68e88c-fee9-4ac8-9514-c4ca59fc7b4c", "value": 7356416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775316329, "uuid": "e4ad9b95-e00e-44a5-8fce-774612f55228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316329, "uuid": "5d265494-30c6-425f-b94f-4c4a13d9fd19", "value": "SecuriteInfo.com.Win64.MalwareX-gen.35637982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6584819-301a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302778, "uuid": "6dc00e86-0cd6-42bb-be10-da8130fe1320", "comment": "Malware payload", "value": "7680c97dcff5c56114257a3923a9342d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302778, "uuid": "0b0fe80a-1d25-474e-8e93-d012228bbcbd", "comment": "Malware payload", "value": "3533717ba3036abf286b92c3782cd71ce93ac4224dad29165b86b9797d40a4cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302778, "uuid": "93fe0f50-a0fb-4121-b850-6617b6871665", "comment": "Malware payload", "value": "f3f05928c7ed7cff83ecd7cfd8db6b8dacec5508", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302778, "uuid": "0d144ee8-a72c-48d7-8e78-69425f027d9f", "comment": "Malware payload", "value": "66941dceb7fa1bdafbdaad74456911caa1fb3fdea74af6adb196dc134bb4f9b75227a9e6330d099936d4972d24a8945c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302778, "uuid": "a74a9a57-cdb0-47b6-8162-b840a7045fc6", "value": "T153E06176A1E1FC307A649F66F014409070CE3D6BC8451950B8EF64756FFDC049180631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302778, "uuid": "22c36bea-0aa6-457d-bcc5-963edc686793", "value": "6:lOnFflsx8BJ6oJXUn23Fdezf3MDf6pfsO3oQgqodLTfsO3oXcadXl4Hx3LcDFXI3:Lx8BJVXeKWfsAgqSTfsHZNy7oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302778, "uuid": "d1e7f20b-1aa7-4426-ba1e-331509ce3c40", "value": 404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302778, "uuid": "de5e11dd-0c10-4d50-b56c-5d8c8b5fbb3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302778, "uuid": "217e47fe-69dc-4970-a8c8-f5de2cf1f4a2", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dc9cb3-2fd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775273350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273350, "uuid": "46da9723-53a3-4fb2-b433-864c1a6841a1", "comment": "Malware payload (Mirai)", "value": "4a9e809c91ad0305b6687025491f4cf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273350, "uuid": "c47015ed-0dec-4d64-8aa7-d55806f39d24", "comment": "Malware payload (Mirai)", "value": "36c606239d9ae977e2a2f3feb5e287568fab0b991421fa1c153cb81402079c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273350, "uuid": "1ecc3e20-b0b0-450f-a180-17578ab3cbff", "comment": "Malware payload (Mirai)", "value": "e75fab703918a25c96ae9f82c1df2f8c13b3f926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273350, "uuid": "bf3826cc-60f6-40a1-b354-2036da14702a", "comment": "Malware payload (Mirai)", "value": "dd26d4889fb1d2bc59878cb3f83da35c60c0ad1e05765cafe89b4cecc27ecdb896c667d951bea4f49ab523a1a423f2da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273350, "uuid": "6040cccc-3701-4a88-b515-9ddecce63989", "value": "T1C0538E32E8295994C5864174B4EC4E751F13F1CC93432EBB1AE683B96893DB8FA05FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273350, "uuid": "29d73ec6-580d-4b77-a0fc-c6c1d670306b", "value": "1536:1aDsHEO5uiu2f8QEwJKPqsOkKmNyClZk3B:1iO5uu8QzwPmmNyN3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775273350, "uuid": "cf99496a-6fca-43b5-be4f-0c2948555741", "value": 62832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775273350, "uuid": "30605ddf-2a39-4433-9854-35fa25a41e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273350, "uuid": "9a030cf7-ddf3-4ead-8a30-d6d237d0ce7b", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d83450-3019-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302208, "uuid": "7bb15867-f7ca-43cf-9339-21ba77fbd041", "comment": "Malware payload", "value": "9a96b68c4c7de8ff01d269e2e8af96f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Unsafe", "colour": "#594DBF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302208, "uuid": "74d1958a-1453-46e0-a44d-4f74fb8d176c", "comment": "Malware payload", "value": "374eabb8dbfaf1c8ad65177994be3bae45396160f48851e3601a66176bf85bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Unsafe", "colour": "#594DBF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302208, "uuid": "ae1d49a7-b234-4866-99da-b485124dd262", "comment": "Malware payload", "value": "828175a7f6809dbb2e843367680a0f7009aafeeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Unsafe", "colour": "#594DBF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302208, "uuid": "e5f41a31-6728-4a5e-803a-555c02e53da3", "comment": "Malware payload", "value": "cbb0d8fe95057e48ca7fe9ed5667a1801a6c4ce0f8fc3366d52dd2976e22b8b7b4a9ce09e57c4ac5e9b44ac66131aa75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Unsafe", "colour": "#594DBF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302208, "uuid": "2d566f33-8296-436e-9338-3988f10b7397", "value": "T157B6338473880CE4F9EE923988D48E57D3B1B17243B885D727F859450AB72CAEF38B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302208, "uuid": "dcd90f6d-5e3a-495e-8ef6-28b6af542aaf", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302208, "uuid": "a7bc20dd-fa41-4878-9b1b-0243c33d47c6", "value": "196608:TAe0W8/L2u8K1W903eV4QtMToEuGxgh858F0ibfU9au5thoANN3gABXbk9itv1:05W8RW+eGQtMTozGxu8C0ibfEau5thoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302208, "uuid": "442c5dcd-3489-4f90-bea2-30c3c9b5d462", "value": 10611318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302208, "uuid": "92a7ce98-b54b-46b3-9ebb-6d160ef6ae4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302208, "uuid": "b8a3fed8-d6fc-4030-97ef-9dba02e2f946", "value": "Kaboom.Lag.Switch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382ae74d-2ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775286997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286997, "uuid": "9f88a644-617b-4da3-b592-3953ffca926d", "comment": "Malware payload (Mirai)", "value": "bbf1cf863ed9186ac9b4a53cc449fc32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286997, "uuid": "bb23bff6-d50b-416e-977a-12d04eb5e7ab", "comment": "Malware payload (Mirai)", "value": "37a38b89112673001398981316ad53d71266d3127b31a3f738c5171aaabcc68c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286997, "uuid": "354497dd-4835-4537-8b17-68a475e90337", "comment": "Malware payload (Mirai)", "value": "2f09e2633d072263b7a2a58d6a16c38b75f7e266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286997, "uuid": "69ad9276-d4f9-4fb9-bc0a-a537392b0b1a", "comment": "Malware payload (Mirai)", "value": "e19d12643947bf0de6c153f09c41700d6f36ba46f7cf1c10130131ac535e905cf75d0c84795836b7c6bce29b047337e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286997, "uuid": "50162d18-b635-4222-9ff9-3736b79d6796", "value": "T112B2CFDC61943084C98D7C7C2B8D4A674F6CA1D0BAED9B16E354CD98B3BEA4B3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286997, "uuid": "d4e72974-111c-4c91-b20a-e5ea1d3d1822", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpIsZqSWvh:4QlS07FUXqIYSXQKquIUqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775286997, "uuid": "69f15d07-1914-4d18-9faf-3a1618569920", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775286997, "uuid": "16f6d813-2d29-44fe-8dcf-834236b085aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286997, "uuid": "65a12dcb-88fd-4dfc-8865-e0d169bde4d9", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0e518c-300d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775296932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296932, "uuid": "21293431-5c7a-4859-b002-01d179f14922", "comment": "Malware payload", "value": "7861b2eef3950508652de33515e3fec6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "moltbook", "colour": "#4E87A6", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296932, "uuid": "18ea5e67-4a5e-4d7f-83ed-aac16f31ace6", "comment": "Malware payload", "value": "3824400982b81f851d4a16001ef1916cc08fd873c8ab4ea1f2832f5e56fe9581", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "moltbook", "colour": "#4E87A6", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296932, "uuid": "9fcf795b-b5f3-4845-ae74-58af9fac6038", "comment": "Malware payload", "value": "fdee8398ebe33e30faf85ebcab84ec6df216705c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "moltbook", "colour": "#4E87A6", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296932, "uuid": "28c0f45f-d5df-4bff-bcb8-ed603f20d9d5", "comment": "Malware payload", "value": "f0e85e49b19c634243f96789ffb2e79ae0e79aa6f1474a5b9865c5f88f8910f4e50b44800330e0bc93f4c4492a6c1f6b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "moltbook", "colour": "#4E87A6", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296932, "uuid": "8470f3b3-c4cd-4a4a-8661-54a2a62ff8c8", "value": "T1DD312B1129C017CAB47578D5FBB39A3ABC72D11440F8D61788035C9B11D16D31B13307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296932, "uuid": "4949bf11-b557-4b73-9b6c-170dc7ddcede", "value": "48:X3SOnSetGAZLzqTjZVfKk5sdReQ1BPKfg:HSkSe3F+TFV4eQTyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775296932, "uuid": "8cff2ecd-8fd5-4f84-adf4-037dcdad1c09", "value": 1855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775296932, "uuid": "23b6f280-4fca-4f01-8016-eeb70399e40e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296932, "uuid": "42ed40b6-10ba-47b4-acfa-054c79cf607d", "value": "moltbook-api-helper-1.0.1.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d516969-2fda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775275034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275034, "uuid": "5178f587-4fb9-4b8b-8cdc-e71f7dcc6300", "comment": "Malware payload (Mirai)", "value": "5bd3a8d46f104ff79f3979350ca28e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275034, "uuid": "1bb06e17-8db1-45ed-8c17-466e4f58521a", "comment": "Malware payload (Mirai)", "value": "3866bda51a31eafcac25e895415b609fb82e49f65222ecae0bd37a22b0509549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275034, "uuid": "b0d0fea8-3560-4a35-a0f8-d3b99c2cd967", "comment": "Malware payload (Mirai)", "value": "faaad0ac329293276bb9884070c188c52dac6e35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275034, "uuid": "db6504f5-53e7-4971-ab8c-306b7ae7a87b", "comment": "Malware payload (Mirai)", "value": "50a03a4b9d91054660c178f17fa932799bcdfeee383bf039804dfc9d31768af5c559d107a6dacedb75e5bd89f2fca2fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275034, "uuid": "17a7a2ce-b342-489e-a5d9-46e4461c4dbd", "value": "T14493E605BF610FB7DC9BCC370AA92B0528CD595B22A53B367A30D828B55B35B16D3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275034, "uuid": "7d64c8c5-3d11-4f05-806b-9056480ac798", "value": "1536:liaJR7OPLs9+O9sa55/avhGHgxboEZkWjYCDJePc:liaJR7OPLsH9s+pHgxboE1UPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775275034, "uuid": "11b2a611-c78d-4ef0-93d5-4d06b42b8587", "value": 93436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775275034, "uuid": "7391f187-9bf8-48fd-ac8d-eebb54742c42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275034, "uuid": "a73f9b9b-bc74-467e-8d37-6a850293d0ec", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da148ee5-3072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775340526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340526, "uuid": "25f26628-82e6-4cda-a4d7-24753955b775", "comment": "Malware payload (Mirai)", "value": "19ca871226c317abe37aefaedabc3979", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340526, "uuid": "2645eb69-0157-4083-b282-68a051662c1b", "comment": "Malware payload (Mirai)", "value": "38c20c35dbb057ce3b8b0f7d05af60d37176158339ca31caae044e0723ac0fe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340526, "uuid": "a9af0556-ac7d-4fe4-9d7a-d200f87b373d", "comment": "Malware payload (Mirai)", "value": "8a038893c4e7829b6aa5fbd2c44e6d83fdc8e5a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340526, "uuid": "1264223c-5369-4a14-a856-50c024caafaa", "comment": "Malware payload (Mirai)", "value": "9b0e884b74bf69aaafcb0f47f40e92588301843e8a6526d221db15454229e26c0b1b7eb2034933703656041561c02871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340526, "uuid": "c19a1747-69eb-4af7-b4b4-64cb52f7b899", "value": "T18E631A89F58B81F5C91B887050E7F33FCB70E56981709A5DEF495F36DA73A02A2122C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340526, "uuid": "4b5d4f4b-841a-4a65-84c3-36ee34b8c5fb", "value": "1536:asIXb8GZ25qH5iLqNuPam7keEqng9At7Z+lYPSCu687B:a3XwGZCqH5iLqIPfTEqfH+lYqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775340526, "uuid": "6a664ae0-5ce4-4e54-82b2-9c54d02a3555", "value": 73108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775340526, "uuid": "25540e2b-1ce3-4371-a375-fe6fca922163", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340526, "uuid": "f6e6b508-2589-4a77-8392-a4bf85c5c5e1", "value": "mao.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f6f3ce-303f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775318457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318457, "uuid": "9a6143aa-9ee7-41fd-afb5-5815cc29a34a", "comment": "Malware payload (ValleyRAT)", "value": "8d7b4560a95d240612ecb8d990cd7c83", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318457, "uuid": "7d3e479b-ae29-4a8b-9b53-24ec7fb105d2", "comment": "Malware payload (ValleyRAT)", "value": "38da37ac0707b4ca7a688715b06182dc8ce3ec9f51c0eb4c6190379555dafbca", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318457, "uuid": "d897a54b-a233-4793-9f15-f523fe9a6133", "comment": "Malware payload (ValleyRAT)", "value": "d2254b97a11b58a9f8e6712716a8dd16c34d2482", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318457, "uuid": "4f3b9b3e-7bd1-4d7d-a07f-66a70bf7547b", "comment": "Malware payload (ValleyRAT)", "value": "97466a911383afb39048f717a0636eaac026e4e0a7a13d86d89d66127e8eb7abe6a48a6d5ff55afa629103bab93dff28", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318457, "uuid": "abdf0b91-d780-419e-9a33-0d9c90eaf50d", "value": "T16E74E403A2EC3CE6D0769274AB7747C6D72EFC5502A1C65F02D042969E3E2937D2A7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318457, "uuid": "b36f3232-cb1e-4a75-9758-48bc9874fc71", "value": "13f3c1e33fd6792e7cb512ddb889dd46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318457, "uuid": "1ccac606-d637-46e3-b28c-dc14954739aa", "value": "3072:ssvoSgP3oY46oV/sUCM7C+Qheh5xau3aHx7JRqi0kuE5oCSSo6rbToQMghqqPppo:s8yohMmLxd3aR7JRok/5olZ6rDwqXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775318457, "uuid": "bcd6d064-353b-4c0e-a577-646b22967c7e", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775318457, "uuid": "0d0b50e6-4492-4345-9e6f-91b08d4afa2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318457, "uuid": "98f4ac21-617b-4334-a4ff-9461466eee40", "value": "\u7535\u8bdd\u4fe1\u606f\u8f70\u70b8\u6d4b\u8bd5\u4e00\u4e2a\u5c0f\u65f6\uff08\u7535\u8111\u7248\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbd27f4-3046-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775321284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321284, "uuid": "43d5f797-b6e3-409b-9c7d-ef25413263a8", "comment": "Malware payload", "value": "773aa88b7cd55192e47a3ad9c2bec27a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321284, "uuid": "fc4d0fc2-b483-442c-b569-fc76c6313111", "comment": "Malware payload", "value": "399ca66a6dbf6b038348d9b64a1bf700dcbcb6c5b86ab07a4548e8313633def4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321284, "uuid": "69793212-b0b5-42ff-b29f-6473ea609b8b", "comment": "Malware payload", "value": "01037c579db159d0804e6516096ef7f60b147bc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321284, "uuid": "21b824ea-8ae5-4e2a-b8f7-3f5f2db99fcf", "comment": "Malware payload", "value": "a1ff0f4c33014adc1ae833f35a272970fff6386d399690ff1c31447527cb4e74ae2ea33215a88d9099a0bbfabce10497", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321284, "uuid": "9b840638-7c58-4fcd-be2a-a91ca59a2353", "value": "T130161A5BB8914682C0E4367ABC7E81C432A31EBD9B9B13676D05FE3C3ABE1990D35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321284, "uuid": "b4b3643a-e7c2-4105-a442-e73554d39653", "value": "24576:eGuDPn90fi4LhiLp/CljtwWpb631Zom5OTa9j12nceACzzhkSNRPNR+F7PnJ0Nza:LHPnr2Z5gdYPTqLyuUnAQ9muEZD11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775321284, "uuid": "7e107c60-3394-4506-8147-5b3bd4bf68f2", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775321284, "uuid": "9f75a5ed-22c8-41fc-8588-0c53a27c3d4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321284, "uuid": "23dcba82-10b2-4ac3-8ee0-3751a888f6a9", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52ea017-3025-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775307474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775307474, "uuid": "70c02a8c-65ff-40ca-ba87-2b9a73cd343e", "comment": "Malware payload", "value": "07226560345444fca583119483c73790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775307474, "uuid": "be67d6e7-b9d1-4ac4-b39a-bb2c8297db4a", "comment": "Malware payload", "value": "3a79d959e2ddc581aef2ad155d2f599390f0cc63793db44c883b3c1efbabc216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775307474, "uuid": "80e8a480-c288-4b65-8be2-afed8ce362f8", "comment": "Malware payload", "value": "be149014e0bea511362ae6b4d0e8c3b412b2fc30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775307474, "uuid": "c67e95e3-4670-441a-85e7-71e8625f8f8a", "comment": "Malware payload", "value": "d40baf466e9454657eafde94ac48741a11a8fb05cb444e1cb58deea68f6fe345463f1302e6d686b26e3665fcb099d101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775307474, "uuid": "f232d692-3874-407e-b003-be0b1ff21117", "value": "T17E3733D279EA55B6C0A38F35A4480FF9EC4839D9FDBA501AFFD5801E0D30E26CE65225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775307474, "uuid": "ecb79561-4922-4519-a60d-68b5984c7db9", "value": "76a837446f49b8e112cacc398d5f9827", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775307474, "uuid": "ad604649-1e0f-455b-8a09-3f41ec0f2989", "value": "393216:yQpju2TPSrPTlkvX52ab6lOS2vx/AFup8aqhPUkiYYJ5K72Nlt2PyrLZDo:yQ5PS+Nb6ASkx/ya7yPUhYYvK72NKPyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775307474, "uuid": "08c6133e-145c-44cd-a5cf-14fa41cbb588", "value": 22745368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775307474, "uuid": "d8415777-1a62-4e22-8479-48caf09e49d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775307474, "uuid": "2ba4e0ca-9bbe-4ab5-bc97-f725a2ad1b23", "value": "07226560345444fca583119483c73790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2bed18-307a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775343810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343810, "uuid": "73ef3f83-d2ff-4278-b2d7-fe1d066d7a3e", "comment": "Malware payload (Mirai)", "value": "5113e423f7cef091a66a05de5b3acf19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343810, "uuid": "5aa58b25-b7d2-4ad3-8dc9-107436cbe6f7", "comment": "Malware payload (Mirai)", "value": "3bf02280b48304fe5bd0867403f01adc340eb0f6a0466a6d99bccdeca119ae1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343810, "uuid": "055215e9-607e-4230-862d-43fc0cfb5ef4", "comment": "Malware payload (Mirai)", "value": "7f39a75f0e188f3b0b4217adb627b9377f998682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343810, "uuid": "431fd985-2b16-4f55-a418-0ea20ee9cd9a", "comment": "Malware payload (Mirai)", "value": "94725892bdd557141bffd11895c3dedf5b8debca33f5a07d8392ac0cbe68121a333f73df9c7549df14bec6e44f3562bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343810, "uuid": "707d717f-8d45-43bd-b688-104b71fa24b2", "value": "T126836C87E687E6F0ED4309F0112FE73A9536A9352124DEA7D7C4FE63ACB2901A057258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343810, "uuid": "d6441396-f17c-4435-87a0-1d32c91b442d", "value": "1536:zmQO8af9TR2Z2jsiWHsxwWOrzSwdUx31EFr2/AYt7u68++r:aQOR9RCDCOr2hqtOAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343810, "uuid": "da7fcdc4-55cc-4923-bd94-371b06034998", "value": 85176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343810, "uuid": "50d727c3-fd7e-437e-aa2e-4ae02ce0080c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343810, "uuid": "15d96841-9252-4efc-9f65-74d16da8e40a", "value": "mao.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800d0094-307a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775343811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343811, "uuid": "d889ffa8-2202-4f77-a1fb-03a4cc638e83", "comment": "Malware payload (Mirai)", "value": "4f710f152bc45743b038b7a6092c788e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343811, "uuid": "0bf6a8e0-4e0b-4475-8fe2-1beefbecb912", "comment": "Malware payload (Mirai)", "value": "3d6282cd1c8d88218beef2984c8e05f3d0d01bb93ea2567ea50e24f9808381f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343811, "uuid": "197c7a18-c990-4597-b274-4b75dd93b749", "comment": "Malware payload (Mirai)", "value": "2559b988bbf91c5e39f682f3b510de9b156d6584", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343811, "uuid": "86d90aaa-3b3a-40eb-9e5a-207f30a9b721", "comment": "Malware payload (Mirai)", "value": "1bcd697a232baae821d870f03eb1a8b96d0c94b49f55a4d7756df587e12d77f67761eb4d718ba6dde2fb28ef4bd45ceb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343811, "uuid": "d6679684-6bae-4501-b51d-b6597a32e979", "value": "T1A6639E7AC1656AE4C25454B471B8CFB807636804D6EA2EF456938E938447FFCB60E3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343811, "uuid": "29cafe32-b621-43a6-9d3f-2f793f834385", "value": "768:4uWTHRYBbVpAqTaI11PZbX+jDbix0rkJ6qYpPWFkRwokyCnjoICdoZA6Ws0FZ79b:MFusW/1o9k5YpP5n3ICdoZA6W7FF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343811, "uuid": "d267d1a6-c2cc-45e9-91ff-b47171163d33", "value": 71232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343811, "uuid": "90bd7dbb-ac22-454a-8aa4-fac1daac1638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343811, "uuid": "044e91e1-6872-4349-ba31-f1bc6d435bf2", "value": "mao.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75caa8c1-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330050, "uuid": "b333c69b-7cb2-4ba5-9df6-a20329eded80", "comment": "Malware payload", "value": "b403e46d54dea0e65b1b8694a1ca65f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330050, "uuid": "00646edc-5e86-422e-9abd-9403d283dcd1", "comment": "Malware payload", "value": "3d6f920992c6e41f82584fd558cf0415f255a9b50ef3628e2b0dafb8014ed0ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330050, "uuid": "26d38d97-dc8c-4ded-adfe-84484e56e17b", "comment": "Malware payload", "value": "c9b7e754aa2f280e252eda9669f1af0661260658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330050, "uuid": "36e94cc6-7c4a-4410-8bbd-a28fd3b88be8", "comment": "Malware payload", "value": "5088856b7635d4810903862d8ca36bc266ceddb15ac3775ae692031a523eb785e0275ad1a8fa419610ea4c5784b1e6cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330050, "uuid": "0ad3020b-bc6e-4de4-9498-894df4f85137", "value": "T179641211EE401F9BCCAFDF755AAB03272B8C54DA83A1A32E537C8D2D789864049D3C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330050, "uuid": "40e34bd9-39e3-4f96-b139-d7073608f23d", "value": "6144:1gr6qZDnFJLIqJ/dGpU3UCKYQYqlZdadbMtwDtVx5SgW97msQfMAI:EdDLdJ/4pU3LQ8bMtwDvx5bG7msQfMAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330050, "uuid": "7bbe9a74-0f7d-42fb-9f08-d4ec20f791c6", "value": 326002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330050, "uuid": "39c49dc8-8420-49f1-a4c8-7a64de00b03f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330050, "uuid": "093d5539-1572-4613-860e-a31402879a38", "value": "3vrtjbxplo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3d14eb-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330036, "uuid": "00470ae3-8ec1-4641-8571-f7c6535bb4ae", "comment": "Malware payload", "value": "e320f077ba74de8ac4924a064dca5028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330036, "uuid": "badcb3d8-47e5-4503-8236-f9e02be68115", "comment": "Malware payload", "value": "3e7a55dfc594af6b7d41d2855845d8b7288904e7e0f23d25667d8b4cd67145b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330036, "uuid": "5fa5ee05-c242-42a5-bfde-0c09432a9bc2", "comment": "Malware payload", "value": "698697d042babfb6cb92fcd80e851244d6a19433", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330036, "uuid": "d0185007-dd2a-44d6-8364-68f851d515f8", "comment": "Malware payload", "value": "259a6125b60c6db4590bedcf1197f3dbc707bc399e0b11ce83018905539225b25a3dadc08e8b85773d5ba9e7816a8f94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330036, "uuid": "508ce76e-371a-493f-a136-b995c3c038ac", "value": "T1AE5402A0F7284533E0468EB56D7F4776EB284E6201B2C13C7711EF563A23935DA8B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330036, "uuid": "8ea92493-24a5-4638-9b19-c6bec74b9233", "value": "6144:I7DnbnUJ3sK+ilibzRowG4hKpuX3hgSR+ZXrPxBr:+K+fbFowG40PSYrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330036, "uuid": "4c4e1730-072e-4b6f-877e-0c1421aa6dc9", "value": 289221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330036, "uuid": "3a90985c-2560-4a1a-800d-6b82dbef92e9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330036, "uuid": "3377becd-6338-4f86-8cec-6b0a2c8e884a", "value": "5u6pbsspr6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea19dc14-3074-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775341412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775341412, "uuid": "2d49289b-e237-46d6-bc81-b04cb9ca9d84", "comment": "Malware payload (Mirai)", "value": "bdb3a364d8253cfa97185421671e9253", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775341412, "uuid": "6fbfe4a7-45aa-46f9-a1a3-3e594628e1a6", "comment": "Malware payload (Mirai)", "value": "3ef977021623a2699154204ca9e45d33d6c82b41d702f04254abfe21d268d98b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775341412, "uuid": "b3e035cd-83a1-4e56-8079-75d702e85944", "comment": "Malware payload (Mirai)", "value": "388dd1c2a818e9d899bbb953c93358035b00c89b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775341412, "uuid": "09828e6a-f6a7-41ca-ad03-e1703713b895", "comment": "Malware payload (Mirai)", "value": "f7060aadc4e008f7f2b67d8b4f5bed41da2ecfebd19363f04583edb305700973767849e7b3d9f95a430f90b1dd9febac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775341412, "uuid": "276bb5fc-be29-4f50-9b11-d0a4e746059f", "value": "T100534AC8E683D9F9FD190AB12573EB328A77E13A2119DE87C7D865329C91902F5072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775341412, "uuid": "ab3ea6c5-cba1-4214-b307-6d8f3668cf6e", "value": "1536:tvMOtsm6UQXNxtjUdRAQB53NPSIYsJrgVIQou68j4:FMOtN6Uex67BB53NvYa8Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775341412, "uuid": "f25747f7-10b6-40bc-9c56-75e8e33c4f39", "value": 65972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775341412, "uuid": "e7b7abf7-fe46-4821-bb2e-7743f032dfcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775341412, "uuid": "83ff6b39-ae91-4dfc-87f2-63ae1ef75cf3", "value": "mao.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc68dfcb-3049-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775322867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322867, "uuid": "9fa266b3-1807-4386-8e64-9e22a81aa519", "comment": "Malware payload (Mirai)", "value": "b64431d5b8d353a431564b3565471287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322867, "uuid": "6de522a7-351d-42b8-9ab9-939e20e4b025", "comment": "Malware payload (Mirai)", "value": "40efc09351a85f9c38fe203c9ca174b1f15651934a3915fd7db18a89246df759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322867, "uuid": "b07d4989-b005-4b00-b45c-543427d747db", "comment": "Malware payload (Mirai)", "value": "b987fe6f858c163238064dc468ac05c8976dfb76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322867, "uuid": "9af8033c-1c42-4d93-9863-acd8756d7f75", "comment": "Malware payload (Mirai)", "value": "9b34a845407b5cb233ec3195b9a328e9b2d226d790dd29b448a6cf041ca8ea7fd8f8395bcd66607ccea90dc5c22c39a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322867, "uuid": "f27a7515-9ff2-4e5d-af65-35dc3ffbd7c2", "value": "T1B0E4E61A6E629F3CF37487314BB34B24D6AD62D713F1C585E2ACD1151E2028E592FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322867, "uuid": "9b8303bc-9d43-40e4-aca8-3c3dc294887f", "value": "6144:CW7ehuablF9ySC1VoCB1mZVKZ65KF3fNQaYPn/RX64/mqce6ZPWHIcffi4+Lu6ii:uT9yHO5Zr+jebfkLu6RFA4PFBV0l9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322867, "uuid": "89da0401-e901-48a5-8e0c-e1709eb16723", "value": 692528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322867, "uuid": "a77a325e-ff47-44c5-bcc5-bb07aa670535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322867, "uuid": "6e30fbaa-e459-4c62-b213-ac119dba3804", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4dfc37-302b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775310068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775310068, "uuid": "da5ed9bc-c30e-474a-a4f6-ee84d8bcee80", "comment": "Malware payload", "value": "aec0eb0e6401287e7d013af9efd7c57a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775310068, "uuid": "dd73cf45-d696-41db-8c78-8a570754cdc6", "comment": "Malware payload", "value": "419310523f9ed7393e7fee0204c7f5ecccf3082ce0c7c16e03bd7ba235bcb62e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775310068, "uuid": "0e0f8df5-f431-42e4-8c9a-0fe55a4aa34a", "comment": "Malware payload", "value": "65f55736fdd2a2173fcdb8ba3dc129a7c11d484c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775310068, "uuid": "00b5abd6-8da2-4f86-8218-125c01c60785", "comment": "Malware payload", "value": "d9e04e88f0ea68a536834df9f8def1e520ac7e21997d5bdf1e468012461bad30f5bd3924501a0fb220e65bbd9a12a264", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775310068, "uuid": "931b314b-5f91-43e0-bcbd-b86a91411ada", "value": "T1A72603C6FFAB3FACD5E78370525270E16EF378EA7410AC5A5258F620EF619801E74624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775310068, "uuid": "073d2ccd-0158-4337-affc-dcaed7f3b124", "value": "c79a9c9fb098119b25ab8aa3d7a13e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775310068, "uuid": "1877ffbf-f2e0-4874-b3cf-090922dd744c", "value": "98304:MNOwXB6BSmVWaLx7b/jaQxRNliRlPARjbi:MNFxglHrnbijPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775310068, "uuid": "0a898c1d-c67f-49b9-92c6-feb20d4e3a04", "value": 4572672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775310068, "uuid": "274cd2e0-a5a0-4e9d-91b6-544265090d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775310068, "uuid": "a2975ff9-2611-4633-a6ba-a545e8adb014", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539e6948-2fbd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775262562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262562, "uuid": "27c802e1-d2a6-4789-a9f9-e2c2162e75fb", "comment": "Malware payload (Mirai)", "value": "0b4d7b6879be3a3e2a2398cafbb11117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262562, "uuid": "c19e787f-ff20-450a-8c5f-3ca2adf6fcfe", "comment": "Malware payload (Mirai)", "value": "45420b7586a7b51b654588918a49985d56c872161f9b31fdbd6cea23b83bd0a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262562, "uuid": "0417d7f9-7c6c-4f6d-929b-2fb89193bae7", "comment": "Malware payload (Mirai)", "value": "df12ec599d15d915467d1366eecb6fe5db51c07c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262562, "uuid": "1971e1e9-19b0-4c6d-81cf-ea4b486b8d9e", "comment": "Malware payload (Mirai)", "value": "545ea830eac8072c909a21995934acc59f3f59f6741cd8bb31d5adf9276eb2c92d0bb71faec52285ec2ef8dfaa9b9718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262562, "uuid": "cf8c2349-08c5-43f5-a8cc-13174f15b1d5", "value": "T104630A95B8818E26C5D5037EF92D118E332227E9E3DFB2229E205F203BC652B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262562, "uuid": "3d937974-c0b9-4aaf-a6cf-e007ff22d667", "value": "1536:8tnwqo23DY3YO8eY6mo3K7OYGyNDk+4IQ5dyWc1IhiehO+0op+zR:lV5IObYo3YOx+6hO+0opu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775262562, "uuid": "1423e8a2-b356-439a-b018-586a4e4bf869", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775262562, "uuid": "666ad642-8ac0-4891-87c4-029ffc47ad79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262562, "uuid": "4d4e9d00-1e74-4180-8446-66895bcd69c9", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1e5cbf-3051-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775326382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775326382, "uuid": "b9bc0cf7-bc8b-4b94-91c1-97f0998ca662", "comment": "Malware payload (SalatStealer)", "value": "b9d5277afb2777e82c8ef63695de1e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775326382, "uuid": "3ce839ca-fd72-45b6-a6c1-b9ee07443b86", "comment": "Malware payload (SalatStealer)", "value": "457998ade649c3d1b893cf5022bde0fdfb403e2db2649a2f198f8860746b5c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775326382, "uuid": "3af4c823-60a8-43cd-ace7-25234373841d", "comment": "Malware payload (SalatStealer)", "value": "f42801ab7536d44b6c709059e0e4e6281be92338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775326382, "uuid": "9cd1950a-c4fb-4155-b3d8-6ebd3138e919", "comment": "Malware payload (SalatStealer)", "value": "cc38dcecbabfe8a69883cf572a393248894490825d957a0d560009e7999c3978f5f66ec8af61a81b21c59d90b7477569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775326382, "uuid": "47b74844-a94b-4583-b9f3-0be32d8e7cd5", "value": "T1A5F533FEDD880963F9E10D3390CDB29845862C86D6DBC2AE31965D09EE2B7733077856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775326382, "uuid": "1614a459-2ee5-4a1e-bd07-9c029811cd8d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775326382, "uuid": "0a8d8489-9de2-4945-9c91-a8237a95756f", "value": "98304:0u1DWpIJP8Sc802YMnsgalo6xaXrLkCVndhtS:0u1D5P8Sh0Insgalo6x+MCVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775326382, "uuid": "d6abef33-d277-4a01-aece-c26a3524d0ad", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775326382, "uuid": "bdb24d2e-b5b5-4aa4-8cec-2adb34bcd6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775326382, "uuid": "1bfbaa78-9584-461a-963a-0d231c645675", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b27d69e-3072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775340367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340367, "uuid": "7f3b7fa9-c4aa-4650-a8de-8c6896c714cd", "comment": "Malware payload (Mirai)", "value": "65dc183c145c89570277277c6a05d5cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340367, "uuid": "1685d34a-5f91-47e2-a4fc-b37013c653e9", "comment": "Malware payload (Mirai)", "value": "46211322cdf55293bfc9b34f1db8f9fd947ff1d3a0aa9123d15432920ab001fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340367, "uuid": "4e17d3fa-89b3-4d1a-9be6-c351890aa404", "comment": "Malware payload (Mirai)", "value": "eb84aaa25c0d7f77988d05d7a4a55c4911656a8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340367, "uuid": "3198531a-75a6-4419-857e-1ad06fc6eb39", "comment": "Malware payload (Mirai)", "value": "00c0e66a763faa976895ab6c54b690d43ab01efdd552c8d72ca39a68377d4f2af2257b17b0b6211d08299df39dafcdbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340367, "uuid": "be6eda10-7368-4783-960a-6b4a75273daa", "value": "T1F7732983FC81AA17DAD01376BA1E51DD33217399E2DE7203AD126F107ACAD1B0D7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340367, "uuid": "687b702c-e98f-49b5-8780-8783295de7a0", "value": "1536:N9t1lc8QUWL85kfN1i8l3E4vQBOye3ae2ZA6WBFIQ:N9tbcKyD3Q0ye3ae1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775340367, "uuid": "5d7fdc70-735a-4890-8b22-0f3876418589", "value": 75272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775340367, "uuid": "0b9a2923-4272-4812-b3d5-1e69811370c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340367, "uuid": "e96bbfa8-cb86-4ab5-9930-360173a8ceb4", "value": "mao.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034678a3-2ff8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287767, "uuid": "c7bc19ea-3565-4461-a441-fb01cfc85342", "comment": "Malware payload (Mirai)", "value": "acce88b99042fdfd2610d4defcf2887c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287767, "uuid": "c5e5c99a-47a1-42a8-a6cb-8313e1160573", "comment": "Malware payload (Mirai)", "value": "47454f90133eedfab3342836209ddadc9a6156933cbded9736443de00868070e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287767, "uuid": "93cdd580-fdd3-4633-a130-43efe916812e", "comment": "Malware payload (Mirai)", "value": "412992beff9e04a2c10a548de86a42c42f2317ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287767, "uuid": "fc302c89-84e8-4577-a228-51585b8c027d", "comment": "Malware payload (Mirai)", "value": "1808e74f6403bc4fb5cb577606270983ff87088faf3ae43bfc9089540ef1ee128765871feafe390834bb1611d5ea8159", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287767, "uuid": "185ba3ec-786d-4516-a48c-2eda8b4e3bd8", "value": "T10C2309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287767, "uuid": "2371eb4f-2d49-4498-b80c-e26304262db2", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2iOe:Gv4QPfZfW5XTOeoEzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287767, "uuid": "d51ad12d-2dcc-44e8-acbc-b3a64f96e5dd", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287767, "uuid": "a8f0ad9c-801a-472e-b8c7-f4779591b41e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287767, "uuid": "fbffdf10-faf4-454c-8074-32e29db47e17", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb60b69-303f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775318465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318465, "uuid": "c36754fe-a475-4b24-bcb9-6a0a2ac2b50a", "comment": "Malware payload", "value": "ce733a391f3fdd575b03865b25302412", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318465, "uuid": "bf396e66-a474-4895-b2d9-9680e83699ae", "comment": "Malware payload", "value": "49628d273c0a1503daa6391a635f9dacee65f145666da19771a73bbd10450831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318465, "uuid": "659169f9-bef3-4820-8a4c-ac158ae5a75e", "comment": "Malware payload", "value": "1545c13ab89e31bb3602e1e2e4986ed46ab893ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318465, "uuid": "b0d0a7cf-02f0-444f-bd30-315be3bb226c", "comment": "Malware payload", "value": "d109c2d7be79f1b22b73509229a487bd2501a9fe4238d0f023c76002dd1e229c11fa5913f0cebc302e83333862aef1e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318465, "uuid": "e621645c-6aa4-49bd-96c6-bef4680b6e18", "value": "T1F73607127F98EE1FD2A421348AA7C23423D93D05C6F025338756F3192EBE2759D5AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318465, "uuid": "be139b3a-d729-4694-bb48-7a5138b32809", "value": "24576:v2ohvjkVg+z5ETgjmi6smbwilYhCw0+GGj8lVGaZt/4wc+lMWiYCID:v29hEJi6iilYhyVhlVDZtwYviV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775318465, "uuid": "fe780723-d09e-4910-984d-5bdc3a5e935c", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775318465, "uuid": "4f12497e-5059-49d2-b0b1-bba17f13bdf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318465, "uuid": "975e9f71-e8ed-4caf-8a5e-5225775e5bb8", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79b9acc-2fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274863, "uuid": "c01b1d76-d3da-481e-bc6a-07455c2e5446", "comment": "Malware payload (Mirai)", "value": "b1969b123b75b729973c7b49631ba09e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274863, "uuid": "c641e304-db22-43a7-aade-57ae17eb1539", "comment": "Malware payload (Mirai)", "value": "4998e4d8376dbc20f275aa6a49ea31d9eece387047480191e5144ee3b5fd8e82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274863, "uuid": "5904fe41-04f3-4a63-90e4-3684275fb0ab", "comment": "Malware payload (Mirai)", "value": "77187ffc3b4c61c45fa0451bfe9e69a74368d456", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274863, "uuid": "cce5b9fd-6087-43e7-a71d-cc2b1270b085", "comment": "Malware payload (Mirai)", "value": "4766f72b1a61a33f5acf3a878bb0675029dd2eb68f7d89ad2fdfa287736d07f89f2f6fd9c96812ac6e70453d7606b3db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274863, "uuid": "9dcae33f-b5ba-4454-abd2-f96f189521bc", "value": "T13CE34C56EA404B13C0D61779F6EF42493322ABA5D3DB73069924AFB43F8275F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274863, "uuid": "bfda23ff-1178-4d96-9dbe-136829686674", "value": "3072:Kg9kpr99748aZLtFaEa3TowBv+bHyRbiK9LGXPhM/9rAnIiUAV:Kg9kpr997480BFaEa3Towp+bmB9LGXJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274863, "uuid": "3a209d55-abfc-45ab-bec1-3e4a3312c0d0", "value": 156878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274863, "uuid": "aeec6da7-76b9-48fb-be91-7c25532be992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274863, "uuid": "0dfbf43d-1556-4d54-9476-1b2effcc2f12", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addf6d55-3047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775321984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321984, "uuid": "6fe75249-7ad0-4f73-b48e-c5888f538c60", "comment": "Malware payload", "value": "568c5af729e535d32086a14aad3aa74e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321984, "uuid": "3b297d61-f933-49aa-b58e-0c7022fffbcb", "comment": "Malware payload", "value": "49f7c39a65dd92b1d4e266d99c239253197f48d07d5c8ca2dbcb086ddc9c4751", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321984, "uuid": "b5fe9cb2-0fb0-4a39-906f-f8e9fc5b827c", "comment": "Malware payload", "value": "5f18bdc2f66c9ccf8e3bd688fe2821052dfaa103", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321984, "uuid": "89788680-50d7-48fa-a11d-954cdc25840d", "comment": "Malware payload", "value": "47c8bb6ec18717a7662f666b31e9d7a944d9a44d616b69717c126420e3094cb92dfe578fce2aa175a343332641e11acd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321984, "uuid": "de3d4972-1445-448d-8b1a-21f632a29cb5", "value": "T1514131E12C5059B4279FCA2046BE5525E01301577A132828B4BFA01C7B7A996B1FEEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321984, "uuid": "7cc63f66-6cb8-487a-9cb3-ebfdeb21dbe9", "value": "48:eNI6nWQ7x8bD9NwV6vlId/IkKj4Q1d48OUG4nZILSwT/Nh:C9WQd89NxNCwzjrS8q57X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775321984, "uuid": "66f599ec-7fa0-4516-b639-8f4660e88507", "value": 2241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775321984, "uuid": "41bae5b9-abaa-48c5-9aee-1bfcbb24998e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321984, "uuid": "506c9527-4bc0-43be-84e3-72a3518a1a4f", "value": "proxy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fd584e-2fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775275618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275618, "uuid": "cfa1a1c1-8a24-4efb-8413-078ecd96607c", "comment": "Malware payload (Mirai)", "value": "fe3f34bbafa46d8cb34dbb7728a36f5e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275618, "uuid": "8b94f70d-82a3-470b-9e22-b5af5c23d9fc", "comment": "Malware payload (Mirai)", "value": "4a580db59a598814149e4f6fc8b14bcb7374bde672abcaea75b946201e83df71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275618, "uuid": "4df2bfae-a9f6-4fc6-9028-28ec8a7e656f", "comment": "Malware payload (Mirai)", "value": "54643cc3110eb011de08a7676f17b8ddffdfb427", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275618, "uuid": "baae8478-d266-4871-b21a-6fe0f9379265", "comment": "Malware payload (Mirai)", "value": "472806c4c5cab826d092d5da51e436ed8ccffefa704a2aaef7660c1f8a65142e91b1429bb8d1a1498f8fb3b313c4d012", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275618, "uuid": "cdc27abf-d4ed-4465-9daa-265805d10864", "value": "T158313247A95EAA3300530729DB93F6D4A143281349A0DFCCF48FE2307F1B4B4B6A0705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275618, "uuid": "74c06220-2eeb-4902-8507-448591f39952", "value": "48:YjFu17Kab1KXq/171g14h1RK1ep1F+1AD17A10sI1j/17s/1wbD1XF17jMu7iBFG:au17Zb1B/17i121M1s1U1I1U1HI1b1gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775275618, "uuid": "4ebf7b2f-5e7a-47b2-b45c-cf807866671e", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775275618, "uuid": "58abdfd9-54f4-45de-83c3-fda31add6965", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275618, "uuid": "1ee6c23b-9b02-49cd-8e78-907962a0c6af", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83c98aa-2fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1775267052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775267052, "uuid": "41b88e48-1aa9-48d8-9fd8-572d1d04d383", "comment": "Malware payload (Arechclient2)", "value": "f426f208e0864e445a89d8fd24a47c64", "object_relation": "md5", "Tag": [ { "name": "178-16-54-51", "colour": "#F885BF", "exportable": true, "hide_tag": false }, { "name": "91-92-240-16", "colour": "#41634A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775267052, "uuid": "19a60810-0554-4777-aa9d-7de4be063fa7", "comment": "Malware payload (Arechclient2)", "value": "4a63b0a172980dff98b4b1bd8eb19f1adddeb19200275175d72ec3817d15e246", "object_relation": "sha256", "Tag": [ { "name": "178-16-54-51", "colour": "#F885BF", "exportable": true, "hide_tag": false }, { "name": "91-92-240-16", "colour": "#41634A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775267052, "uuid": "a4146aa9-e7ae-4b17-9422-0885a1ca7c79", "comment": "Malware payload (Arechclient2)", "value": "a9e7e542bcf0e47ba3f7b95c08f01d4b0701f315", "object_relation": "sha1", "Tag": [ { "name": "178-16-54-51", "colour": "#F885BF", "exportable": true, "hide_tag": false }, { "name": "91-92-240-16", "colour": "#41634A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775267052, "uuid": "8392ad8e-2c1a-4642-92ac-0d19ded08690", "comment": "Malware payload (Arechclient2)", "value": "c4be999a5261a1666189a6144e0de85811513bd966e61b9a05063fd9f3295db0d98199ac2f049dece3eed0b6645d9f23", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-54-51", "colour": "#F885BF", "exportable": true, "hide_tag": false }, { "name": "91-92-240-16", "colour": "#41634A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775267052, "uuid": "6a2b9f75-0cf7-4449-9bc8-0f09351382c1", "value": "T184356A375D470F7B42C933DAEE936545EE25515A12B322BC3BAEE064370BE5C6B8884C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775267052, "uuid": "524f1670-b400-4c0a-9eb1-e5d93993c989", "value": "12288:pRCoRCHoINtFPc+4nB82SvjM6FWC7PtwJg9hn4oziwjg:pUHFL+BLSv3WC7yg92oeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775267052, "uuid": "16badd36-a291-470f-b281-dbf2d3e1a1cc", "value": 1096950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775267052, "uuid": "543f4840-f4ba-49ee-8a7f-96336a108d2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775267052, "uuid": "464e13aa-5a2b-4da8-b0dd-1a72f282bcf2", "value": "GARDEN.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2476e5-3070-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775339622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339622, "uuid": "202f05f8-5c4f-4014-b93b-22fc8d8de3c7", "comment": "Malware payload (Mirai)", "value": "a357cd4a1a4ee0002da52ab2714a4ff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339622, "uuid": "84133ee5-7758-4743-a284-c0b8781ee7f1", "comment": "Malware payload (Mirai)", "value": "4cac867a75d44338ead9c0976c35215de1d8c3f5ee6bc400c5734dfca1d7c8f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339622, "uuid": "6f9839a6-c9e7-426d-84d4-3fc057295e43", "comment": "Malware payload (Mirai)", "value": "f4f25846ff1dd2d6e5dd64804c946115a47c732d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775339622, "uuid": "0370989c-b9c0-4ed9-959e-61055d7fa500", "comment": "Malware payload (Mirai)", "value": "caf0410ff59a7f909f590e54e7e13e2fdc119a108fcd1d8e7908d760eef1c8b2972c59d0fb841ef4717e9888ffba6cab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339622, "uuid": "503a729a-fb3c-4bb8-a34a-4bc5ca16dcdb", "value": "T188735C21B97D2D27C0D4A13A62B74766B3F6520F24A4C72D7E720F8EFF505C4AA166B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339622, "uuid": "5ace210e-9914-4140-936b-8758eb99cd62", "value": "1536:h+j6BLg5Uwq4cxe1ZhftaFjwPmZaagNdG5ZWaWCNkX:gaVShftDbNdgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775339622, "uuid": "a43ff644-9c75-46cf-aff2-49edf79c9451", "value": 77232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775339622, "uuid": "f94bebea-8ee6-435c-9d5b-e5e07581dd2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775339622, "uuid": "0e343e82-03c3-4fba-bc9a-27d2d2807088", "value": "mao.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5e66fb-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330033, "uuid": "fcb7b124-4d4d-4dd4-ad54-5d09c17fc188", "comment": "Malware payload", "value": "7fc78617822d26e161381bd28c4cac27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330033, "uuid": "f2225040-cc55-45d3-8e04-435d97ec9685", "comment": "Malware payload", "value": "4db115d6aec8de6663fbfc8a7e94ab34adbf3c718bb9bd4d6100e65198b85b55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330033, "uuid": "ffedf9d2-cc87-49dc-af05-289a26e47a0e", "comment": "Malware payload", "value": "065cbfde6991c358b41a047ad520e04f403c27ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330033, "uuid": "b298ece8-bb3a-46bb-8016-504104bb4354", "comment": "Malware payload", "value": "ba43a7f69ae89617009b8a1624ab406449748ac4c3495cc274c648bc0cbe181a045efef1b47c694b391493aeff969df3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330033, "uuid": "ca439b41-f7fb-4be1-bf8f-e617abf88d86", "value": "T1376412C26B508F16C65D81728AFBCB91BFE601E526E08546B33DE800DFD264C5A6FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330033, "uuid": "673829b7-c54f-4a07-a0dc-d4004781b85d", "value": "6144:uRjR4tudkSB23bFVPYIJfHMACIaf6/li74liAy+FQ1k5L0RPtKt+/KKoy8l:akufEZVPYIqJIaiI74e+K1k5L01U8yKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330033, "uuid": "f0be550b-64c7-454a-9009-70809f7bfd93", "value": 324829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330033, "uuid": "341e2878-748e-4673-a6ef-eaaf29b43b6a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330033, "uuid": "d7646b66-12ed-4944-a72a-70f36849c6ac", "value": "zlr01030u5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1c81ad-2ff4-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775286150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286150, "uuid": "01158f17-2e11-4069-ad6e-78ce5c142fec", "comment": "Malware payload (LummaStealer)", "value": "dbd8002517fefb3a195df81ca970d1d5", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286150, "uuid": "14ffeb94-db3b-48b7-8534-88287736f82f", "comment": "Malware payload (LummaStealer)", "value": "4e62743c61bf2c18a0f77d0837859aee67d2aac22908e25289cd3d760e024c04", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286150, "uuid": "18e26983-4df8-47b1-9a08-1523814e802a", "comment": "Malware payload (LummaStealer)", "value": "b465e5ed4cd5c5717c4ee56c49b33ccd3fea533b", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286150, "uuid": "56451a01-e876-4f3d-8ac0-c39aaba9531b", "comment": "Malware payload (LummaStealer)", "value": "971041d843ec36cb8a78dd55f7f0839547da4ecb54c3432cfac3924b3a43aafca01fc9d84b3df8cb084c4278aacbeecd", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286150, "uuid": "451d7371-e35b-406c-89ea-651d9829a860", "value": "T147654B40EDD784B6E416173289F726EF3335AD091F329A87EA407A79FAB72D11832351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286150, "uuid": "2e878627-a2ec-4d3f-8a10-8322fc605cf1", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286150, "uuid": "cc815b46-ce10-4392-9f8a-e438b3b5bab8", "value": "24576:jC44yKr/Wn1z2vyUQvL9Df9VKqNBD5g0ahaFismIzRjnDJP2LN1jSDFK1iiXLZJp:juDun1zrlce2mDbiXLzy8c9EuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775286150, "uuid": "7063bde3-1c11-48a6-a127-f7526985e741", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775286150, "uuid": "4a281f49-48a3-4fb9-8c28-2f87dc8b0a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286150, "uuid": "5e1614e7-4b4c-4ee7-8842-ec192934be0e", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913fc3d0-2fcc-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775269108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269108, "uuid": "3da6744c-d4b1-4d63-a19f-3f3fdadf92d1", "comment": "Malware payload (CoinMiner)", "value": "43472f7b283aca33bb92f79f9bb19cc4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269108, "uuid": "41505760-73cd-4051-aa15-b54b62cbe5e9", "comment": "Malware payload (CoinMiner)", "value": "4f361ec950cc375e21caab543e37b463e0a5dc3d7f8d8d188f3498932cd46d5c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269108, "uuid": "171c1fbc-097b-4580-8031-a56158c6ebf6", "comment": "Malware payload (CoinMiner)", "value": "0040f6ad5c630692ef2bd6c5d3aaba0c81c9e65b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269108, "uuid": "f8ecbb61-85e3-4109-9292-56c7d6b162b5", "comment": "Malware payload (CoinMiner)", "value": "7e285dc4652f2ac3a4c9536eb09fa71a033ffc707fc59a49d40b099bbec48836fb5f9f8013046e4513625da6f008923e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269108, "uuid": "b0c6a02b-baf4-460d-9115-9f997f5a4240", "value": "T1283123F4B4A2B9F5378B9930A6BF4425B833104AAE1278596523D02974FDE87E33DD11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269108, "uuid": "90f423b8-2e4f-490d-ba3b-4d284914e08d", "value": "48:Xet1tsbidimskeP1CrGuZ27RVInSkQkxV5D:uLtsCFe/umA/Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775269108, "uuid": "206e426d-375a-47d9-8653-3f755c8f1b5e", "value": 1714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775269108, "uuid": "81750274-a692-4a35-9352-8bbeb733cc05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269108, "uuid": "0d7fe343-28de-4bae-937d-79c86e8fd97a", "value": "apt0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c62f8e-305d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775331260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331260, "uuid": "69625050-550c-4b4d-8d77-f314d5e4d30a", "comment": "Malware payload", "value": "8f666b2deb04330de0ec156305d773a1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331260, "uuid": "d2ec8dee-7fa6-4808-9873-215e7b90966a", "comment": "Malware payload", "value": "501e35f1600ce0548226c9957eed76f5f04cb2e1dbfd4f3fb8652009b38e8c9f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331260, "uuid": "db297a51-fa1f-48ab-9c50-2c9b9ccb1a68", "comment": "Malware payload", "value": "39ab13cf8ac7ea66b9a666a62fa4e6cefdcef128", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331260, "uuid": "aab5889a-d21b-4a05-a216-8ee7afd2128d", "comment": "Malware payload", "value": "b1840e29ca83653c9cd9fd0e5e5ef82f4aa8875c52314d2d823593f1718e40f25b0af7059a54b7d22c47a65f70010220", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331260, "uuid": "91d00237-bd6c-4346-9c8d-31e36895f29a", "value": "T18FB3129ADDD0FCB3C9FE58B99870F13CFF611362D2C56B8609284171992287589F263D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331260, "uuid": "9d9e9aff-6f54-4658-81e7-7701c796bec9", "value": "1536:RbTxvrw+otVLqUwBx84E4uAXQlcWrZvS00eV688DANSct9eISuGyPJdiislf7:4JwBMAghNZV68C69/tlP2isd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775331260, "uuid": "7c190096-35e2-4a96-87fa-b2e00b0e0469", "value": 108871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775331260, "uuid": "b70097e3-d9cf-454d-8fca-f79a2cbb3cae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331260, "uuid": "527c1ce3-a1e1-47a0-a4ef-8b5d1fed94c3", "value": "MadHineks 3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc97ac0-2fbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775261965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261965, "uuid": "68e1580a-350d-4ebc-aef3-88e363a5995c", "comment": "Malware payload", "value": "3c794de299cc17b82adc0cbda3f2e34c", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261965, "uuid": "d6127109-effa-4a9b-a931-2a9b86a8b88a", "comment": "Malware payload", "value": "51c41d5d8024ad4d026cd7b8a54cd65be31daff721a5696e569bf3924a9fc1f8", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261965, "uuid": "e18144cf-506a-4e74-9d41-7bba241e07a7", "comment": "Malware payload", "value": "afcc3c94d75a05d0535c11cd7a047e8459d4fc4f", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261965, "uuid": "3576e0b8-7455-432d-83bd-1b1808d3b3c8", "comment": "Malware payload", "value": "645ba4c510a9e04707c8c941e83a8f46c145849ea942c63db385cef205ab0178e66784f44103de1c9b97fefaab7f3534", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msedge-vg", "colour": "#251BE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261965, "uuid": "cc323530-7a67-497d-844f-a46dc56780a3", "value": "T111D3DFCD898B88E59B1F3468062F6C068E9DE227061DC9C0BEDE9F583F535B075B99D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261965, "uuid": "a287de58-ad2b-4282-8fbb-0315b0ae40d0", "value": "768:kFeo7+z6Umz6ekz6rAz65I5kOu5kmW5kHB5kaOnmw4nmJynm8wnmMlYbwRWYbYUm:7mo0u8m6nF+U+BDnoTL0WE4cTWBUGrcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775261965, "uuid": "705626e4-4b5d-4bd1-b09b-e3f8403e6b5e", "value": 134056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775261965, "uuid": "f33ed316-ac49-47c6-af7a-0661530572c4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261965, "uuid": "45bf2a14-8664-466d-a3e0-53a137030b2e", "value": "UK_Record_Backup_171.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32712f05-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274103, "uuid": "eed56f8b-7c3f-462c-9faf-806272a53ebb", "comment": "Malware payload (Mirai)", "value": "f754830373a9a502d11d5873f1749c0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274103, "uuid": "a3b491c2-4130-4d9e-a0fb-8306538e9f69", "comment": "Malware payload (Mirai)", "value": "51cff1a4556d40a537da8e8170057213d15ee01ee113113cb96f7f6e47a18291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274103, "uuid": "361006e0-10aa-41b2-89e8-be62c98593ae", "comment": "Malware payload (Mirai)", "value": "8e7cc7602310eb377d8b2a862d3eff7434b001b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274103, "uuid": "1865c1d8-b300-46f3-9def-c21f3699875b", "comment": "Malware payload (Mirai)", "value": "42eb027824df9026c28ebd5e0a52c1c0290fcaf83bc6dfd672c482d73fcf7d6d4a821191d7cd45a9c90b91d418501aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274103, "uuid": "96e55ad1-0f0f-4a1e-a355-6aa7c289a789", "value": "T185633A81BD815713C6D122BBFB5E428E372613A8E2EE3207DD226F21378781B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274103, "uuid": "a851be86-a8b1-4244-bea8-dc5fea7a9420", "value": "1536:h8M0OQTv0KtVkrkkNe2uN1jOa3j1OpKaEkvRK:h8MojYze2ADgL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274103, "uuid": "d5c00820-78ee-4407-86e1-16077c395e5f", "value": 72544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274103, "uuid": "8574c7d0-f3f6-408c-b3c9-f9b7d7879612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274103, "uuid": "e9b730ca-7a8d-4151-b14c-e935bdcf7049", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cab7ad1-303b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775316774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316774, "uuid": "5f405116-1126-448d-82a4-459a7f0612ab", "comment": "Malware payload", "value": "b430256693840898f772205341e7445c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316774, "uuid": "591a01fc-b28f-4d5b-88ff-9e4f50b4cd3b", "comment": "Malware payload", "value": "5310ddc8e268d444d0fb712b0ff7d16982d0867384d55ea75a7a12b27d61623f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316774, "uuid": "ef9b37e1-d669-43b7-a518-7fd07c950efe", "comment": "Malware payload", "value": "6e5a8190556d3cb8ea1429ccf4d49cac99e2fff2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316774, "uuid": "06c3fbc4-4c0c-42f4-80b0-e4c2cc35b2a3", "comment": "Malware payload", "value": "f08d43c2c8e6f104c2a134cf1b1859e6247fdbab242a6d978137fe94ffc273228cd2835c80cda8f473bcdfe76f64c870", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316774, "uuid": "bc7de0ae-fc58-4d1b-bcb9-5acebce392ca", "value": "T1EE82E12CC7EBFD7C798C5A86DB8BC8D02839662033820135D634EA95F05AF1D56DCA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316774, "uuid": "f72b5e8f-940f-4253-abc8-4325c2f967d7", "value": "384:K3LSsg5lt+xZZoP1d5ZA7Yi9pTQdVDAfNNVY+0dbcw:KOtNpDzA7J+DAlHYxdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775316774, "uuid": "c05d1de1-f975-4393-a272-732209e4db53", "value": 18536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775316774, "uuid": "b0c5a9ad-501a-4925-8fef-803f148b30fd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316774, "uuid": "40fe14a7-a256-4647-9882-5b6658533f70", "value": "clawskill-1.2.1.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c91918-3047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775322073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322073, "uuid": "705fe09e-c5f3-46e8-8d57-a59e15e22593", "comment": "Malware payload", "value": "347f183998930cab6b86e0bcc75598e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322073, "uuid": "71c220b6-1294-403c-a389-682dea4a796b", "comment": "Malware payload", "value": "534f41f04a647274d29b0ef2a46aa59e1c2cb3267b6f31ba27207316ca993f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322073, "uuid": "c2c13f8a-6044-40da-8a4e-5ee42d73d5e6", "comment": "Malware payload", "value": "aa2792840ecade1f67567bfb393fcb61baa9f625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322073, "uuid": "3333a814-2adf-4bbe-a1a9-d1d1f4f25618", "comment": "Malware payload", "value": "8c0b2b69832c979aa1342b309fff40732df638a81a6f2bcfb1c35658b6cf103e6296dc5f64dc6c6493ad2a72b2ef857a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322073, "uuid": "379f189e-fd95-46f9-883c-ceff663e308c", "value": "T1E7B67C73945334D8E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322073, "uuid": "261f1fce-90c5-4a79-bd39-282f3ae58aba", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQt:cqYUQuVDt0TZE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322073, "uuid": "7cfd20b9-2cd0-4c5a-8306-1729830575c4", "value": 11042816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322073, "uuid": "10029b0c-c5d5-4987-8d48-3d9cfe742c3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322073, "uuid": "14b7cf64-4ac4-408d-92a6-5ea1ce009dc4", "value": "534f41f04a647274d29b0ef2a46aa59e1c2cb3267b6f31ba27207316ca993f4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b072590-2fbd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775262547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262547, "uuid": "c21ac066-a1ed-412d-a3ff-2f76c365ecc3", "comment": "Malware payload (Mirai)", "value": "f113d719f0a5ff7cd7887734808906e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262547, "uuid": "b700ad82-97c0-4779-9c15-e0b585b81c38", "comment": "Malware payload (Mirai)", "value": "5396e77599082f88a766be76f1f08148976e8d48276e816963f73acda92d5dc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262547, "uuid": "ffa68378-d311-441c-8e58-a9f551277443", "comment": "Malware payload (Mirai)", "value": "0fd71c0346800555ecd2f6729a99f7ae868199fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262547, "uuid": "e0741bd6-4994-4c5a-9f83-5b78127da40a", "comment": "Malware payload (Mirai)", "value": "94abf53dc1f6af7ddd921f65048673b37809c89ea56ac52c97acaff411a522365a706158114ab3beae19e35ee664e9d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262547, "uuid": "40716b42-8c90-4de9-b9d5-443cba5e3214", "value": "T130D2D00AE22E68B3D5701835FB74804B0F815BBAF8BB70326AB4D4A49BCB85755FF041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262547, "uuid": "121ac8f8-5a3c-4067-b350-ac47d203639d", "value": "768:H/76iRifaS+KegXFKht5lnZsmEhFb6/9q3UELqQ:fLEfaSTFKDZsmEGuLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775262547, "uuid": "077a532f-c9e6-4172-a46e-c843ca102559", "value": 28548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775262547, "uuid": "590eb449-dd75-47c1-b813-1dd1d641b664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262547, "uuid": "f37cb421-7e35-4225-96e5-bac133658520", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602f9d91-2fe2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775278474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278474, "uuid": "8164fe31-ccff-4cb9-8719-8faea800c8d1", "comment": "Malware payload (Mirai)", "value": "5b386494ecdf6dfe3a77ffeff57beb39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278474, "uuid": "11b616b3-1056-436d-89c9-c77a99922317", "comment": "Malware payload (Mirai)", "value": "5427edd231beb33e66ab7b5993d1a70587d2f7d042306a60211b56af44f82380", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278474, "uuid": "2f1fe70e-3ea4-47c0-ba70-142894e74501", "comment": "Malware payload (Mirai)", "value": "eb0650fc6cffff80841333f3373e128e94a80631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278474, "uuid": "3694bcbe-19c2-447a-a6ef-898efd5db180", "comment": "Malware payload (Mirai)", "value": "42db6e730b1dd994a41fc2ca1dfe0d645e5d065ab79036556b7cccf7846d7a21e7274b8db45b341b017038a6a57b19ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278474, "uuid": "8ad16601-75f6-4f57-a547-032ecda606d9", "value": "T11ED2E061B38CD560D37008319F644882E1A4AABDEDFE73222E78905C6DDA9172EF4797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278474, "uuid": "7fc2b2b2-996d-4c72-a595-14db745680c6", "value": "768:I6Dc28+YbMvFwWQVpEMT85rGh4aP30e/0s3UozN:II0MtwzpJAqhbZ5zN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775278474, "uuid": "ee8d2581-488d-4e0a-b577-90a7f91f26b4", "value": 30604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775278474, "uuid": "da7c6470-5e29-4b78-a90d-7e03e2cb2b46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278474, "uuid": "09041fc0-6716-475a-a528-fe2a4cc202d0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c97f34-307f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775346046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775346046, "uuid": "d9cff74a-f5fb-4f7e-8f87-04424fbb1f62", "comment": "Malware payload", "value": "31f3c2734ceb6dfcc346b16cdcff9d8c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775346046, "uuid": "1d8fc13b-2495-47ac-b58a-77a7d98dee1b", "comment": "Malware payload", "value": "55f2c5212b0a8fd51a73aeb0141da97a4bb27117144cf269ab5fd52de4a005c9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775346046, "uuid": "55fdf5e8-d800-4236-9554-385dfc8ae817", "comment": "Malware payload", "value": "73b09417552e64650ae0bc1069aaba8135c06a66", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775346046, "uuid": "f6c931ca-69d4-4d46-9b9b-105098e0d0d7", "comment": "Malware payload", "value": "f69bfd3eee1459f0718ffff95698fa0acc40afd2cd0595c8945b088174ae74b6ede817bc06c115e39fe047c48bb06278", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775346046, "uuid": "8d3af51a-00f6-4438-a1ea-ad8e29a7526b", "value": "T136665B07EC9555E9C0ADE2348A729253BB717C885B3123D32B90F7782F76BD0AA79710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775346046, "uuid": "93fe0962-f1b7-4261-99d0-947228f366f6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775346046, "uuid": "ef2067eb-20c7-45e0-9cb1-f56dc734b265", "value": "49152:ZgXUBrjuhWnk3fdkxzVh00pRZdhsRS+lOPiy3FxBpqAEYP6qoA1V7tLQVwDiMwKi:ZKVKR3x0OayfB16f0tL/PsaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775346046, "uuid": "83ae94be-c4f7-42cd-9d91-8d0733eae973", "value": 6850560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775346046, "uuid": "294ee710-053d-4c5d-97a7-ca81e9247de5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775346046, "uuid": "33f5573d-3af7-4356-96e5-cc2e64660811", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658997bb-2ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287503, "uuid": "9a15c724-6baf-4281-977d-388009fb83e1", "comment": "Malware payload (Mirai)", "value": "b53be31bc55d4567e81190acefb6e15a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287503, "uuid": "601db5e1-f98d-43af-a39f-e53310790719", "comment": "Malware payload (Mirai)", "value": "56010e2ec81eb4a48a318cbc70289d998eec394f9dfa66baef369a56979f5800", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287503, "uuid": "58247b6f-59b7-4234-b752-fbfd800ff6e3", "comment": "Malware payload (Mirai)", "value": "b1c86f138f23b1c6cd318aa57ef18b6694e75051", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287503, "uuid": "a32e2bef-de74-42c4-ac68-1ae203f6acaa", "comment": "Malware payload (Mirai)", "value": "dbe6199cbb4f798bfa799c56d7af837cf40b771fa764e79187694b956b982a165c36e9f6f7dfb8fcc39f4aef27807767", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287503, "uuid": "c5440e0b-3474-44bf-b52d-f11ea6dee7e3", "value": "T16AC2F1582902898BC4372D7A754BEC59BDD3174E189F891822FAC1258BF372C67F131A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287503, "uuid": "1ccc4e48-5641-47ab-b93b-f5bd02a80d68", "value": "384:TeV0foxTKXtuvwdtTX9KSyaBSBjeYTfo9mmQPgta8bN4Y75f3M+2ffVCBOi7+ngT:TDoQtBTX941eYFDgNbl5PatCbYUmQAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287503, "uuid": "63a73492-e0ba-4791-8e54-901d8137c03b", "value": 27740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287503, "uuid": "a302663e-61dd-4cfb-ad29-efb9ee52a0e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287503, "uuid": "883dde90-7b9c-491d-a4c5-931a44780f13", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4bce76-3046-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1775321634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321634, "uuid": "1b08cfe4-17d3-482d-8a17-85e5e37cfdde", "comment": "Malware payload (DeerStealer)", "value": "b4dfaf11e472f2a1704aec2179bf4100", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321634, "uuid": "8ad2fe70-660b-4e30-8bdb-691e93f4380d", "comment": "Malware payload (DeerStealer)", "value": "562bb0195ecd7959c535a5f2cce92125296d4921a15b5339f2f68ba815a7101b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321634, "uuid": "9da9c8e0-b326-4faa-86ae-731dc3f4a632", "comment": "Malware payload (DeerStealer)", "value": "2dfe0f2a1263eb571d10185cc70122bb8a9e176a", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321634, "uuid": "a5097d0c-5791-42e1-96e4-d3737fd36b5c", "comment": "Malware payload (DeerStealer)", "value": "02da22212f0f3865efef84915ac38d2a935165c6157c38fd7a1bc0fb18f4f3851db88d6b41d087660b71b99b56027875", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321634, "uuid": "86397ea4-edbd-4cbc-963a-61e15436548a", "value": "T147A63397339C40B8CB598C32DF14AB770632E7AC6B431D03A5DA1F04AC36696D7176EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321634, "uuid": "20cfeb01-2a7e-4fba-91e6-434470523395", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321634, "uuid": "d40f34a4-1952-4285-9bc6-a093d7a2cb63", "value": "196608:+pRSglwpq2u/HUjA5pd2V3akMF/vH7I6xFCCcwpB47hk:+pRXwxcUqv/f06xbBChk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775321634, "uuid": "b5796af7-a80f-4a8a-8a77-448f84295828", "value": 9798313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775321634, "uuid": "ab28a764-fc3d-40b6-b7ce-3edb4fafa036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321634, "uuid": "06ef7af4-2677-424c-aee7-1add6eaa0c95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f9b8ff-2fd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775273657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273657, "uuid": "6e5cf760-cdba-4172-b28b-66713dc813bd", "comment": "Malware payload (Mirai)", "value": "8d4c2ae7c5b1847af1469c800b75d566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273657, "uuid": "cd85c73e-f7da-48c4-865c-0b5bf3aa4561", "comment": "Malware payload (Mirai)", "value": "56a6bbf9d1914c24109b7fe1e28e8f380ea2077210f45ea1cd5f0646c46d023a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273657, "uuid": "31274e53-c0cb-4310-b9ab-1a1968f0b9e4", "comment": "Malware payload (Mirai)", "value": "cd952b7c4048108385975a356fd321f068cb9307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273657, "uuid": "b60dd341-1129-4290-abf2-6c9941bbc216", "comment": "Malware payload (Mirai)", "value": "56fb4e3bcbcdd09c1f8ca38a5c76bb9c32c2d029c3792324a59abdd4478dbba6bb08994fc459507a3425197174641e12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273657, "uuid": "69aa10f0-763b-4c33-9aac-47749147a6eb", "value": "T1B523F891B8819A27C2D1137EF9BE968E336073E8D2CB7227CD510B507AD542B0C6BF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273657, "uuid": "16f870a9-d7ed-476d-9f13-c59ff06669d2", "value": "768:UK6lFnnn4gLg+3+xlZJ41QGjXflZIZQ2/jEMdMizLTxKDtYHImiODCgSMecdb5pz:annWZJ43flZMPjEMdMfcOYrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775273657, "uuid": "21d746fa-1f72-412b-b74f-8c3bad68ba87", "value": 48028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775273657, "uuid": "f5485aff-f975-4f33-86bd-2c24cd720ced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273657, "uuid": "8df9d857-4378-432c-81d2-c7188613d35a", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a707ee55-3049-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775322831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322831, "uuid": "5c961b0c-4b14-4d76-a44a-095363ba199b", "comment": "Malware payload", "value": "8a74c38a6044fd1464c76a6ce25eb0c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322831, "uuid": "089f32d2-3e14-4089-aa90-bbe67b11896a", "comment": "Malware payload", "value": "58a28a05c1a68fbb5a9988b2f046a289dbf277fe95f3aeec8f8d6a7373324539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322831, "uuid": "df7f3e8f-300d-4960-9675-8d2c70273c99", "comment": "Malware payload", "value": "d4b8d530d48bacffdf92fd58a6dd2e250e1b1676", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322831, "uuid": "661d4d1b-d44d-4c2a-a150-b3b6e5287f1c", "comment": "Malware payload", "value": "3b30b111dd60221e6918747f2c1b687d663cde1164e23727f460728e51c80bca6f6f361f0ceb8b062cfd98d25dc7d687", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322831, "uuid": "2da71ad2-dceb-4ba3-9c83-32235986b620", "value": "T19F2619176E28EB1EC22811345C72CEA86B391C8A46DAA517B355F319B9F10BC4D6FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322831, "uuid": "73407320-f451-46c9-b9e5-2f2096884c44", "value": "49152:8aquvPfZQLXLZYbzittYTN5G7eHjtVFeTx16DmHjVVFZJbeKD2nl5/f77mbw11dz:rqumu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322831, "uuid": "8768eac8-fd68-404b-9cc6-3952482b647c", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322831, "uuid": "477bfd34-0777-4086-8102-223472f6899d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322831, "uuid": "1b659354-030c-4de8-b22b-d7c7c2d751a8", "value": "linux_mips_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425e074b-307c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775344567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344567, "uuid": "723724b6-f302-4be3-ab68-cc855e67304f", "comment": "Malware payload", "value": "1585abe56c0201d1912fb7c6378c96b2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "tnt-unguidedfreewill-co", "colour": "#7C1A44", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344567, "uuid": "6f2e2e85-3028-4863-9e79-4e76f5d32a47", "comment": "Malware payload", "value": "59a9fc2aa8e8935158404d0747e2d8bf59cea6fc4b41c18c79ba957fc4c700be", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "tnt-unguidedfreewill-co", "colour": "#7C1A44", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344567, "uuid": "7bb315ea-17e3-4a06-aeb0-898ddd387b47", "comment": "Malware payload", "value": "be8d7769b20ce05ea159f146e5044165cf296e52", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "tnt-unguidedfreewill-co", "colour": "#7C1A44", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344567, "uuid": "4580c630-8df6-4d4a-98c5-586e62355510", "comment": "Malware payload", "value": "28d98e73a4f035bf97d31a63025399ed0b7714b6e98eb1fe77078b617b0229b5783bde57357671f4681b22a3389638f4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "tnt-unguidedfreewill-co", "colour": "#7C1A44", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344567, "uuid": "5e24fdca-67b2-4268-9a20-fbff9ce6339e", "value": "T158A633F0F684AFC1D121C53153F89064E6DE1CA670A3ED66BC132F9D25939F7A2AE448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344567, "uuid": "f1754bd5-4163-48ef-bf01-06e03b11954f", "value": "196608:4XoIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9hl5+uWL63x+mb2ZYYLqPZ8eP:vhOnn7FUNyhGprLz0D2L63Mmb21Gh8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775344567, "uuid": "543929f2-affc-4aa4-9b94-30aba0bb5f12", "value": 9648580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775344567, "uuid": "18b7f32c-f03d-43a7-b96c-fd5b82ca9f4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344567, "uuid": "de0c3a6b-d116-4928-a2a4-3704718d19d4", "value": "1f86ed90-6b0e-41e4-b4b8-dee23cfba442.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1055bf56-3037-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775314848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775314848, "uuid": "f5f33007-49b9-40b2-bbc5-17c2b73da245", "comment": "Malware payload", "value": "01ca29c105774bd2416945b8203d8a2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775314848, "uuid": "c137babc-43cd-4554-a8e2-065ab26384f2", "comment": "Malware payload", "value": "5b15dcff5b4960235476057ddb138c7b2539bd253be814100fd2e36215fcdc61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775314848, "uuid": "86ea54e4-a3c7-4f1c-84fa-ae53a70c3836", "comment": "Malware payload", "value": "060888d2aa87367da7eab9154c298a48839b1f36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775314848, "uuid": "b5d6df29-f8d0-42fc-8093-243d79510430", "comment": "Malware payload", "value": "061fc9bf01ccd9fe13a3d7cd491d6b3d4e726ab04374ef2d1e8ab8ff5122dc13873afc8f98e155278d98df1e9ac34a58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775314848, "uuid": "4848b3d7-dd8e-4b59-b078-c15baac14da1", "value": "T131364C57F85151F8E1BEE270C5565223F6703C881F3223E72B01F2E52A36BD49A797A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775314848, "uuid": "8fabd959-8d00-49ff-a1de-418314c2c358", "value": "49152:sWJtAgZD0rb/TivO90d7HjmAFd4A64nsfJm+pskbwNIjdzmZZgeg8htzRBFjUhxd:5JX8mLRhXjwEvM0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775314848, "uuid": "38cace85-db73-4de8-8ea1-f98171a0a83b", "value": 5275648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775314848, "uuid": "465ca570-6f27-4b35-b306-e6c2dccdc219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775314848, "uuid": "44cacc88-2f64-47dd-b9b6-e19801acd4b9", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4573c0c9-3044-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775320520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775320520, "uuid": "e3679794-79da-4038-86d4-441e62ddc76e", "comment": "Malware payload", "value": "c540c26726bc2bddb5542805c34a14b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775320520, "uuid": "3627a8b9-e164-4ac4-9cd9-4f444bf3147c", "comment": "Malware payload", "value": "5be8608d1d61f478405b17fdd5a0f16da5acc92cba92a6c4eeedbe87954e7f3c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775320520, "uuid": "41874c93-264f-4da3-b73c-4151651ddc24", "comment": "Malware payload", "value": "295cd23697cd249b17a35c60a9c44af46d3a1085", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775320520, "uuid": "adb23951-45a6-42e1-804d-32c16336c13d", "comment": "Malware payload", "value": "338f347535567a0f0d7d269709c2aadd4ed55b38eb06056462909921c72b71756f08715b7bc2e84d712b8912726fe662", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775320520, "uuid": "d3edb6f8-36a1-40eb-9dff-601b5ac9083f", "value": "T1D6871256E2F900E8E9BBC0B8C6575517EBB1345817309BEB56648A692F33FE06E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775320520, "uuid": "a469d446-5165-4d80-93b7-ca202a25d532", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775320520, "uuid": "46772e79-4ad0-4e1b-8e6c-3b1dfbed73e8", "value": "786432:44WaL2qdAPI/Ja9McwqV0UXrnrr1D7Z0+UemAfjOFXYjVy:6aLzFJtcwqV0OtmAfjOFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775320520, "uuid": "62d615e7-a813-44be-afe9-b4afaed8f57a", "value": 36619236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775320520, "uuid": "954cc74b-859c-4157-8e4f-01165c4f3b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775320520, "uuid": "90ae0c65-5408-4279-94c9-beb3698e0323", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f0a4f4-2ff8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775288005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775288005, "uuid": "4409b00b-b4e2-4a77-ae39-a108ea319549", "comment": "Malware payload (Mirai)", "value": "dc4a83725592ada2b6420246d35a7420", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775288005, "uuid": "88c28f98-d3fc-4e69-8114-0007b5559154", "comment": "Malware payload (Mirai)", "value": "5bf2ef67e14876189cc28e342a7815ee9cb93ef9ff10110d5673ee2e31524844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775288005, "uuid": "a7285006-cf29-412e-a48b-07d357234c12", "comment": "Malware payload (Mirai)", "value": "564feae07e168812e8f2279080b7f08b99481fab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775288005, "uuid": "eb35a2a4-b33d-46e7-b4fd-2341c5ecc7d2", "comment": "Malware payload (Mirai)", "value": "c2b451193b7708e307ab25cae86850e4e27f911a05f265ebc972843b8a4439c42dcda327df8f5b85b0a9f853b2b16205", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775288005, "uuid": "6bfcc6e0-7811-44a3-9063-775a36630c5c", "value": "T11C630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775288005, "uuid": "1fd99365-b1df-4672-a524-61ca81875dcc", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775288005, "uuid": "0832b6b4-703d-40d9-9c13-c65757024783", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775288005, "uuid": "674aa081-5058-4bac-82b2-7aeb8bb36088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775288005, "uuid": "fec368f4-56fd-44f3-81d1-989f5f2bda1f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15761433-2ffa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775288657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775288657, "uuid": "9285c2d1-3b16-4e7b-a224-d7749109cd55", "comment": "Malware payload (Mirai)", "value": "da2cd343bf6815128a0fadfcfb940a43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775288657, "uuid": "318d5672-bf22-4f3c-9f1b-d9c49260a66d", "comment": "Malware payload (Mirai)", "value": "5ca5f11f6f388258c42826f4a876f7976d8000d8d06b11e40df4ef067d420a2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775288657, "uuid": "980f35ad-1b97-4dde-be5b-5281b7ccfbe6", "comment": "Malware payload (Mirai)", "value": "55a67ab87be31d48a2c2a0573abbb25ba5382239", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775288657, "uuid": "0450d943-1637-41e5-bfa7-47aece6863b2", "comment": "Malware payload (Mirai)", "value": "dd26b0a8939a3af239c330604c2be86c8c815d5d0e4e20ae9411d23864d6134a7cbc45cf5c3bfdea80b4e90078aae285", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775288657, "uuid": "bbd916aa-3e64-4546-9291-49f795707477", "value": "T17FB309527D429F13C5C221F6FBAF46493B136BBCD6EA7102ED247F91278B8DA0E26501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775288657, "uuid": "3c6cb252-b96d-4895-bbef-9847020bac7a", "value": "3072:guFtPIGVDuhSXqnredxfk/XHvT9sKQbffi:gW1IGVChUq6dxfk/PRsrbff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775288657, "uuid": "ef55f3df-36b8-4394-97e6-edf41850423b", "value": 112524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775288657, "uuid": "fa7e235b-c267-446e-8dd7-21fb7ec291a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775288657, "uuid": "25c26336-b290-4822-885b-ae3dd6011b9e", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580e5377-3003-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775292634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775292634, "uuid": "e37896d1-71be-409d-ad38-7c79f1be446b", "comment": "Malware payload (ValleyRAT)", "value": "32c1ea0f9475409ed8eea000bee1e8a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775292634, "uuid": "60a367e1-2bfc-4f79-b191-ebeb40db6f13", "comment": "Malware payload (ValleyRAT)", "value": "5ea579e8fa695b2312ed199ff228784e4be3a8f3319afa18c40955f926336057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775292634, "uuid": "fb348a9b-1a53-4219-9325-0ba58d02f23b", "comment": "Malware payload (ValleyRAT)", "value": "efb7c3bdd5b647ff5dd401de24a7721b7c1c7898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775292634, "uuid": "b5e315c7-dffe-46cb-b2c0-9471f6044035", "comment": "Malware payload (ValleyRAT)", "value": "0d07a6f50065b5e5dec0ce4a51d58f7ca291be4e6f6f6ff8916015db0fa282b81196b642c281595966bf97398112bf28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775292634, "uuid": "4114c433-bb7e-445b-bd52-6d76cd3fe6ad", "value": "T161D533B817C4C055E872583B4DE1C6939CE9B53E8071094773D027DC3CBA79A8BEAE96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775292634, "uuid": "f5f427c4-867a-4d62-bee5-851e2c324878", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775292634, "uuid": "4cd46f09-40fc-407d-916f-5c2d0d67c630", "value": "49152:cIEncbQ23PfohrxKobbW8IWHVtcakqQ66+syDITuTGpvlz7VQWs5o:cIEnYQ23nohrUkb9IWWvfWITQGpvlzKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775292634, "uuid": "efd8e539-df2b-46be-9636-df9a9e807407", "value": 2994628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775292634, "uuid": "81458d7f-1937-4592-8294-c0c0c08d1b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775292634, "uuid": "e01b7f69-dae0-4b98-9316-f55eb7ecf18e", "value": "32C1EA0F9475409ED8EEA000BEE1E8A8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc242c8-306e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775338491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775338491, "uuid": "76a309c6-1af5-476e-abc7-e7a79f135224", "comment": "Malware payload (Mirai)", "value": "28f3be0b291a4cf7bd448765bd2d8327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775338491, "uuid": "e8e83d0b-98d4-4e5e-892f-a35c2244251e", "comment": "Malware payload (Mirai)", "value": "5ee560d056ca8523e4994dec9b401d8d8aab0cb112d36af2453c9ea93a0e62cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775338491, "uuid": "cebfc726-5e6d-479a-a72b-54b9ab8405d7", "comment": "Malware payload (Mirai)", "value": "f1de7605495470b8447ff0bb7d677d22b88a2c58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775338491, "uuid": "894da931-b40b-4049-88bf-ac01d1fd8a02", "comment": "Malware payload (Mirai)", "value": "dbecd1ffba263fdf7d6c6dfe88c3b3a25ce75969f611122104d0dab8ac6ec9076f767f8eae2f9f997ce1745b85ada06a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775338491, "uuid": "dd9ba192-08c4-4ff9-9d2d-b7b6452a3fcb", "value": "T192635B0177984A03C16659F4393F13D583BBEE9222F4B788290F9B5A81B4E772459FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775338491, "uuid": "97620f0f-4da7-45ba-8a0f-07d44b2b1b94", "value": "1536:Yy34J/eHqY7w130Qnewf3e3Jz7M2Y+FMdKacz955++kZA6WuFTVE:p34J/eHqY7CLGMX7Z4553sF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775338491, "uuid": "fe7e4caa-d51e-4e71-8a66-5194a8f53568", "value": 71276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775338491, "uuid": "d53cf0d4-c7ca-4bbc-a49c-4fda8acc60fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775338491, "uuid": "d61dedaa-8af5-4902-8c7e-16ac25767729", "value": "mao.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38df3368-3079-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775343262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343262, "uuid": "1eb1119d-518c-4b04-8d5d-540f1d4d757e", "comment": "Malware payload", "value": "910e70f3e9f395b11f8b3bec2d45d570", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343262, "uuid": "f3f2d23e-1388-497e-8224-a216616d646b", "comment": "Malware payload", "value": "5f9a1a139e012aceddac845ea21a78c65144883de8b54ce37460134256ba4051", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343262, "uuid": "9bb3f8e3-cfd7-4eaf-95f2-bf023df0b0e6", "comment": "Malware payload", "value": "4964bac18b84438effb9a2fdf9906943a8ac8907", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343262, "uuid": "f0abea2e-b18b-46ed-a6fa-abecde088c65", "comment": "Malware payload", "value": "042ac8f52ddf8ccd020f0275f634f7908c63110c48286282ef74b7a000f38a8c0a14c513bb84dd785f7ae31b52732176", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343262, "uuid": "fa971a40-552c-43cb-b2e1-fb86f34fd9fa", "value": "T1FCF6BE62719950A4E0F7C1BA96F75F17C7B27C0403359AC71281B9DE0E77BE24ABA603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343262, "uuid": "46283f40-4c2c-4a68-a620-ecd476c0bfa6", "value": "b2a93297c823b89942d5a78509c4f6e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343262, "uuid": "8034d9fd-c475-462a-92fe-6f0b874085dc", "value": "196608:a3/RC9AQ7Wli87BsScUhxVYodwS6BuCFGyM5mpl5JG:C/EJ7Wg8SU7dwS6BuXyuyla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343262, "uuid": "7c078ce4-8a35-4a9c-b54d-7e24578899f4", "value": 16006344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343262, "uuid": "378409aa-04f3-491c-928c-e4c1ab8ad7b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343262, "uuid": "746940d0-7ec0-432e-a8a2-20a2f7f95fde", "value": "python36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08d8ee2-3047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775322042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322042, "uuid": "e65c9452-3092-4538-9103-448839d43636", "comment": "Malware payload", "value": "8a744478809b2960045b55979a114f4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322042, "uuid": "73994cc7-0a96-4025-a2f8-455142610171", "comment": "Malware payload", "value": "645dd2e41f0da6aacd9f94dd65facb8297621606bdf224e37605213533d9d298", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322042, "uuid": "fa53f03a-61f4-4dc7-bfbe-2a8d0f3d1f38", "comment": "Malware payload", "value": "3c5927a5e0ef9e12b890d8a756a1f49c40b8cdc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322042, "uuid": "892e366c-2503-45fc-9748-71e65ffa2062", "comment": "Malware payload", "value": "7ecd4002fefcd652d4aad5c027882d2e769d57c645ea9700c22a08baddf835d94c29099db73055e516fa5f1277b91871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322042, "uuid": "63567846-90d3-47cf-a01c-12c0b128bbbf", "value": "T1AAB67C73905324D8E1A889B4D51416527DBC3C8B5738A3C7BAC471F66BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322042, "uuid": "6932e186-bede-42e2-a823-43a27a2a7fdc", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQB:cqYUQuVDt0TZEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322042, "uuid": "9824f74c-bbdd-4fa5-b6fc-82d502878560", "value": 10551296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322042, "uuid": "83461fb5-afa6-4d86-8fa5-601d0ab76c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322042, "uuid": "189a3987-64de-4f91-9e05-9b73eb19706f", "value": "645dd2e41f0da6aacd9f94dd65facb8297621606bdf224e37605213533d9d298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7922c6a-2ff5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775286755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286755, "uuid": "e77a1412-76eb-450d-b6cb-a37985696d23", "comment": "Malware payload (Mirai)", "value": "90b5c65aefb840a10e7cae30297f34f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286755, "uuid": "f5cb5b8f-db71-4b86-a568-427b06330b66", "comment": "Malware payload (Mirai)", "value": "649bea12759a8794de9b8e3992f09cfb21c9b86ef071fc29825c5a530378f705", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286755, "uuid": "74fa19db-ed4f-49b9-953b-08c5eed883a2", "comment": "Malware payload (Mirai)", "value": "7bfdbb1ce0c6ab1101adfd2f436cdcce592cd299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286755, "uuid": "e89487f4-2b6a-4fd1-9629-bd1ea9fb45a6", "comment": "Malware payload (Mirai)", "value": "d3b10b9bfdb4f209db3cb442270112b1b159ee15975e78022c4b1b55e6adffe81cbf1cbd127c3cdfae54bf8a4bcffa58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286755, "uuid": "82fd5a20-58d9-4fd7-a4c6-a573be964311", "value": "T164230271890A8EF124303C76DAD5E393B5E029B2C6673113D6290A3C3FA5B131E5BF4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286755, "uuid": "cf2d6e09-3c82-4ae7-af7f-5c1588be8a9b", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3i9q3UELbUXfi6nVMQHI4vcGpvy:DECFd+A6YHAxXLRQZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775286755, "uuid": "ed3f17d4-0712-4644-8960-320257e0681c", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775286755, "uuid": "85be3349-1f2e-4532-a8cd-7e1a40fd6d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286755, "uuid": "1d25e90b-186f-40cb-a111-fde5360e4555", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1690c170-3074-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775341057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775341057, "uuid": "860cbc30-220f-434b-9518-ac40c43210e4", "comment": "Malware payload (Mirai)", "value": "777118aabfc6acb47841edf2bf55d1b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775341057, "uuid": "476c63d0-485b-4c86-9330-0bbee742a382", "comment": "Malware payload (Mirai)", "value": "65c071651912721813fb80153a9a662de6212aedb6a120d8a2275d2092347aa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775341057, "uuid": "b0dc814a-4959-401f-be3b-4073004e551d", "comment": "Malware payload (Mirai)", "value": "91b5f9908f2ae809ec0d445a84aade70f28f11ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775341057, "uuid": "131b91fa-fd83-487d-89f8-a138d6bb13d7", "comment": "Malware payload (Mirai)", "value": "49c0d32f2104b7adb8a9a15d185d79b83de64f4f99ebe693f197f8eda2ef0aeda97608a4fd72907215420a757955d93e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775341057, "uuid": "0339a83d-08c6-4be8-967a-266a188f07a5", "value": "T1D6A3A509BFA01EB3DCAFCC3709A91B4524DD692B20693FB5B930D824B14B64F65D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775341057, "uuid": "fcb3c928-4d06-471a-b91d-f91268cbd670", "value": "1536:tFJqNVmQaMwpnErfEbif38U+WwCmAZ27EF7QuIZA6WEF37Mi:tFM/alnMGAnZKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775341057, "uuid": "8c55c1d4-8530-44a8-bed2-cb75bdf1db27", "value": 99168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775341057, "uuid": "d7b1da88-9183-443f-841e-35a670e628ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775341057, "uuid": "0025dde7-e684-47d1-b4ee-623a4ab4ccbe", "value": "mao.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93458f59-2fcc-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775269111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269111, "uuid": "75a01b00-75b3-4d0d-b129-21fdea594b1f", "comment": "Malware payload (LummaStealer)", "value": "4f5e638e302bfeae89b1293da04557e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269111, "uuid": "bb214d3f-8ae5-4204-83f8-5b21379c379a", "comment": "Malware payload (LummaStealer)", "value": "65cf85118c69198cdd7c9f6b7bdb58bb8f1ed9cc09834dd687c0e70bf53c8723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269111, "uuid": "5f5607c6-ca36-4158-a1b0-9de42f936c69", "comment": "Malware payload (LummaStealer)", "value": "9a4ae45b3ba19e367563d9a20117f51d226c8e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269111, "uuid": "d2fcf4fc-69e5-42ff-a157-9466b8cd8d75", "comment": "Malware payload (LummaStealer)", "value": "fcc92b779f4554c72a09529084ab0052282510f87ce17e4ba0eba4e4ea526168a629630208777172732b9952242a6621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269111, "uuid": "08cdfd05-a646-4dd3-9d94-9b7c31a5652e", "value": "T159E53AA2B546E2CFD49B1BB48427DD97691D03F94F1148D3DCA8A47A7EA3CC112F9C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269111, "uuid": "6787eb6d-9934-46a8-a3e0-4716f6deb013", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269111, "uuid": "5d96a706-012d-4170-b960-8c1b0f282980", "value": "49152:GAdB7X+BKQGguHAqm1zQZBi1YeeiXhXjuoZQ:GAP7X+QQGgaAGByRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775269111, "uuid": "4dfdeabc-269d-4209-9c82-97187de26413", "value": 3187200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775269111, "uuid": "fb0a310a-22b6-4ec4-826d-5361e7365952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269111, "uuid": "74289892-299f-4fb9-a361-1cc08969b483", "value": "65cf85118c69198cdd7c9f6b7bdb58bb8f1ed9cc09834dd687c0e70bf53c8723.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4b4af3-3008-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775294653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775294653, "uuid": "932cbf5e-bfc2-4c86-899c-70b8526299f7", "comment": "Malware payload", "value": "4a446026475520a5680709c28f5ae8dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775294653, "uuid": "7f02bf63-e0e2-46d0-ab44-6ecaf9e9def2", "comment": "Malware payload", "value": "666d68f41268d80387a85b637d4ce7366728ebe0a35cf7ce12c67ee61a1b7981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775294653, "uuid": "015663b2-d896-4e91-b72a-98889535372f", "comment": "Malware payload", "value": "74a64bc9f24fc789d424b769001b5f9abe6f13a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775294653, "uuid": "52b588d6-d6ff-4a0d-b8cf-fbf0f2bd8d33", "comment": "Malware payload", "value": "84e1bd6d1d900afd6a76b9749a0d29813ff2d79cd9c1304985fb0eb8faf96ccce08014a5b357a52692a89df29084402b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775294653, "uuid": "2ab05010-ccff-495c-a46c-e4e53496e83c", "value": "T136E6332BB298A53DD4AA27325573901018FFB6ADF516BE1566F0C88DCF361C00E3E766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775294653, "uuid": "6aabd0dc-d913-4ad8-9a86-271bc8a99dae", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775294653, "uuid": "e597fc3a-bc9e-4a93-a469-faddf806a6dc", "value": "393216:eRvv5l6QgpcgsUCUJdF2Jy69Vb66cGZ2CN+5ck:KH5l6YkKJj6x8lc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775294653, "uuid": "ea04d1a4-6887-4192-adb8-c15593e3ce38", "value": 14956048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775294653, "uuid": "283c0217-9fc8-4ec4-9e5b-e3a6d14e04d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775294653, "uuid": "8faaa52b-1339-45dc-b012-d0a969c3cca2", "value": "SecuriteInfo.com.Adware.Downware.20655.1805.30378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5688938-3045-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775321164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321164, "uuid": "27642db8-d6fb-48d3-a7ca-baa5b440f790", "comment": "Malware payload", "value": "a8b9faa0c5caa4a7193dfd1801b88fc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321164, "uuid": "bf8de489-f009-4c2b-b55f-852cc46b31b6", "comment": "Malware payload", "value": "67114b42f4590b462d185c96bef65cccac34659e6d95b47315be464bcabc5187", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321164, "uuid": "d4543ded-0c3c-4637-b041-4bc58bb2db97", "comment": "Malware payload", "value": "61b588c5b54faca3db112ed0015752ae2c9a07c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321164, "uuid": "54861a76-3383-43ce-96c0-e5f371d866be", "comment": "Malware payload", "value": "cd4016a1f3c4d760631601c617e258b4cd0c7e87361a95ddc4096ba27a2a58162096c7c680bb209430e5ec7385045e34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321164, "uuid": "6032ee08-0578-4563-9714-739df38d6ef1", "value": "T1EA165C90F708D23AE98B0A3249670F7473502E46D6F4896F430AF75F06B16E69A1FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321164, "uuid": "8bb5e5f1-cf9c-4b93-b7a4-deaff9fe79cf", "value": "49152:JszbPl7gwCItWGrbcTweZSgU7YDVFSrtbcoX4RNxSVE:eXPl7gFItW0naacoIRNxqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775321164, "uuid": "4d5581e1-b618-433d-9b68-465a02b83928", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775321164, "uuid": "bc3894ab-acef-4e94-8d24-196a26dd6fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321164, "uuid": "0fd2420f-4809-42a8-a73e-7e69afe2d02f", "value": "linux_ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820f7297-2fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775271659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775271659, "uuid": "eb13269b-9731-41bf-9409-c65edb876799", "comment": "Malware payload (Mirai)", "value": "ddaf5d110ebfcc230d2a215cecdde0cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775271659, "uuid": "77ba80aa-c2a5-4d5a-8634-4f6cd5fa53f2", "comment": "Malware payload (Mirai)", "value": "69580e576e8b29dccb7ed5b32926a153ec7bd84939d6d1bcf57c21d3b4ec6dea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775271659, "uuid": "01cbf031-08a2-402b-81af-f98d26b93b04", "comment": "Malware payload (Mirai)", "value": "8e1bc319a16f4a5d5676f172b36f56a8db86e82b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775271659, "uuid": "1b21e645-63d2-4537-a937-4b7c8bf7b575", "comment": "Malware payload (Mirai)", "value": "3bffa19408513125c3769befd797d6675f6126b30d0a23030d8fcad180e2cd3e01517e352286d86e1f5b81d94f1e64f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775271659, "uuid": "13ae5dac-3ab9-4522-ab05-f5980bd9c66b", "value": "T16693D606FB650FFBDC6FCD3706A9070625CC550A22B97B3A3574C928B55B60B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775271659, "uuid": "fe1236a4-b253-4fa5-bad3-86e54ad750c0", "value": "1536:GHz/LXDiF1dFw+0FmAqWvhfxFAqjItWd5RyBmZiY6m2B9HglmuCSAaf:X3Q+0FJVMW8BmijiCS3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775271659, "uuid": "5874074a-3ba8-435e-a661-07a4070f92d5", "value": 93316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775271659, "uuid": "a0f1ce3e-f31a-4386-b9ee-f1143f81997a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775271659, "uuid": "c9abf6ad-13ff-4951-a219-5431a80631d9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9eadd6-3047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775321985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321985, "uuid": "865e8499-4d35-4feb-94ed-745838b5bd2a", "comment": "Malware payload", "value": "ce57af9dd1804eb766c95e31423e60fa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321985, "uuid": "9f0e20b3-e01c-49c8-a20c-30d1a1b4da87", "comment": "Malware payload", "value": "6bfcf6860490b0952ee283f22b0f5cb536a48a6e3d8676b2596e68651929fed2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321985, "uuid": "8150aa3f-13f6-4dd9-b6c1-f812e285ce5f", "comment": "Malware payload", "value": "956184d31f475d077c1d3287d4bf14111e064b1c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321985, "uuid": "529813cd-da4b-4a6a-9b6e-27633dde8181", "comment": "Malware payload", "value": "ef71ceb037cd0041d124aa105a1319dfb2482c89dd7d60078ac6cf5f7e9393fe63e455befbc59566329f553b098d6628", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321985, "uuid": "9349d8c0-8e24-4423-85c2-6d78f9ab9ecc", "value": "T1A44176E57C5058B86ACBC9304AB65432E02311277E02346C70BFE01C7B7AD55B1BDDB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321985, "uuid": "1fe5fbeb-ff2f-4bdf-8a50-4c1bbbb1a231", "value": "48:LnWQ7xBAjHeD2z4wV6vlId/IkKj4Q1d48OcKQZJnVILSwTph:jWQdBA7LsxNCwzjrS8E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775321985, "uuid": "17a671c4-691a-4a53-a984-4799141476ff", "value": 2310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775321985, "uuid": "e55dc9cf-6dd0-4c8a-910c-214a0231c4e4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321985, "uuid": "f35cdb9b-bb30-48ac-b971-8ba1f3cb95eb", "value": "get1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ae3991-3073-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775340707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340707, "uuid": "ca19b607-87c0-40ad-9f51-7ad904141e77", "comment": "Malware payload (Mirai)", "value": "56327a4c39eac023863f4f7fabbff116", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340707, "uuid": "b48745da-9ec3-4f1a-a590-18b84763eac9", "comment": "Malware payload (Mirai)", "value": "6eeb60e728d5f48609de671f8bc6f1498674422eb571b8e53b5fd1172c79301e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340707, "uuid": "45e45e7b-b1ff-4457-a343-e6a0c238f24f", "comment": "Malware payload (Mirai)", "value": "e8e32a4951d2ae66b9589bf3a4866006e7ca1d8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340707, "uuid": "81bef383-8d4d-4b21-b60c-f6f3336b32a5", "comment": "Malware payload (Mirai)", "value": "6bb3cf99eb85499845ad300bf15c284494d0111f5e64320c7be6ea4f46e4426901adcb733f83bf29ac4ae33e995c9fb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340707, "uuid": "c831de2b-ac9d-4635-8919-66d9087ca90d", "value": "T1E1634C96F8009D7DF80FD6FA41124A0EF42162455B030F27FBA7FD936EA20A95E67D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340707, "uuid": "6a8e11c5-f2c1-47b2-8307-126e6467a854", "value": "1536:td8Q1gvC8MVfB/qCDcxSihNBCXoZE+8Ex6qtCGW6lZgdJd:td8Q1wN4JyCDcxJ+Lr6Hgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775340707, "uuid": "931db009-d53d-4a5f-ae9c-3b5098af2d71", "value": 72820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775340707, "uuid": "06521bb3-2845-44c7-8a9c-1a8fd71719c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340707, "uuid": "f528730d-59ac-4ef7-9dc4-839a93b1e20d", "value": "mao.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f4df04-3072-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775340365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340365, "uuid": "7164481d-8576-4e7d-992c-6c7cbd6e07a4", "comment": "Malware payload (Mirai)", "value": "4daaf9a485578022665585938d7cb1ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340365, "uuid": "275af1de-44ec-4dfe-85d6-470445ceb73b", "comment": "Malware payload (Mirai)", "value": "6f696ecf545ba18eb0f4ae12413a36371a1c2eeb7ff83a638909869804450642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340365, "uuid": "81c1b2ef-7221-4058-b85a-64e7e1681171", "comment": "Malware payload (Mirai)", "value": "855a10298f9096a334c45d49ce2c3087c7962910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340365, "uuid": "ca8aaa31-6002-40e0-b255-0a653e7f2c42", "comment": "Malware payload (Mirai)", "value": "d610532c2eb05cc8b2c05828a9bd980877df8b89da58b1f1f2448018b12e80cd76efc2492010082584b39c8259c90757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340365, "uuid": "f102230e-a04e-4167-b0a2-05ad04af3a62", "value": "T1DB633B0BBE4480FDC155E178837BB139D437B4BD1139B6AA2BD8FE261C46E612E1D868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340365, "uuid": "b4b0f185-3449-4c6a-b5bb-4682d3aafffc", "value": "1536:eYAPXmylmqMosFggIMsAemoa++mzzULjqOqhmwb/tkhzYua8Ljb:e2qLMobksAkPbxhlrtkhzHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775340365, "uuid": "f20c4c21-741b-4137-9e73-f52e9c27ac84", "value": 72368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775340365, "uuid": "80ecfcb8-affa-4be0-a85b-de6a08a98822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340365, "uuid": "73668995-1154-4de5-9bb0-ce78e8eea52a", "value": "mao.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6674c9c2-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274190, "uuid": "1c234d72-3332-4f31-ab4e-88ba9f507f0c", "comment": "Malware payload (Mirai)", "value": "c01e2f72b989cd99325fcac78676b671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274190, "uuid": "ccaaa916-c89a-442a-87da-ab5755d26c17", "comment": "Malware payload (Mirai)", "value": "6f6c2d0dd6125510c627812d285b20107ce71c2d76e034fb3b09b27fbd53e142", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274190, "uuid": "53a3dfa2-50ae-4cb8-9c43-76a492ef15a3", "comment": "Malware payload (Mirai)", "value": "e8916617d1dba40176adae53d099e900f5ed5187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274190, "uuid": "18ec7588-0a3e-4260-a5cc-733cc0168df4", "comment": "Malware payload (Mirai)", "value": "bfda4228f3f920d755cce7fa7b254767190c19e34e0ed0de2ff34f3d03b4824fa94b59487e4bbea168a0a5988576e0dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274190, "uuid": "e7785771-6263-4bc0-a9bb-a2e6a0cae030", "value": "T127F2E1A577921036D39075BDE9BE0681372B92E9A2C8201131B8CF6D35C6EB671FC886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274190, "uuid": "691048f8-c2b6-42cd-bf62-ec8e04d96705", "value": "768:0V7kUiJS0dfoTJitHqBPCN18HinoHceklMUyI7da49q3UELQj:0VIUH0dWiJN18HkekOUyI7OLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274190, "uuid": "63e191e8-2a14-47e2-bd84-2f8c83df816d", "value": 35344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274190, "uuid": "1ae0108f-f4de-4ffb-bf3c-84aba8491a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274190, "uuid": "73c9a691-1f91-4e47-aebf-94d84e7924cc", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fb6f37-3078-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775342905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342905, "uuid": "14822fab-d9b1-4a5a-b296-c6fe939e525f", "comment": "Malware payload (ACRStealer)", "value": "36609b034c4d0374b3c3c526ce77fcfc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342905, "uuid": "12962824-3a13-4a09-ae77-817762406123", "comment": "Malware payload (ACRStealer)", "value": "72877aef417ddfa012fdae01c66b3ce0962c5e1d98ff970bc3d82a814bd28366", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342905, "uuid": "433a60c6-556f-404d-9642-21aaafb5bef9", "comment": "Malware payload (ACRStealer)", "value": "bdf2b75b97441a6861c2ea1e1c69e900de416adc", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342905, "uuid": "7be36bb3-f267-4719-a807-ee533575f967", "comment": "Malware payload (ACRStealer)", "value": "728d02e0685f35bebef442bd107a495ac792b73b4dfae92b108b2c97abd360a1dbf8c86d364086adf9b2e52a448d3390", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342905, "uuid": "de4ad954-3d93-4f48-bc83-6e53c6b3e4c0", "value": "T185073396B7CC4A7CDE5A6C3D8CE2FD095B2A5806B49609F7E54DC1EA893331306EDD10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342905, "uuid": "da4659b6-918a-4d93-beb1-ac3687656f0c", "value": "393216:kUdvXpjK83HTmB4hwBiL3JE8Y0yoaZE54gih9h8A:kcXpX3TmB4h+0DaZwXinqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775342905, "uuid": "d1b331b3-119c-4a50-b242-4e41f870c00d", "value": 17816012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775342905, "uuid": "8279a8f8-133f-4f11-a02d-556ddbbbd5a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342905, "uuid": "2a08ba57-fde1-46ce-b7ad-66b03662cf18", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45662c2e-3005-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775293462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293462, "uuid": "3a44a4a8-284b-4c34-9c2f-e92241ec42bf", "comment": "Malware payload (Mirai)", "value": "136a08b1cea1f3d54415558e84d91e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293462, "uuid": "b2495bce-cb56-486b-b484-2f4619b5d419", "comment": "Malware payload (Mirai)", "value": "72fcbdbe9fc821d7edb508ca0629e9534a2cfd10377042857f22ef7c87f1fa0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293462, "uuid": "67c0b0a1-4205-4c67-8a45-55035a92bc4f", "comment": "Malware payload (Mirai)", "value": "b3ca9e1d7235296c52b750e2577686cd50d360ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293462, "uuid": "b120d831-b2ec-4909-9315-e41cab59a842", "comment": "Malware payload (Mirai)", "value": "0132a241f31a3418f3496e5b2e138ae6a89b1672662e01611723743600043cf5a203028be0eabb51321c325b826e3147", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293462, "uuid": "f8b0edac-c548-4c36-9352-9297e41b7812", "value": "T1A4C43959A8419791D1C02BBBFF1D934873131B38E3EEB106AD196F646BABC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293462, "uuid": "9f99c457-e837-4cb3-b5d8-b922fb2a45b3", "value": "12288:N95R6+0iH69TbHCxY4SvpE7KcRIVn0IXMfLknOXGmUaB2mnGZ9J0SCghW4Z:j6FiHabHCQqYVn03kntIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775293462, "uuid": "46678909-34d3-4077-b22f-b4dddc4ef722", "value": 560400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775293462, "uuid": "49f8aa82-c5c6-4ee7-a675-9a7691cfc66a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293462, "uuid": "146b4cd6-2a05-4efc-9e79-0c9417d8cfde", "value": "a9349d10.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0a09bd-2ff3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775285851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775285851, "uuid": "81bc556b-cf9c-4899-889f-6b4635a843d0", "comment": "Malware payload (Mirai)", "value": "f896eb423d1f20d0b36143bdc9633c41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775285851, "uuid": "7fe14195-abeb-4c91-ab2c-3de1517bbe9c", "comment": "Malware payload (Mirai)", "value": "73d62b475534c08e67fd1b4c8f05ab3fd64114260cb7b9924c091b48a0bcfa2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775285851, "uuid": "f1860460-0613-4396-92a2-8cf70fc5253b", "comment": "Malware payload (Mirai)", "value": "980e494285d3d56338cdc7a529e61e793905c115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775285851, "uuid": "fb705083-d1e5-4c64-8649-92621e9fd4cb", "comment": "Malware payload (Mirai)", "value": "ee30e06bbd8f76002e55526cca2b985db5c59ce7ad10447bc7952827fd51573aedd83510ca3cad851f7c833acf6bad9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775285851, "uuid": "ae79e8cb-b591-419b-932b-e6e0776da249", "value": "T15B157C9DE786E4E1F12300F1025FD7F71534A12A9013FAF6EF8A266274327A16F5621E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775285851, "uuid": "fa70f35d-32ec-41dd-bee2-757db761b584", "value": "12288:rOEM0ANU6+/Qhd3hNmkjMkEOUPu/+EN46iBD+MM06WORKSPyt/rgR9e18Lu:yE1AN7+Yhd3hokFUM+ENfMqMM/8t8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775285851, "uuid": "af487351-3f2f-4c3c-91e5-caa3b55eea39", "value": 926968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775285851, "uuid": "a98574cb-98af-48a3-94bd-358cfb874d92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775285851, "uuid": "1d0814c9-9160-47b7-84a2-98800e204ac7", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2683b66-3076-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775342205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342205, "uuid": "167b047a-1f3f-4f6e-80e1-006f956fef17", "comment": "Malware payload (Mirai)", "value": "c2b72339982da9362b5b9de0f12a30c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342205, "uuid": "d5219e00-e556-4331-9922-3a5c4f892dd4", "comment": "Malware payload (Mirai)", "value": "73d6959881e86abde6fa3398f8377edc906892297e836d501b01e9e51e5e2131", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342205, "uuid": "c587b388-d02e-4dd1-aecc-9cf06e1d78cc", "comment": "Malware payload (Mirai)", "value": "e6f3c9b5930f6813ebbee721ee632af6577df4c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342205, "uuid": "40931353-6c86-4ed3-a149-aae598d6a878", "comment": "Malware payload (Mirai)", "value": "e09879e81dc88854d25a0f69bfad3ee8ed3a808b38b6c92b296a770c8be99fede001fcec0586d765ed3bafdff0e60772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342205, "uuid": "eac7322a-ceb6-4523-bd82-de302a753f7d", "value": "T1BD732983FC81A603EAD01376BA1E519D33257399E2DE7203AE126F107ACAD5F0D7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342205, "uuid": "cb6207e7-dbb2-44df-8073-08d2eac3573c", "value": "1536:Jl9u2pf2dCjlHxHuhJV2hC2sAQQOjYRBepRZA6WZFxJ:Jl97pxMhL22ApOcRBeyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775342205, "uuid": "ea8a07b0-d3e0-4931-beee-76fc97a32eda", "value": 75272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775342205, "uuid": "1b115f46-1830-4bed-85e0-d60b4c6c06b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342205, "uuid": "44b39b8c-19b0-4adb-b4c0-390a1dfa04de", "value": "mao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0b74a2-3047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775321982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321982, "uuid": "7f946e64-4c41-4db1-bf8e-89cd9471fd56", "comment": "Malware payload", "value": "0878d079f7b00cc9f604d68ab010ec8e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321982, "uuid": "61f253b1-e856-4f20-94fa-cee22edf8409", "comment": "Malware payload", "value": "76447a4f69bb57266c1fc004b08cf69ade02d0b8db73a4e3d903b9d72732f7ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321982, "uuid": "6eac4475-89f2-4221-a1e3-8d9b50cc0857", "comment": "Malware payload", "value": "23a1e2307d21dcaa6b58a3ca3acee7d533a24532", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321982, "uuid": "00bcbfc6-5e92-41fe-8de4-4bce1ca43e57", "comment": "Malware payload", "value": "2331577d2a09a5402b818d4d076c34c474a52f4ccc8ac054db576f9d2b660bd704c3a9403d4550c870b12ba497d9a3ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321982, "uuid": "c79a7619-26af-4040-9702-cc9f58c81afd", "value": "T1625173F27CA198B4774BCA22867A9121F033254B7E03352C74A2745D92FDA5A923ED37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321982, "uuid": "6cf9dc6d-fc98-491f-94ab-e41ce7d79d11", "value": "48:CD+ZTiyAFcnWQqp/8yiAkKS3e1dZ8+KZ5tHy+I7SwTNAt84Mcgpjh:rTiy60WQShhz5KYKt8b7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775321982, "uuid": "3311265a-536d-4ad1-9a4f-a2ceeec7b39b", "value": 2509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775321982, "uuid": "13ea2852-a888-4229-b365-8090c9950d5c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321982, "uuid": "147512c1-f96c-4c52-ae3d-f817f191b215", "value": "get.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5447ef-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330058, "uuid": "4994f50b-db96-419c-be9e-2c95f9f8738d", "comment": "Malware payload", "value": "71d34b6f0b0ec85692a33e9a7d3d0b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330058, "uuid": "eef24a24-8c45-49ec-aa32-8f8a8e288efa", "comment": "Malware payload", "value": "76dece1465d0598b533b29e3da7cc8531f48e1b15dc547896cda4650171d3d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330058, "uuid": "e2619a10-b95c-40df-b52f-216b19c791b7", "comment": "Malware payload", "value": "63838a84cea45868ff89c3190046bc2a77b5eedc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330058, "uuid": "b92a5d34-385d-466b-b634-e4e2d62d0493", "comment": "Malware payload", "value": "dea9c50156d5405ea259962e4dcbdd64a7c05882e419bab5da0e14e9fd7e17de56765b0a3c13a57340a30ac98b683ed0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330058, "uuid": "56925784-d31f-4e6c-ad7d-c69816875933", "value": "T1C9341241F6C361A2E51303750652E7EFF2B9EB345090FB2FE3546E769EE0680918DA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330058, "uuid": "3fb9d0e8-99fe-466e-bc12-3b33a70bca58", "value": "6144:bw0leKLh+EPq8OuTS0URjHF1qHO288X4tD6A6XUSw:bw0le6hniJQS0Wl1qu2lXV5USw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330058, "uuid": "11cb7909-767e-4e23-8159-4384ed98670e", "value": 247000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330058, "uuid": "0013523a-4197-4df1-8b6a-2f86799402b9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330058, "uuid": "c7580879-99fa-48bf-a181-e178e4a5585f", "value": "aygbsqq0c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6e0506-301a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302604, "uuid": "439f82bf-a116-45ac-81ae-9252d79b3a58", "comment": "Malware payload", "value": "c7d1f2b135a7e4b1688da9f8719bc44b", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302604, "uuid": "b53ce025-69f9-41b2-8825-03eea8e90cc1", "comment": "Malware payload", "value": "7b2bb2e7cf9abb562700e06bbe674966f6eca53f9715503ad9ae645872895e63", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302604, "uuid": "fd0edda5-4ef4-4f6d-a30c-cae4c44860fa", "comment": "Malware payload", "value": "5f9c662878f635cff5b1afae5f50cf09c1580e2d", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302604, "uuid": "352626f6-60df-418d-8357-e61a0c147002", "comment": "Malware payload", "value": "d4d07f7d8dbae09b1ed8fcc54a9ca9e70a2ae809a34e8131824d05c735afdd73e47014d39d734e4e00f11f011f6acd44", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302604, "uuid": "fb903bd5-72a2-4f40-b960-42adf3b5abdb", "value": "T13A646C1BE75414E9E5AB9178CE478946F7B63C524B52E78F23A0369A3F732605F2E300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302604, "uuid": "21b79e17-8b67-4f40-bb91-a9de8856f7ce", "value": "2d57fe5a14d9c21e415763d874dec9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302604, "uuid": "7576f9b4-df36-4e37-90ee-7dbbb9c162a7", "value": "6144:Doo9xIvmq0l18bO6hGt+I2WYgeWYg955/155/pzNzmddNrG7Bv2:c8xIvmq0lEZhGf2WYgeWYg955/155/x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302604, "uuid": "383f664a-3fa1-482a-8202-e44cee21a27e", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302604, "uuid": "a72999e1-8b10-457e-a886-bba511b0a209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302604, "uuid": "6c21e83d-e6b5-47ee-9199-6b95c395b89c", "value": "Nex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6f8255-307a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775343674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343674, "uuid": "eff6368b-434c-4366-8596-46f75052bfb3", "comment": "Malware payload (Mirai)", "value": "a0b3dc34e423d442c8b56c9f334866b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343674, "uuid": "d3405c89-0dc4-48dc-b990-58da5488d719", "comment": "Malware payload (Mirai)", "value": "7be1c8bc82951cc9170a14d5ff1cc26382b93a4c2251bc78989b8718cc9d4029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343674, "uuid": "953fd3ad-9a3f-48a8-a10f-b64b11e2230b", "comment": "Malware payload (Mirai)", "value": "3117004df3c0b1f6af52cb13573593dafd0577e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343674, "uuid": "9f886f86-5a91-42c8-9585-72ad899d5846", "comment": "Malware payload (Mirai)", "value": "54d97e27570c3087ffc2d4ded2d31e49b694bd29aa7fa8f78c535b375da92750c9a448961476d04bce92f63e085da282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343674, "uuid": "0a25f3bc-9315-4b05-914c-44ccf04823b1", "value": "T1A0A328751582F2ACE9B51075F80325E1265206183FEDD2E36CC766BBFEB0748716EE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343674, "uuid": "119ba91f-dd78-406f-84c5-0cdf095ac7cf", "value": "1536:5IUl8tUUBF+V6Y7EOwTJY0qVBIVCCfy0K9p9ZGAW2HA:O3tUo86Y7ERuduepg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343674, "uuid": "4af24dc8-9f83-402c-a3d0-420087542f04", "value": 100160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343674, "uuid": "c2e7764a-721f-4c19-9252-39fc85e98311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343674, "uuid": "d3cc4d9a-61af-4687-aac3-2593eb3dd5c1", "value": "mao.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91394604-3050-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775325801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775325801, "uuid": "db56aa80-7537-4190-9a7d-33404fb3dccf", "comment": "Malware payload (SalatStealer)", "value": "4063918306f52e37f20e87bcf758e94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775325801, "uuid": "0f315953-f4fe-444e-ac08-8741dedc904e", "comment": "Malware payload (SalatStealer)", "value": "7dbbb6d6db35b86cb6d0667396ad594433a2fc2bc040ba23341c300c9139353f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775325801, "uuid": "a900bb2e-376f-4802-95a6-d9daf1c12cd3", "comment": "Malware payload (SalatStealer)", "value": "8bf586492f18ae799c6d8d2656012f026716a26f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775325801, "uuid": "bb14acde-e66f-4191-9582-5a1ec16d7bcc", "comment": "Malware payload (SalatStealer)", "value": "01434fd0928efae3ed6667352d473698e023258d87e2bd0c0395104343e6447c06d266ef63382db7accad6463c360fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775325801, "uuid": "55df25cc-dad1-48e3-a8ea-5e4539257630", "value": "T1ABC65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF8776911C6A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775325801, "uuid": "6d2ecf8a-bd48-4c9c-84b4-3ed2b2606f03", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775325801, "uuid": "e923b56c-b387-48b3-b7d8-390f1d607ac2", "value": "49152:o5M7fSzjD7aQ54gg195BbxBCJ8Lsfghm6b1cum5TdNBVayquaZj34RssyIGN6QjW:b7qzFg1LNDCEsN5l2GIj4X3HX+DE9O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775325801, "uuid": "70a4ac44-2ad0-43fa-851f-50aa185ad681", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775325801, "uuid": "c5a89438-14ce-4aee-b022-33d3f958a220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775325801, "uuid": "26977c75-1ce9-4c76-a534-98cd8e525d1d", "value": "sample_unpacked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca00d26-2ff4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775286065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286065, "uuid": "df52f881-3f75-4ea9-9099-11345554e867", "comment": "Malware payload", "value": "23d65f941206c1b61e95fe03b8ec3a5e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286065, "uuid": "51b594e3-7fd4-4be0-bb0d-332694a62de3", "comment": "Malware payload", "value": "7e2b5d65f98997b5bac0ee963084e714fae6d10dda65c8a772c415c5d612ad43", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286065, "uuid": "346d5150-0577-4ace-8767-910ad3f23b8a", "comment": "Malware payload", "value": "5fdda99588e1eed6457543621e8e398dbefbc261", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286065, "uuid": "e3584a17-3047-488f-a056-a912ab7593e8", "comment": "Malware payload", "value": "07504708124cf65b094499719fb4c5ee7730039b789380c3f0be31806bf37a02883fdbff037971b88bf9c8e75d6754a0", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286065, "uuid": "d5e656b5-1a25-43ed-9b20-3f82e401dc80", "value": "T197C7BE1663A116AAD977C1388AAB6503EA73B8071330C7DF329C43752F63AE45D7B760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286065, "uuid": "5688e806-95fd-42d1-92b6-f2b025965e90", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286065, "uuid": "eb457e3b-3132-43cc-8462-7023cdef064a", "value": "393216:a/jdQ/wilbpfLWPIv1eiHg9aVLB5EVsnHxyataUTKgkggx20+t/VxVDF/xgca9B5:a5EosxTUU8XOkBKgPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775286065, "uuid": "d31cb85e-d97d-42df-87c0-2f1a6dabef6c", "value": 54475776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775286065, "uuid": "0d268a8a-20ca-485c-96c4-52cc8f4cbd30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286065, "uuid": "75137a81-eb72-4678-bbe3-07caf278d33f", "value": "Kunaria_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a543c95-3017-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775301201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301201, "uuid": "e76ebd01-92c3-4988-a719-48f4042b4c51", "comment": "Malware payload", "value": "822a9b39e0a6456b6e80928003e386c5", "object_relation": "md5", "Tag": [ { "name": "ai-agent", "colour": "#855180", "exportable": true, "hide_tag": false }, { "name": "claude-hooks", "colour": "#D478DA", "exportable": true, "hide_tag": false }, { "name": "exfiltration", "colour": "#1C6D55", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301201, "uuid": "6380efd9-b23c-49be-b77a-ca448803c52b", "comment": "Malware payload", "value": "7f2b10f2837c9c9a9b8b9f8a14f620618a019fb037ffb1681b923f0fb34104d5", "object_relation": "sha256", "Tag": [ { "name": "ai-agent", "colour": "#855180", "exportable": true, "hide_tag": false }, { "name": "claude-hooks", "colour": "#D478DA", "exportable": true, "hide_tag": false }, { "name": "exfiltration", "colour": "#1C6D55", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301201, "uuid": "90f1f373-b9e0-403e-bdb3-e8e596a97519", "comment": "Malware payload", "value": "94ce467498bd00f6fbd1357c70bccf56f791e9ec", "object_relation": "sha1", "Tag": [ { "name": "ai-agent", "colour": "#855180", "exportable": true, "hide_tag": false }, { "name": "claude-hooks", "colour": "#D478DA", "exportable": true, "hide_tag": false }, { "name": "exfiltration", "colour": "#1C6D55", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301201, "uuid": "375142f1-c761-4c89-b799-76a1718aa886", "comment": "Malware payload", "value": "bac9cafddcf1bff40fc505d7c0950aa6f003dc113d238301128d5fbc042e47afaff08c3fdfd88b4bfbde18fa8cc509c8", "object_relation": "sha3-384", "Tag": [ { "name": "ai-agent", "colour": "#855180", "exportable": true, "hide_tag": false }, { "name": "claude-hooks", "colour": "#D478DA", "exportable": true, "hide_tag": false }, { "name": "exfiltration", "colour": "#1C6D55", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301201, "uuid": "14a348f1-23d7-41d3-a3d1-8b367afd0840", "value": "T14D66330453D6ACDCB42983B87ADE37735D95530BAE80C64658B31F30AB35E3A748F968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301201, "uuid": "a68286e0-c95a-44e3-b38d-3c8e937ea28e", "value": "98304:FVQdrmK2oI6+T2s6iYMynBFGvxXRDypKHmImHOBkZSWIGqZkLC7dRLjBQQJM2cew:LQdrJ2oM2KNdveZoPJtX6LeQtuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775301201, "uuid": "5a1b3483-5ff1-4133-aeb8-21677a371a96", "value": 7046683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775301201, "uuid": "40805503-1dd2-4860-9a7f-a4af14f1959b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301201, "uuid": "29cf9c52-f6d0-4101-82dd-e47014bca1ad", "value": "npm_the_matrix_ai_premium_1.3.3.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb397ee-2fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274791, "uuid": "0e9d1107-e69a-42fc-a38c-0b398b849f92", "comment": "Malware payload (Mirai)", "value": "3ce33b5988c095798b58e994b53091e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274791, "uuid": "71cbcc97-03c1-4458-a4de-0ca0f1861a98", "comment": "Malware payload (Mirai)", "value": "80e12cd5809f22304bf15fbb85ff5e59d6d5d5aff8b052239aa9658ac64e5d3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274791, "uuid": "bb54e778-e791-429f-a855-f3b4238075f0", "comment": "Malware payload (Mirai)", "value": "5b5918b32935f8afb7934950f07bb4f4f20c5a9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274791, "uuid": "3f96dd04-2c20-4ce2-89c9-f141278daa6c", "comment": "Malware payload (Mirai)", "value": "eeeb483b0b597347a7a832b348d8fdd2a2b2b7de8f39392bda6a608ddaa623a7066f05f6a8e49ecba7d107f3de5de40c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274791, "uuid": "30cec6c0-30d6-431e-ae49-dd6089a99c98", "value": "T1B94302F64314E81F85D52837F97E8ED866D6067C04AB3A73293612855EEFC05AB3E442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274791, "uuid": "c89cba02-59b0-4bad-9f91-e9aa6489744a", "value": "1536:m72cQeaRd2fhBnbU0UXXIpz2X5MnLZz0vrYgu1zPYiDM+8c:m7weGUfhpI/czA0LZaYgu1zYK8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274791, "uuid": "92ba76cc-e109-4326-89d7-0f6d0b1e6e03", "value": 57000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274791, "uuid": "0c04e94c-ef4b-42ca-ba4e-ec47c634256e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274791, "uuid": "cd28e6ad-de07-41e4-ac92-b8467788c26c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd0e843-2fde-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775276621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276621, "uuid": "b20e0acb-732c-40ba-bbb5-a9d4a95698aa", "comment": "Malware payload (Mirai)", "value": "c51bf60076667cb81f2df0d5cb333f2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276621, "uuid": "e6d7b89b-7009-4d8e-9e6e-f954ef4b2ff3", "comment": "Malware payload (Mirai)", "value": "8120766b6b118ee6863f57d2a2f7f53752d282fd4d12d925f70b9ab74f003534", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276621, "uuid": "658433d5-9c0f-432d-9fe4-e0d019bb895a", "comment": "Malware payload (Mirai)", "value": "40f819c9ab467b393607033368e2898e5cea3aed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276621, "uuid": "093e4b72-fbb1-48f5-8303-ab9fb9213c3c", "comment": "Malware payload (Mirai)", "value": "7f2e5897e09caeb6bc9172375749708df162a0917a71a1cb77ab4f1a6aa94a84cd4f5ae93a28b9817b9737ba5f06bdc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276621, "uuid": "d97d9aca-f5ca-4888-94bf-9f149b56dc7a", "value": "T18BC32902771D0F43D1232CF02B7B1BE18B9AFEA119F4E6C4611DBEC952749B62186ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276621, "uuid": "d80e1a64-7b40-4e1d-b0e7-0650810069ac", "value": "1536:0cyeafdV/i4MbEXdKTC7ZbF8E1ixjb6ohww0b+wg+2b5BTvPRBsanGPIJ+dJak7M:0cpqdVzcybN6Cw0/gLzTsacIOF5vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775276621, "uuid": "986d5951-0ee3-4d01-8e62-2ca875476f91", "value": 120812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775276621, "uuid": "5d903ed8-06e1-40b1-9f32-ed805c8ced44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276621, "uuid": "226769ba-1778-41c1-8ee6-5a7339ccef93", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf055f4a-2fcd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775269614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269614, "uuid": "948673fd-87a0-479f-b6cc-ef7a8b2583ee", "comment": "Malware payload (Mirai)", "value": "80632c91ff3f2e923d90717928c1ff13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269614, "uuid": "48a9d692-2292-4a9c-bec0-6a4f9066b30a", "comment": "Malware payload (Mirai)", "value": "81631a4f740b8b24e45926f0b36e34aa92491f8bf6cb4ff1a3ff1ebb24ad9112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269614, "uuid": "0324bb72-4a56-4944-840a-7eb821379ea2", "comment": "Malware payload (Mirai)", "value": "29f5eeefe0c80adcf455f84823c05fc7f2f19fc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269614, "uuid": "e4e35712-18f5-4158-8a63-aca226f9c60e", "comment": "Malware payload (Mirai)", "value": "907e023a607561010493e1aadc1e569a4eccb614cc24d97d778d5f18faa5a4e5451a27fcabc69c100938f2023159e16a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269614, "uuid": "3db5033e-4084-437f-88a6-a0b51ed176e7", "value": "T181A32956F9818B21D5C112BAFA1E118E3313177CE2EE73229D146F20778B96F0E7B846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269614, "uuid": "30b9a1bb-88b0-44fc-b53c-e833e3db9e57", "value": "1536:Ncnxswlrclq3eB3DjOrY9fv2453Ywav1nJwKVXUkiey3fkIUZUT7t9YVgC:QskpkjOu+41YwavtYPkIcUTR9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775269614, "uuid": "ed226814-0b7c-4ecc-ba2c-f2d740142b80", "value": 100456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775269614, "uuid": "29f1e409-72c9-4687-86e7-de47ccdda6bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269614, "uuid": "e2bf8090-54b4-4e73-bb72-89c1a8ca723b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5725ddf-301a-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1775302777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302777, "uuid": "e93f2705-205d-449c-90fc-039c6cb9ed8c", "comment": "Malware payload (Hajime)", "value": "b5a0f760908852c4cf85dc51112f3def", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302777, "uuid": "02c0f065-3f42-464d-a6f9-8a60e86a481d", "comment": "Malware payload (Hajime)", "value": "81b00a1fa1258c7c961745a948c0e86c0361730a875d40c0f831302f719d5a5d", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302777, "uuid": "b01e6803-27e7-446b-aaeb-ad99c86fdf75", "comment": "Malware payload (Hajime)", "value": "5a5399520cdd589decd710e46466b54104b0eb9b", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302777, "uuid": "150f561a-ae78-43c6-b1e8-2a053ac89708", "comment": "Malware payload (Hajime)", "value": "7a2ea2b72c615ffb616c2436de80d1a0733a85c5b6a55bf5c2683ddffc500e480a812ccdb33a17c102d8d782b8c57a29", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302777, "uuid": "722bffba-c505-4604-9bf2-f3c9fc038820", "value": "T11B7302E017B5178C1372E8393BDD305F9124223972AA35606D87528EF957603B6B2DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302777, "uuid": "4a00f8d5-ada0-48d9-9f7d-54934dc20a70", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBP:8D+CAXFYQChaAUk5ljnQssF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302777, "uuid": "ffb3307f-6966-4205-abc1-71509f144853", "value": 77832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302777, "uuid": "b55ce12a-e44e-4f6e-b0c2-26f35085ed3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302777, "uuid": "786186d1-21b2-4049-a625-f96dcfc0646e", "value": "config", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f38a78c-305c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330898, "uuid": "c2ffc45b-f5d9-4718-abb3-fe2ef8daf270", "comment": "Malware payload", "value": "125e0fe72019e1a8c44ad73a598ba95f", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330898, "uuid": "f961d92a-5e81-4b3a-8bf6-8fe234ccc2f0", "comment": "Malware payload", "value": "81ecf0bbd62ef8602803b02d767cf2915875da82d156de57589733b58b36ad63", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330898, "uuid": "88bb3207-0355-46d5-95ac-877edc1dd6ec", "comment": "Malware payload", "value": "dd67fe17cf0b0448c432083bb3b0a456b546e95d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330898, "uuid": "2081a15f-91df-4dbb-a78d-0aaf89ebce9d", "comment": "Malware payload", "value": "6bc81f8b608fb2d9e55265eb78b43e76d4b1e0341e11c66819480bf2efd63f4282d3be3607d0461364cad00d37cb4bbd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330898, "uuid": "581a196c-dd1b-4680-adb7-82133330cb9f", "value": "T107539E0266FB8519F2B71B7049F7E1102A3DBCA65EB6C70E13143A6EBD71E909E09713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330898, "uuid": "f024d92a-5d3a-44ef-8d90-61fd27a84fd7", "value": "768:eH9JDe/WT4AZCyblQ/Bex5fgmD7uRxtMct2pVLrwqZADGepWW/R:QXe/UvPqBexreccMpSuybWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330898, "uuid": "9bff6c60-007b-4cc9-a316-99f66b1f640a", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330898, "uuid": "ba1dfa8f-2a4c-486d-9c83-50bd9ff4cfd5", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330898, "uuid": "ac6fffd9-c077-4f7c-9fdb-e9fba8d1ee83", "value": "nas.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6bfcb4-303e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775317846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317846, "uuid": "96e93cbf-2edf-453b-9fbc-feff2e3cd33d", "comment": "Malware payload", "value": "6ea35b32a313cc642792187e080d65f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317846, "uuid": "c42797d4-f9f3-40a2-a4dc-4049e646377e", "comment": "Malware payload", "value": "853b1386c9bfe386a49d3c2efea9e796885b9e93a95efe4c9cc5662faa343abe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317846, "uuid": "6bc48e7e-1902-4303-9e12-de094aaa372e", "comment": "Malware payload", "value": "c77491279dd1e2aba922e1bcdae67025df4e35e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317846, "uuid": "1cb77093-dd91-4a12-863c-0544f13f819a", "comment": "Malware payload", "value": "a5ff9d5ad02cfe05b2d8ed2befd68ed33aa4d891f83f7576d8849baf10c26cda6c02447dc040fe0e6f694298803454e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317846, "uuid": "519b8780-4f13-4848-ba7c-e416d4ea6f44", "value": "T18E162957B8924682C4E43A7ABC7E41C432A31FBD9B9B12576D09FE383BBE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317846, "uuid": "327ccdf4-ceb7-444b-a105-138e11567dcd", "value": "24576:+Lqt/Q9Y7n9qYzxntj7A5CYjZ6MCbn2pdXj1l1C+eD/hJoe6I4dPyeqz4SSnLZ27:/j9XdJ0maElQvsya90gCu1wZz11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775317846, "uuid": "3c8154f4-57ae-4a95-bab2-4444abe9a030", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775317846, "uuid": "a016ca01-ae3f-44d0-9942-2ab48803f580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317846, "uuid": "0a5a50c5-f548-47ad-98ad-a77d1e11b4be", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5907cf-303c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775317119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317119, "uuid": "a9feae41-3d9e-4b10-b7da-713a2e1270e5", "comment": "Malware payload", "value": "2f375f800776b788b22c9e3e5f65ac23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317119, "uuid": "acb6a639-72e4-431c-bee7-576f8deed703", "comment": "Malware payload", "value": "86c0889afeff6ef08fe532ff18c1ac7405b3c913c249e76efc19bac39b713917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317119, "uuid": "b5be67be-f77c-4351-8127-4168fddb1b15", "comment": "Malware payload", "value": "3ed5ac2d88263ba9f205d701f3f7fd0f11675e06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775317119, "uuid": "46379c8f-db86-47e7-9646-bbb3faa8c475", "comment": "Malware payload", "value": "cf8ec90abdc0a5824c2390401a7a09a74227a1bef0aacdd66438146f51da8cecd3252c2b85655254b12a466ff06451db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317119, "uuid": "63ec7019-e42a-4e68-a68a-3deba6f67a5d", "value": "T1D726C708ACC82BAAC02C5B7495FB8E5623701D148AF55A266265FED9B8773347F43CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317119, "uuid": "5b2bfdd9-200b-45b8-ad22-d727776cc3bc", "value": "24576:iZg93OzH+C/hkLRk07EX5A6Z5UMM6Q5e0aWuMTOZWsC8tG/OjpF5hBUea/9hc5TU:/sIk0O9BV0arZTC8tGl85T11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775317119, "uuid": "6c3a4139-4425-4e00-8135-b8d4c860ebb6", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775317119, "uuid": "2a34eee4-3d4a-4f05-925c-b0ffc61c8a1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775317119, "uuid": "d339bb35-d0b1-48e9-925d-dfa10780b25c", "value": "linux_mipsel_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e34ba75-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274095, "uuid": "ae304efd-9b41-47e1-a034-65e27fbf754e", "comment": "Malware payload (Mirai)", "value": "4bc52f55f2a87ede13a424bf1dfdd4ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274095, "uuid": "d462ff83-68b9-40f1-8645-b93f16548d7d", "comment": "Malware payload (Mirai)", "value": "86f6f1ac0c96f6ecd0b93ade872c0a68ce0dc82d09496a042cfb388d266e388b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274095, "uuid": "21d2be12-ff10-47f9-a040-90beaeace7a5", "comment": "Malware payload (Mirai)", "value": "268d7e5ba9513e8b40aa8286021b9630ebdeadb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274095, "uuid": "d6063802-6169-42e3-8299-689bb5101bda", "comment": "Malware payload (Mirai)", "value": "fe905a9d01c4308d9c3e353dc2b1e459f4279d3031ec2418e7a93ed686c76815dc3bd9992614da54e2f96dc55bbb9dbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274095, "uuid": "a6882848-210d-491b-977d-a9486a543073", "value": "T1A3539D77C9296E54C15986B4B430CE792B63F88482872FFA1B99C2798047DACF6493F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274095, "uuid": "80bfa5fa-9b1f-4cbf-9833-d5140c18f4f5", "value": "1536:daXwtcKtFAMHdazjKHqcfsTD/GCwi+hCPoK:d8UtOMH8zGH8TD/GWwcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274095, "uuid": "f222699e-5db7-4109-9c2b-54f6a11c69f5", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274095, "uuid": "6b6371e8-bb52-4c33-a09d-137ba43c4911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274095, "uuid": "316c51e8-b620-4a8b-86e5-9615ee85fc54", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b5f5f7-300f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775297702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775297702, "uuid": "47919a5c-c1f5-43b1-8311-59b07f7b7a5c", "comment": "Malware payload", "value": "9dd84987c8439ebb124a877f5d317bce", "object_relation": "md5", "Tag": [ { "name": "crimeware", "colour": "#F3B027", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "spam-toolkit", "colour": "#D07A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775297702, "uuid": "4a1b6323-1c22-4450-b221-524dd5307416", "comment": "Malware payload", "value": "8729125114636fdb986658b346d8ba5c4f6307d0bfdcfef5b8d1ff8b534f750f", "object_relation": "sha256", "Tag": [ { "name": "crimeware", "colour": "#F3B027", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "spam-toolkit", "colour": "#D07A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775297702, "uuid": "232f3091-7631-4321-ba10-198c5571ceb5", "comment": "Malware payload", "value": "baf79347efe89d63ecab985f858ace097b3ed258", "object_relation": "sha1", "Tag": [ { "name": "crimeware", "colour": "#F3B027", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "spam-toolkit", "colour": "#D07A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775297702, "uuid": "b5ad7a86-a5e9-4128-a191-782f544fe95b", "comment": "Malware payload", "value": "142aa520225fd1f609c1fd00b61e7bb343078d58e9edf8b78e95c66282edf80ea80b1b243550247a9850e60ee8e5830c", "object_relation": "sha3-384", "Tag": [ { "name": "crimeware", "colour": "#F3B027", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "spam-toolkit", "colour": "#D07A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775297702, "uuid": "ec8c38ea-0ef6-48b9-acc8-6e4fe6f901aa", "value": "T130D312AB80847FCDA534E7061A777DB8AD35CBD90E7198B22F559C06858DF838E902CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775297702, "uuid": "f2d2c8e2-37ca-46e5-9d2f-3e47292ef5b7", "value": "3072:bjDDLzkTlQGSmQsRMDRpUNqz+j4YzQKUME2Zq4+EDu:/DY5QKNaDRpKqSc54+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775297702, "uuid": "af3de029-0e10-4211-934e-aeac3e0c1c1a", "value": 138005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775297702, "uuid": "d4bb16a8-b885-4fe9-82e1-18c0124f6afe", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775297702, "uuid": "ed0d63d5-8cc8-4446-9b87-d0b39db6a7c1", "value": "npm_nolimit_x_1.0.96.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004d201a-2fe0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775277454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277454, "uuid": "428ba8a1-6c6f-4c12-b8d6-e9f512e4529a", "comment": "Malware payload (Mirai)", "value": "0663b675e6942409377877b3fce56255", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277454, "uuid": "c46dbc76-33ab-44c7-8fa9-5a6ab0644601", "comment": "Malware payload (Mirai)", "value": "8ada174e7f0845bee202dbb6613ac07665ae5fe9db08d297e8b8da06d096275d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277454, "uuid": "e38d7e6d-231d-47fe-89c7-029e0b7f7e9f", "comment": "Malware payload (Mirai)", "value": "2059eef649c79fa05e891233312db5bb409aa4fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277454, "uuid": "cc3024e0-6a06-4437-a93a-46ba66799f09", "comment": "Malware payload (Mirai)", "value": "4f5f47eff39112ab4419cd3866cbfb619c93a9bc67dda376246dcf8f4dceb4badff305762663a7585ec52b7828101c57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277454, "uuid": "9109bc90-eb94-4fa8-9e11-bcd2770ad9d0", "value": "T1DCB309427E429F13C5C312F6FBAE42993B136B78D7EA3142ED247F91274B4DA0E26611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277454, "uuid": "ddc5305c-141b-48fb-a891-e08660992788", "value": "3072:86SGX67aeyWUeAs0o/cMB++cBYzppHwAUf:4D7aOUNs0rMB++cetwAUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775277454, "uuid": "0ec22811-0b87-4bf4-b69b-1e3788522e72", "value": 116620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775277454, "uuid": "bc047e4c-f7c6-4629-86c2-a3a58e22c83d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277454, "uuid": "5ae3018b-391f-4a28-bad6-41ce1d6e809d", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3851a557-3057-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775328659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775328659, "uuid": "12c3c99c-ec1e-4a2d-8e4f-c0c43c8d1dc9", "comment": "Malware payload (SalatStealer)", "value": "a68f5c940de5e9973cb104770aeafa55", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775328659, "uuid": "8a5081c7-e7e3-4c50-855d-b18d4cadbbb5", "comment": "Malware payload (SalatStealer)", "value": "8bdb1da1effbe7318a30321d22cb06f65723fb64b276b6b2680ff8cddf5171f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775328659, "uuid": "a95343ec-7a9a-4b7d-9b38-4e8cd64afa24", "comment": "Malware payload (SalatStealer)", "value": "6fa096b756c9b4b397f08200ed60fe86f6a772d9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775328659, "uuid": "bd5b28ce-ffd0-4279-aa8b-7628a92d8cfd", "comment": "Malware payload (SalatStealer)", "value": "e4a78fa6762b026acca9b8d3dc0aa23d3a7d45aa51b6edb5bf4ac221ecd7c39a148d7a858835470dbb713a214c532bb4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775328659, "uuid": "d05e73bc-0021-4fc8-8f20-b4da29adc063", "value": "T10F86330121D966FCE1FB023208BC6F48A73D7C504F46BEDB96C66DE43D62AD2593681E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775328659, "uuid": "5e491109-078a-4d03-b7f3-64bf876f2970", "value": "3974289d3779418070dfcb87e2020308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775328659, "uuid": "8246f6a8-0821-4ab9-b44b-052ccf16fbde", "value": "98304:FG8YuPv58fP6LWLTbnDgzPe5s7hiRxfMt+jmZd/rvcNLh9cMtptfHcQVbrd5cSWd:vqP6abQee7FMaH7cNLh91t3PPIFhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775328659, "uuid": "a5ca62ce-9728-4c40-ac71-74c4482e6eb3", "value": 8323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775328659, "uuid": "d0e4be49-ba3e-4ab7-ba09-b2d4a7934d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775328659, "uuid": "1ba340e1-540a-4fa8-90cb-2f3706fb94b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6f8b68-2fe2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775278473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278473, "uuid": "f04c3508-738e-4680-8650-ae8c75043084", "comment": "Malware payload (Mirai)", "value": "7dcba15efb67d58e98bbc92d9d04c327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278473, "uuid": "aaeb40cd-f2b9-46f3-a10d-afb0eeb9937f", "comment": "Malware payload (Mirai)", "value": "8cda6ff36f64a6c787982c216740857cf6b06b3c0dce3f341b3fcaafd6a8df3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278473, "uuid": "94e6abcc-8fe6-4f3c-9580-f9c2bdd983cb", "comment": "Malware payload (Mirai)", "value": "ce87eeb097dbf8f2c924ece22ca668a6b1bf660f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278473, "uuid": "c0976779-60cd-4ac4-9270-15394d5c4bf9", "comment": "Malware payload (Mirai)", "value": "799b4225a0820e8246ce8c44eef3af595d5d2330ee763f9d848875a06be6563a6126fb02e61a8b929f0c6e0b8e50b592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278473, "uuid": "56882db0-c1a4-42f5-87dc-1d831669ca9d", "value": "T13ED30816B9919F11D5C321FAFB9E814933136FB8E3F93102DD206F54278A99B0F7A612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278473, "uuid": "9e35211b-4f4d-42a8-8906-ca856e8066f6", "value": "3072:JTnpOH3Zs2b5RMzafKaanyqaEPhmy5lsp+kXb1wBC+3:lQH3l7MWKaanyqaEPEy5S+AbWBC+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775278473, "uuid": "1d34380c-64b9-4f19-9512-f9ea44992ebb", "value": 141424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775278473, "uuid": "5aa1bcd9-2e28-413a-b61d-bad10071a29b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278473, "uuid": "cc89f44c-48fb-4ba7-a40a-fa05b75522ac", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8424cba8-2fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775275528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275528, "uuid": "7a072c9e-7f88-4826-b8af-8678560dff17", "comment": "Malware payload (Mirai)", "value": "66d87ddcbe4fd2b028473db32619af84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275528, "uuid": "792e3116-a7de-43c9-a3a5-f5ae6cdb6825", "comment": "Malware payload (Mirai)", "value": "94a092e0c22c028e99357b985533418f70ea2a24ba8f8840a8c882b98dc814a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275528, "uuid": "18984f91-651f-489e-86b1-f171831385f6", "comment": "Malware payload (Mirai)", "value": "d9ab84565799d4923377435e039f53762eafd2db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775275528, "uuid": "46d9f27e-7263-45f5-a4c1-1514590cb4b2", "comment": "Malware payload (Mirai)", "value": "9eb7e3af8bfe7f9cda11e1351d0cc365955bb6486615b8d8c884fc359ba4d2cddd7b1c9a20fcfc1336e4553be5c69c68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275528, "uuid": "a270fe53-b614-49ab-b04f-eaee319b12d8", "value": "T15A632A21B6351A27D4D1A47E21FB4B1AB2B196DE21D8C64E3D720E8FFF216807942DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275528, "uuid": "3064557d-dc34-47f0-87a6-ca4b44791f0e", "value": "1536:hv7vpo0iUkoD/p4hRxJvdgRVR3GKndOH5Z757wKtdXT:97TeQR3NndmZV5XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775275528, "uuid": "5af6045d-82c4-4d39-8eb4-04332d8c205e", "value": 72744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775275528, "uuid": "41aae1e8-972f-4e73-adbc-c459959ec0c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775275528, "uuid": "8e182ac9-fe75-4ff5-a7f3-2a7421bcf603", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1f6ec2-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274444, "uuid": "d215e696-2344-4adc-b312-c8f4d8335bdf", "comment": "Malware payload (Mirai)", "value": "836965ede672343787ecf3e31621aa24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274444, "uuid": "0a39b4ba-9a49-4f81-a785-28c8eb1d9fab", "comment": "Malware payload (Mirai)", "value": "956efc94046f41222b0ac1cc601afa5748ad9598e05a02c901a18f785f650cc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274444, "uuid": "f18ffdfc-4ede-4df8-9fee-2c492bee6692", "comment": "Malware payload (Mirai)", "value": "fe85b6e686ed183f9767063ca7926bf524723cfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274444, "uuid": "3b318c39-51c6-4070-bf2d-705c86a5a5a4", "comment": "Malware payload (Mirai)", "value": "08a1b67a0bb3b12960deac83a8968f9bd1864989526ae781cc3e8c55e02367e0ab563b6810885a2bcbe7b36b0a0dbe43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274444, "uuid": "bd627206-c3e6-4ba2-9b1f-e8e7684acfa5", "value": "T1BD93A61E7E219FBDFBA9823447B78E16964C33C627D1C681D16CE6112E6024E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274444, "uuid": "9ed62dab-472d-45a4-b0f3-ece17bb5f02f", "value": "1536:zp7U06qOdpyyOBnoAbotyHWV8BkMmCe93iOS1:zwNoCqHWV8BkMmTiOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274444, "uuid": "51e01b02-de68-4250-83fc-bc8e056e296a", "value": 93036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274444, "uuid": "4f60a41c-8d00-4216-9b83-6795097d3ae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274444, "uuid": "7b79901c-483a-4ef2-b522-e0d0a3e1ab23", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151d98da-3064-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775334183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775334183, "uuid": "99df137b-54d0-4f71-9f5d-424975f575f4", "comment": "Malware payload", "value": "16d624196abdd850fe4b92894970605c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775334183, "uuid": "972e2370-00af-439b-914a-e5530e9f4122", "comment": "Malware payload", "value": "9714272c145f2756b257ebe574a7d84f1ae476897ed42cae28d31ee4f4354dae", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775334183, "uuid": "8c9ee0e8-1ad1-494c-83ed-b3de0843a382", "comment": "Malware payload", "value": "8a0366ae8a374a3c2571078124ce6f36d2d4da09", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775334183, "uuid": "0d6de010-2f3d-486d-8658-ebacc12ec19c", "comment": "Malware payload", "value": "063497d52c69fd32d8968b995fea66ce8f221b975940f29a4177eabe9a7c89ca36c5caef06176afccfcbe5305fb7b0a3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775334183, "uuid": "5f36ff91-3fac-4756-aeb3-f1306ce24aa1", "value": "T14931310677E91329D2B38E7984BBD2108929BC02EC525F3D0584079C1860719FD36F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775334183, "uuid": "f8fac798-cd23-46af-a8b3-796d01a1feaf", "value": "48:8tmXZDbbWG9/GzWyvHnLWIIlgwV5WSo5UBWW7/G7:8U9h9eBfniP5W9UBWAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775334183, "uuid": "6cf24464-a6fe-4633-b2bc-4bfede83a925", "value": 1858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775334183, "uuid": "b5545f73-e719-4a2e-bbc4-c5ef04544923", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775334183, "uuid": "d34c42c3-acc8-4999-b71b-9247ecc4ae58", "value": "250413-Incident Report-Telopea Park School.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b78ea47-2ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287513, "uuid": "65ff5804-8bb5-4618-8aca-16f07b3cd3bf", "comment": "Malware payload (Mirai)", "value": "247f81b0f8e6c4fa3dde9b24feaa9285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287513, "uuid": "82e70a10-c7e1-4c90-9204-98516b814f76", "comment": "Malware payload (Mirai)", "value": "98c57bd25e7c99da48c2632a3a1a53cdc7be6a5008f06096768e02f413f968e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287513, "uuid": "1236b381-335f-4210-af31-1396a8b6018d", "comment": "Malware payload (Mirai)", "value": "ff0d31fb2a6340f82f6e9809aef8ed99512fc01a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287513, "uuid": "1aac48c0-b202-45b8-8f32-67d3cfe56f95", "comment": "Malware payload (Mirai)", "value": "32bcbfb67620f13450ad7a5090f5850ad6a697922837aee5bba4528631610eca59a502e9bdd5d343f2ab642322757fe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287513, "uuid": "386dcad6-bbf3-4e09-b957-ce7fe64a7506", "value": "T17F330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287513, "uuid": "2a0658d6-afd8-41f1-863d-b9c117f867b3", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGa:r/hqaJMDg9eqK806MHdkfQX6HuCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287513, "uuid": "f512c485-1f4f-4734-a6dd-5da54f3c94d5", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287513, "uuid": "00ac0ce0-bda5-41ac-aa65-37bccfe14855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287513, "uuid": "7ca79b53-7d16-4228-bacb-522efd1722bc", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817ca85c-2fef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775284114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775284114, "uuid": "6b96f467-d0bf-474f-aa36-933fe17cc5e7", "comment": "Malware payload (Mirai)", "value": "9390aa714d9340ae83195d9dcc557494", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775284114, "uuid": "aac3f329-7747-4d3c-a6d8-d1b8a973104f", "comment": "Malware payload (Mirai)", "value": "9913afbed6d45a489c7962cf5acb83a286889fb082880b8acfea9ca3e4c5accd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775284114, "uuid": "568b2b18-3cce-4caf-b98d-b6582af60fe2", "comment": "Malware payload (Mirai)", "value": "bd7150672dd97bad15333a0a4a931ece6e861015", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775284114, "uuid": "98c6a65c-eb1f-4aac-bf00-050aa383e99a", "comment": "Malware payload (Mirai)", "value": "cea26a4f30c1df6a67f4d9f216dd1dcbddd8cbdef7ba3a83bbfb2738189ad4ba30f9bcd75238157041355a5fb79f2e91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775284114, "uuid": "20f22c50-4522-4e00-9309-db05f3268db2", "value": "T19AA2D11572A32D66E3D91C3DC9AA8357F9A70BFC80F632757D456620C94920A3E38A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775284114, "uuid": "7555590b-7753-4c3d-91b8-9ddd2f14aabb", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjrLwhymdGUop5h+:TvQn4j+ZO5fKAlx/Lws3Uozc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775284114, "uuid": "00b11519-9014-4a29-a6c6-19931313cd74", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775284114, "uuid": "4e409b35-fdbf-49e0-892c-2ac4192b4447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775284114, "uuid": "5923c0fd-8b3b-4e1a-b248-7f59bd0244d7", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ef5829-3067-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1775335627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775335627, "uuid": "b87b877d-ed13-4b3b-961e-0fd124a30900", "comment": "Malware payload (OffLoader)", "value": "1621a29fbef409ec440f333951030984", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775335627, "uuid": "123cd12a-1f5a-402a-8ffb-bad17e46148d", "comment": "Malware payload (OffLoader)", "value": "9a5616c779815a0c7724761d62ba7a370a72b246ca17dd5de372f015007f9e8c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775335627, "uuid": "e314a89d-b2cd-4730-8335-099fd50bc23e", "comment": "Malware payload (OffLoader)", "value": "78bfba5c9618a09e0b7b66823bc58021e1549d63", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775335627, "uuid": "b68757f7-64b1-429e-812e-aabb38471bac", "comment": "Malware payload (OffLoader)", "value": "d1a670826c3bffd9ad28972f2a458b1af58a0f8a49cdac3ffb853cd2943a53ccd26b749327950a8faf8e1cdace9870dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775335627, "uuid": "1957ea09-8e7d-4074-a7bb-70ec6530f12d", "value": "T12D86122B72C9123FF436853355B6A22018FB364BB4098E16A7E03959DF296E01D7F7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775335627, "uuid": "e7598bbd-3d64-4655-867b-83848fb70907", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775335627, "uuid": "41d2f0d0-9166-42e0-b505-907eeadafe0c", "value": "196608:JHZXdFkuUSniG/8VqmxkAkbfKbpzccuHylJrjRS9qnJ072wZ:JH9dFVUVqWHYf+pgcpLjRwiS72y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775335627, "uuid": "8c96cfe3-898d-4e32-a636-f0c7a032e178", "value": 8473604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775335627, "uuid": "6ec5fd8c-982a-4410-aaac-3c49c957df1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775335627, "uuid": "d3601e1b-3316-4a5c-b485-99f33336a888", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f89483f-3041-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775319383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319383, "uuid": "63b2ea3d-2bd2-46a9-9a48-fb9f00fd50b8", "comment": "Malware payload", "value": "81e21774e6765d18444d02b58e68e598", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319383, "uuid": "db4d9208-1610-4d83-86d2-f674436b995b", "comment": "Malware payload", "value": "9b83791bba1a2384a3f49d4c3abd96debfc2bced8a1fd7456810befd48b1dbfe", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319383, "uuid": "6ea0c1cb-c56d-46f2-87b0-fe7ed67dd867", "comment": "Malware payload", "value": "0ed5162adf4d59fe105ecc0122ab14912bd35ffc", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319383, "uuid": "05692141-6ad4-49e5-8870-3fcc745ef8be", "comment": "Malware payload", "value": "69186481b9c056902f86012e2167882c96c313adc91c1cff26cf678727661a105aa13279d3d1bf8f8071108f4c1c6448", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319383, "uuid": "2e4b8ab9-22e8-4bea-8ada-f3d3e8ae7fcf", "value": "T194168D5B7CD004BAD0AAA33288B261917B76F8191B3233D72F44B6783F767E06979714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319383, "uuid": "7a009179-64c5-479c-8ddd-7d968469ea13", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319383, "uuid": "b2df2fae-b140-4c5f-a66e-e6d85ffeed0b", "value": "24576:rM/1oK5WuY4z61U9tNfTAW1MGucUyXwmGiWPrWKf9:rMdR5Tz61ItNMeMGa5xS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775319383, "uuid": "2ae34404-865f-4e0f-959a-703359f39216", "value": 4021912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775319383, "uuid": "edd23afd-a637-4799-b462-25700ef0be2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319383, "uuid": "0521d285-533a-4dff-afde-05503e29674e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c51357-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274100, "uuid": "5f494a5f-05eb-4fb7-8b89-68e6896ed59b", "comment": "Malware payload (Mirai)", "value": "3999c43b1cc6d28868a0e90f427650ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274100, "uuid": "91254e75-6267-4d1f-9238-45b35d540a11", "comment": "Malware payload (Mirai)", "value": "9b91fe3431a6db3387fea765b0bc905cfe8f8b17ad643c33f068cf62e9d48363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274100, "uuid": "30397d08-15ba-4aad-9a8d-94c168b283a3", "comment": "Malware payload (Mirai)", "value": "a6d9ee8809c6e7b272af2feaa562bc2b3b4b1707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274100, "uuid": "dca7dd8a-09c7-49db-8f9e-0e3897753b58", "comment": "Malware payload (Mirai)", "value": "04c65658c6be7ab8e3e0be2326f0b4e5faa5bdd954f2aa61e4f03d19955a5fcc2077ecbdc18b8b1c85078e35be0bb228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274100, "uuid": "4caffd06-0d0e-43b6-9641-03a34914c78d", "value": "T179731995B8818B22D5D502BEFE1E118D3313177CE3DE73129D206F24778A96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274100, "uuid": "367bf2d0-2b42-45a0-9420-11e0da7f0828", "value": "1536:nAnOHGsTtml2P9gIgDZPa3SZ0QmMNiB8sYqSBp7ib59Ye/:5GatVqZDZPaH8sYqSBpGb7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274100, "uuid": "8c4212ac-509a-4175-a0b7-82f024cc4747", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274100, "uuid": "81395666-b3d9-4264-9980-0207f503942d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274100, "uuid": "231f85cd-4b75-4e18-94c2-3c9c5feea4b1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af858d18-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1775274312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274312, "uuid": "ce83ca45-b3d9-444d-9f32-ebc03ee5b5f8", "comment": "Malware payload (XenoRAT)", "value": "8ac0a68721aed8d7bcb6c41da71beb9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274312, "uuid": "f86aed51-05b2-4d5f-99b7-c27539ebc686", "comment": "Malware payload (XenoRAT)", "value": "9bcccbf6ddaaad70c705a45370f151ce4f7b072ce260b31946b255952bd01c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274312, "uuid": "d129cb34-d350-4c21-bddf-a278e9b61f71", "comment": "Malware payload (XenoRAT)", "value": "9be9887fd16caab7eb24b1c4e9ba3680600cb70b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274312, "uuid": "3c68b55e-d7ec-431b-9f70-4ba39b1b2e0e", "comment": "Malware payload (XenoRAT)", "value": "9d059b914e6d4ceb10094901ab8300697ad45a8f480cbe61f2b449487de0254a230f656da7949b7cc51f9be06d9f4232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274312, "uuid": "4f4b767f-304a-4ade-9fce-cb5e67c1fd4f", "value": "T17123F74C57AC8923E6AF5ABD98324263C7B3E3669532E38F08CCD4E9379339554053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274312, "uuid": "d41c36c1-9021-40a6-a0d2-85dc7b628614", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274312, "uuid": "2ef5e74a-ff15-4272-b206-94b6616afd31", "value": "768:9dhO/poiiUcjlJInuzH9Xqk5nWEZ5SbTDafWI7CPW5q:zw+jjgnsH9XqcnW85SbTGWIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274312, "uuid": "b0c33ad8-504c-413c-a8fe-3ed2c4965407", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274312, "uuid": "45f46017-66a4-49e6-9013-b630a1130554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274312, "uuid": "a45265cb-1fac-48c4-aeb5-2f1d5fc0487a", "value": "Loader1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33120736-301a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302450, "uuid": "30bb7d93-b3ca-40ba-a9d4-696e5fda522b", "comment": "Malware payload", "value": "bf71f128816f7a5033d70d72e3077538", "object_relation": "md5", "Tag": [ { "name": "Dacic", "colour": "#229061", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302450, "uuid": "ebba9093-19c3-40bb-b357-4441f16b76a5", "comment": "Malware payload", "value": "9c1de5f2d652d1e07adc5d9e0156dd9474e9adc6f17d210285c6945df549667d", "object_relation": "sha256", "Tag": [ { "name": "Dacic", "colour": "#229061", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302450, "uuid": "1d4b71af-9773-4eb3-aa7f-00cbac9064c8", "comment": "Malware payload", "value": "53958e188c8c35aadbd79825d350be2d1c6d4e7e", "object_relation": "sha1", "Tag": [ { "name": "Dacic", "colour": "#229061", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302450, "uuid": "cda363a1-ca19-49f9-adb1-a62da1b1d41e", "comment": "Malware payload", "value": "877b752fe1d1def27c401efaefd91b092c19969144f15596d87e401c571994b55f16e7315b9796d25901915f4d4272e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dacic", "colour": "#229061", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302450, "uuid": "c1e89702-a9e1-4ca8-87c7-f15b5437c5b5", "value": "T11FA5AE10E3A911B8C83BD634CA569333E7B078564330E58B0A9DD6452FB3EA25B7F716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302450, "uuid": "10ffb055-f40a-4c8b-91a6-14ea8bb84bf3", "value": "2d9eb1f07fccf61de60224f8f00b11b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302450, "uuid": "8a55644a-9f9c-47c5-9012-9474e51ecb37", "value": "49152:Edl4CoKynlu+KAo0MDmrxI674h3uD/qULf7Rv/T1MwWJd5:yTqj1v/en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302450, "uuid": "cdb25940-376a-4d3c-ae40-44d8f85d8a1f", "value": 2158080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302450, "uuid": "503ac843-1a31-4723-830f-6fe94d72d77e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302450, "uuid": "e93a9f9d-5e23-4a34-84a0-0629672c7e8c", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9ac34a-3019-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302015, "uuid": "d7771941-a6a7-4885-b25f-a4fca5d3b1b5", "comment": "Malware payload", "value": "61b87176b3fcb60bb608fc370a6c8e5f", "object_relation": "md5", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302015, "uuid": "95248451-868e-416e-b9f8-b1bd06873cc0", "comment": "Malware payload", "value": "9cd3d39d9d9a8a5e10ee9455a70ba4ad593634dc0189bfbf4609cbd9381b29db", "object_relation": "sha256", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302015, "uuid": "a49fc9f6-644b-431d-95e3-7f51b6626c12", "comment": "Malware payload", "value": "f13dc94dd111a990ea309835b75fcbc334274128", "object_relation": "sha1", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302015, "uuid": "22836810-3f5e-49a7-b321-2f81c8316dee", "comment": "Malware payload", "value": "552c513fb899d68fabe2c5f2152ac86087a29d98eb649be16c9eff2032c2b6cc998635a1c982c235ddbcd21c460af355", "object_relation": "sha3-384", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302015, "uuid": "eab2abef-2d55-4866-9d2e-2033d77b0db2", "value": "T1623110FB68088D9B5B02E5C6C1DA542CDD73E3577A229CB46204CC2C8F00634D6D2CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302015, "uuid": "e99d1be8-088f-439a-8ed1-a2407dfcfa0e", "value": "24:9AMfoXnrQMGGFRHu9bXQ8TGdSXcFRAVMSoMRD2aMbnvpj0qkn:eMfoXnHzFRHu98p7qx2n2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302015, "uuid": "5306fd3c-59e9-4917-a7c9-0055970dda59", "value": 1725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302015, "uuid": "4a0a9259-40ea-4ebc-8097-e1ce70639ffc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302015, "uuid": "ced92573-d4f1-4d1c-a1c9-b88e2137f14d", "value": "done.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479f03ec-3005-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775293465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293465, "uuid": "4af3fd34-891b-47e2-b92a-1c5066f6821b", "comment": "Malware payload", "value": "d381a660079d254692347abbb8601128", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293465, "uuid": "686133cc-5355-4da0-96a3-c01844be827b", "comment": "Malware payload", "value": "a0c6f7821878044c49adb124ef899fe0adccea01890445070d91f09c4a602058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293465, "uuid": "05fe1f74-7e2a-4619-88b0-8d8161982582", "comment": "Malware payload", "value": "4f89ade1cc77ebb0e4eccd4188cfbae4ac8e6f78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293465, "uuid": "ad861c63-af0d-4bed-98a9-4dd146d1eddb", "comment": "Malware payload", "value": "bed4a12625bfce47f3a4c8b71e5884c86de4fc231bb3dd3c1ef70adc23f721cd2c78d39823b7690d70f1a0230df9977d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293465, "uuid": "28e17422-729c-44aa-b5bb-88123960941f", "value": "T168C44959A8419791D1D02BBBFF1D934873131B38E3EEB106AD196F246BABC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293465, "uuid": "e0ef8cbd-46f1-44cd-99ae-7767d601c0a9", "value": "12288:qUYfZJYnlRVHCsfiwkkE3K5RYSbJnlRLB6VsGMg72at0LNFl22AmHnbMhWk:sBJY3VHCwMJSbJnEVl200f7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775293465, "uuid": "5e213aaa-a1d9-46e0-a69e-4b9910ddac0a", "value": 557304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775293465, "uuid": "01e1e341-a137-481c-868d-b6c98a755dbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293465, "uuid": "28f1819d-4e4d-4e17-bda4-faa303b358fe", "value": "b10309e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77378ed2-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330053, "uuid": "ebb3c84b-5c64-4589-880b-1578092c9cc2", "comment": "Malware payload", "value": "35710589e5c527a1b54c9ba1150ecffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330053, "uuid": "1f3067b3-e54a-4a72-bbf2-922573cd5905", "comment": "Malware payload", "value": "a21b9fdbae3257e202e0f4aaa32ba65d23c14728683fc1a651eca42ddea9a9d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330053, "uuid": "b77213cc-97dc-4912-b415-2dd1cb84ea58", "comment": "Malware payload", "value": "980013679b8d5e05ab78130ab3e46bdfdc7723f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330053, "uuid": "e6371b0a-1a6c-4bc8-b335-6f0a73550958", "comment": "Malware payload", "value": "36fc42cd0dc5abb32b2e591f46befd06c6db1f927efb12e432d85123931d08215fa297d70ef05143f36be778955d0de7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330053, "uuid": "5db5bb79-0173-4fef-95c8-82fe66dcd9e6", "value": "T1443412839FC251B1E6938A344096D787EB24DD242004DBD5FB1E3EB1A8E23E7F50E659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330053, "uuid": "d75bd7df-0131-4996-8428-df8430947782", "value": "6144:0wM1m1qFlHH4APNSTfqEcaDKctbC+MeETu0pU:0wM1mgln4APNQiEcaDL9JMLVpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330053, "uuid": "c4c24783-cb0a-406e-8536-56995cfc67e6", "value": 248295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330053, "uuid": "07cf936a-9773-4df5-873c-bff286569f11", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330053, "uuid": "a06193e3-1bb8-4d4a-9ee6-b71893ce7f05", "value": "rh1ele5p8l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eecd7c6-301d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775303759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303759, "uuid": "7bd45518-507e-4c01-87bd-4354344d8e13", "comment": "Malware payload (Mirai)", "value": "0389dff068ea8f6cf4ddc4b00aad0d9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303759, "uuid": "2666a8cd-1fd9-4593-9833-7f23c375525d", "comment": "Malware payload (Mirai)", "value": "a2e39a970e40ea24d2516d09447a186147c4b123b38707406f0e7daa2e664692", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303759, "uuid": "5bc0151f-b3c7-4811-89d5-b21f7b7f3fdb", "comment": "Malware payload (Mirai)", "value": "9c31470cfefa8f1bc710790c119e815c1174d5fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303759, "uuid": "9ff9a9aa-e3a1-4075-9200-be82d3c038cf", "comment": "Malware payload (Mirai)", "value": "e64d0b1e5b2b1bb21ebccd5fc130e5f310a06bedfe83a1855c5d49ce1aba7a50de3a7ef31fec87ccba67e09ef9d41c08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303759, "uuid": "a80a919f-ff21-4563-ba3a-466db9b2bb32", "value": "T138F3985E6E128F7EF668873047F78D21A76C23DA26E1D645D2ACC1105E2029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303759, "uuid": "918bb7e1-1453-4871-b6d4-90b01d6b8497", "value": "1536:Zq/Bpmz3dmp6iHkopmKoyz9dbYO7W8sCvZgTgKdZPHXxP8ne3WNecXIV:Z0pmQpMypdbYO7W8P+ZP3xP8LNec8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775303759, "uuid": "4ab8770d-9428-4a95-a1aa-801e1a60c09e", "value": 169192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775303759, "uuid": "0ff215d8-7a52-4bc2-b1f8-e8e83048e63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303759, "uuid": "fa25d4e3-01e7-45dc-8df9-279d91eeff97", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d60846c-2fcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775269128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269128, "uuid": "19150b76-94eb-427d-9265-6c9d0ba61ff2", "comment": "Malware payload", "value": "2d07c250e4c85023e992e1540debc846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269128, "uuid": "22c9320a-47bb-453f-8c29-b3e0c12a5b7d", "comment": "Malware payload", "value": "a3443065affd5e460ce0e6dcc66bfeb3ca6342589c50fd4f625724a07fbce228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269128, "uuid": "a41fac49-e70e-490f-93ed-eb2e16f542ed", "comment": "Malware payload", "value": "d801ae8fe481e7c4284cc4b34d1497127557a1d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269128, "uuid": "9eba38bf-61a4-4083-ba4c-079844ad3a40", "comment": "Malware payload", "value": "473589f5b394a6a2438e14b2c6418a081735f00010cb9914f80e7d3c1ddaa14dc5fca8dcd044cfc6d2b91480105c49e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269128, "uuid": "ddf24d53-f303-4a4e-98b7-34f008cdba28", "value": "T10517334DCB0284DDDD117AADB897788D8FF42E8C8C5D9F35486491ACA78847C78AA4FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269128, "uuid": "2c9fba25-74f8-4fbc-a5f1-1aee11e59776", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269128, "uuid": "97163245-bac3-4636-a165-affe153fdae7", "value": "393216:1Wm33i7n8Lnmgw27jtW9l+OC+ab5BkBhibwzBXt+IW+392lj7l6ggVr/WCk:Q8Y8r+2tE+Oxad8XtD392xwLVrWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775269128, "uuid": "22a20d27-6ba4-4e5f-a715-5b72960b3b73", "value": 19645440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775269128, "uuid": "00380c6e-4d9e-4df1-9094-f1bff7577fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269128, "uuid": "a85060c5-8920-4557-90b4-1c959208a336", "value": "Wixide Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c79ab6b-301a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302386, "uuid": "e5e0bfaa-0c33-401b-9027-f289cd84a2a9", "comment": "Malware payload", "value": "12223ac825fe1bc3af17552336939943", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302386, "uuid": "6e00b8e4-38e1-4ace-aae1-8ca4343043f9", "comment": "Malware payload", "value": "a565d94cbc5d45acb927ab391d8d7845371cebeda5e1be4f156e8783f0fe416c", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302386, "uuid": "ac3d9ed1-4e2a-40a1-8853-fdb07a38f074", "comment": "Malware payload", "value": "89f0454c403b53a65e89453b42973af0eebf7428", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302386, "uuid": "01317624-6c7a-4725-8bd1-c01e7dc35b9e", "comment": "Malware payload", "value": "afe020ffe7e8064fd7b052dd9026b222edb709d54516f1503a31fd4daa0d5b3bade00423ca68f1611cf0ff89ec2eb29f", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302386, "uuid": "bfcbcee2-fee3-4462-b419-c4206f877aae", "value": "T1C3F57D03F296586CC016C33782176A66BA71BC850F607D9B03D4F7352EB6AA07F6E719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302386, "uuid": "d420160a-98ef-46a7-ac10-cefe1e01ea0d", "value": "49aba763a60be0605ce284318275fabd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302386, "uuid": "2d4c630e-d41c-4c90-9416-bccf49a78056", "value": "49152:XKYDDXn74dzH/XwTT/ywjmQjnbLuhQuWxoZPUomLGO7KKI1FNs7iJDsf:Y4gQHWRUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302386, "uuid": "045ca09e-f14e-4186-b92a-17ee13aeb86e", "value": 3345920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302386, "uuid": "ab8fee6c-4368-4ff4-9b15-220b7f51e808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302386, "uuid": "8e0a2eae-4ae2-4ce3-9468-2f5454f50407", "value": "MemeSense.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965d2860-3078-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775342990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342990, "uuid": "44fa3ee3-d499-4f8e-a60d-2158845f4c9f", "comment": "Malware payload", "value": "5e6bb977ef6b6cbc009c76579daeeea9", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342990, "uuid": "e4f04bd5-e802-49e6-86e3-cc85f65f85fb", "comment": "Malware payload", "value": "a750f3b2120e9f9dba4a05581d47943719d330a032523b4fccd70558c46f6dfd", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342990, "uuid": "14e7c7a4-523c-4596-821b-d6b482ee6f83", "comment": "Malware payload", "value": "522fe54c87ed2b3b5a19d1dd0dd9ae09c74bbb17", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342990, "uuid": "3aa521ef-3ba8-4068-b731-7ea978006616", "comment": "Malware payload", "value": "d104f89696818b85de621a0ef18d513257112538290353b4176ee140f957a99941071ff50dba2caae12b4d6e7b97ef7d", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342990, "uuid": "db137ba0-9f1b-45e8-8d0f-706f4aa9a8f4", "value": "T1E41733D6FB02421ACA5B5B726A71C2683F376F82E41C854C316F64BDEB7F276E940214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342990, "uuid": "b716013e-da72-4e93-bd94-460443296016", "value": "393216:xpYV76aS61tWwrfDkKO4A3Il2a3q5Q0Y98C7Cib4:x2/lOiUa3AlY980CE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775342990, "uuid": "20079c1a-a845-4c1f-88c8-9f39dcb2ed2e", "value": 19615744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775342990, "uuid": "65a24a74-4506-4b34-a84f-0658d5b63808", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342990, "uuid": "d84c3e14-b849-48b2-9793-177b4fe538bb", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3442f9b0-3005-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775293433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293433, "uuid": "0f3787af-d5f5-490e-9aa9-0186cc66e966", "comment": "Malware payload (Mirai)", "value": "263c51c145780fa42c29b249f81be629", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293433, "uuid": "0f1a8d33-75b0-4410-ad80-4780fb08313c", "comment": "Malware payload (Mirai)", "value": "a9349d10ad9d1b164273b87ec2ec6c61d5099e3882106d42732067d614d32fd1", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293433, "uuid": "1690d731-15a3-4d48-9b90-703dbb279790", "comment": "Malware payload (Mirai)", "value": "2c220fe3cac41986edbd45666913143107c57043", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293433, "uuid": "67317ed4-3597-4f5d-9312-f1910f1e3c88", "comment": "Malware payload (Mirai)", "value": "5bb6424d9965e45ef6b1d92fe26bf064bb92371cce3dce2359d4978a79369b8944b17659f197bf881c8ea2f75eb9960e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293433, "uuid": "7ff9133c-2c2e-4c86-9f9a-96c73e10a7a6", "value": "T1F74423C4CD49DBC00C3EF25CA4499DFA06918713FD5EAD26053670B902F06EA8B69F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293433, "uuid": "7d7cdfe3-6017-43fe-9233-04f1de79e134", "value": "6144:5wr/6Z+hXMUm2KiYHNtDYIvJdJG/pWqjBitHnESubpuJ5:O2Y8UnqNNNE/pW5tH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775293433, "uuid": "2f584bf8-ee51-48f8-bfd1-d7cc9c2fbb39", "value": 270804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775293433, "uuid": "985fdf4c-6a76-4892-9612-e21018ca2883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293433, "uuid": "42fd9f95-dfb5-4b23-99de-9f3d797475b0", "value": "a9349d10.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9341fa2e-2fd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775273836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273836, "uuid": "ca644a25-50a3-4dd3-8582-a96c38fcf0e2", "comment": "Malware payload (Mirai)", "value": "951208a3b3a8984ae304c8e80edea849", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273836, "uuid": "cb738411-6d22-4532-a2b5-e449e3fbfb9d", "comment": "Malware payload (Mirai)", "value": "a93855f7794f5c3a7bef6d038f844cef0db1621928c6d2b6323cbe9fa5642619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273836, "uuid": "c2344257-50b9-4f1e-a5f2-58df5778f7ad", "comment": "Malware payload (Mirai)", "value": "affb98cca0fa3cf4927b6a79b468dcce9f6abd0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273836, "uuid": "6dfd13a1-5c29-4050-adff-db4310c460d5", "comment": "Malware payload (Mirai)", "value": "7c405a418857370a706c0db7ed866f84bb86c6e12c9db494f72d6742a76e85a8727ea71229f2e359334695c30615d463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273836, "uuid": "d8d3e963-9e16-4664-8a80-5a76adac85e5", "value": "T1E2E2F11CCCAF313CD1C3C3BE70065B7A05BB601156E96BA7607CB89B04E7481E67A6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273836, "uuid": "6c07161f-5ce0-4f4c-ae73-5882668832c7", "value": "768:7SKwIC/XMVIFiRCsVmbw73UHJENSiHNcZEx33s/:pGSIF0CuuwzsCkZoc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775273836, "uuid": "3a4c6c20-31e0-4a42-b3f1-197bb4955ee5", "value": 31432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775273836, "uuid": "185c8425-fbd4-457b-9c4d-3aa39896b485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273836, "uuid": "2ce98297-bc75-41ee-9e40-6b5026161713", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d13d8a-304b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775323640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775323640, "uuid": "9764dff7-d499-4393-9438-71bbf14a38ed", "comment": "Malware payload (NetSupport)", "value": "8244af3dd0a23fff58e7e308582aff02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775323640, "uuid": "20205e16-f7cd-40e8-b099-dde24a2a21bf", "comment": "Malware payload (NetSupport)", "value": "aa8b48023efb7fcfc7d52f895770210874aaaf7d52c39bea2830c930847d1e84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775323640, "uuid": "867676c3-08f7-4827-8afd-c39e24376072", "comment": "Malware payload (NetSupport)", "value": "b8fe4b400b86bb458c72a907c5248945a2ddac93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775323640, "uuid": "012db542-9f5d-4a17-b458-515dd88b24c5", "comment": "Malware payload (NetSupport)", "value": "f0583d426267ccffa44938251bb03b5d1543460bfe10b4614646f9912634ffd46b2b8c9d5dcfd5f1d5d5d908a0e99d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775323640, "uuid": "69a08846-7c90-49a6-913c-36b73c68be37", "value": "T1F1F56D27ECBF4CE9D499A134843361567E28B8405B3263E72AD4B3782F736F0597AB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775323640, "uuid": "53d7b820-cba7-4361-9dfe-8beabd8fee2f", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775323640, "uuid": "25df8c18-7ab3-4a76-b40d-94fa2dbf5390", "value": "49152:1UQ2x90k5SbCNxHrlHF1YwCrRdKski1HIdPoDgDjEclK0PmjJ2rQclt:1U2o3NtEygclK0Q5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775323640, "uuid": "6c953c53-4d97-4bc4-9c8d-541a7086c1f7", "value": 3465216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775323640, "uuid": "eaa45c14-e8ec-494c-aa68-e54f1dfa7343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775323640, "uuid": "681149da-a4e6-4dfc-ae9d-9c235e4d6ab7", "value": "SecuriteInfo.com.Win64.Evo-gen.79726373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee6c70f-2fde-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775276620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276620, "uuid": "c1ca5dbc-2d7a-4b00-8564-f020675ab02c", "comment": "Malware payload (Mirai)", "value": "c48ea33322e3d9776f0d09eff27b65a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276620, "uuid": "436f8d0a-de02-4e2e-a83e-191b719a7dce", "comment": "Malware payload (Mirai)", "value": "aabe3c75c74611484aae5f13ec6212a348df01d223d4c2d2a7d77a306486c1d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276620, "uuid": "c2381cb8-5d9f-439f-af51-dd45d83aee61", "comment": "Malware payload (Mirai)", "value": "158e93f1d42aa3c175571bd47d94efb59eb99a53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276620, "uuid": "cd22442b-632d-4836-8e11-fea4ff3136e1", "comment": "Malware payload (Mirai)", "value": "0f80f11c4fa9ff7057760ec024e8f6870d9f2c76c974603691498ce2fb4dc6c14bf7dceb114079eb509d8f77788cfd99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276620, "uuid": "4feb08aa-996f-4589-91bc-6b92e7d3dd49", "value": "T1A5E3E70AAF610FFBDCABDD7702E90B0224CCB91715A53B797534E818B54B18B4AD3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276620, "uuid": "bdcf5bfd-eefe-4698-8e44-e28cb3e91e06", "value": "1536:smZv/wOvVlyhm8NH0Jwtgm/rEn0vqrTTTDK1RnjwDOgIlgrsZW7unKZ/gg6qM0vR:nPQmatB/W0gOKrsYwWs3S3GiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775276620, "uuid": "1d511a87-1a4e-4dc9-a62c-e7fc2fefe4b8", "value": 153124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775276620, "uuid": "e68713a8-8886-469e-82d6-89515ad95e91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276620, "uuid": "0280db42-8b68-4300-a284-3ff5fcf4e802", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1a7bcc-3078-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775342816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342816, "uuid": "97c829fc-1654-40e4-8f87-deaba5fc2cf1", "comment": "Malware payload (Mirai)", "value": "e1defbf08ad104908ba872531870e879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342816, "uuid": "ca36eeb9-422d-4526-b8b6-e58d9728280b", "comment": "Malware payload (Mirai)", "value": "abcbc71b75b492709a97b750acd1558d8a6b5e43c8e22fbe04630f5ce0c2676b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342816, "uuid": "6a5d2149-a43b-42d8-af0f-973eff72a99d", "comment": "Malware payload (Mirai)", "value": "86249c23fb04a939cafb1a581bc54fe241192e3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775342816, "uuid": "2cf969c9-4da9-460c-a09f-7f0c427922eb", "comment": "Malware payload (Mirai)", "value": "2bf7deb9ea4fbd8741f19c3cc331ad4bf13d1291450c12f07cf431eb23692fa4bc54d4349ea8912de4fe31d2e877a112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342816, "uuid": "b79d5714-953e-4ac6-96cf-9aba927a8282", "value": "T10893734D7E329F7CFAAD823483B74B659349379572D1C588D2ACE6011E7024E702FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342816, "uuid": "1a9e6866-e413-4b2a-8774-88717b7a3de1", "value": "1536:JCHlT3U88uOGcPI+6LnArqV+Gq9JOW8Hjz8dtUMsOphUHwQwiZwPps8kYCIY3ZAs:Jy3U88HOW6jz8HQwiZwPps8kYC3HFFRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775342816, "uuid": "1558ef36-87ba-41cb-b5e0-8c26207e255d", "value": 97520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775342816, "uuid": "8262f7c6-992e-46c6-8922-0dcdea13b2ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775342816, "uuid": "aa539603-6552-43f3-8be4-c347bf33c034", "value": "mao.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a7a831-3078-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775343096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343096, "uuid": "686e4153-74d8-40c2-bec0-978a650445aa", "comment": "Malware payload", "value": "4f7cd861fa842ef9834a26d8c03e59ce", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-9021", "colour": "#28C0DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343096, "uuid": "2d53117a-f70e-4cbc-85f4-90f0d7390136", "comment": "Malware payload", "value": "ac2315edaba7d5f4fc0708edda09ad06038509f7ef8c0614a3248d7d811d3f08", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-9021", "colour": "#28C0DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343096, "uuid": "0920f0ec-c4c4-47bf-867a-4dcc3210a681", "comment": "Malware payload", "value": "146f35b84a9843cb66ff67dbb55755144e8cae3c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-9021", "colour": "#28C0DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343096, "uuid": "971de9cb-358f-4ccf-9b8b-ee2f604ebf63", "comment": "Malware payload", "value": "27e7fdea248420b905f31bd6d4396874b0e06986d94074aa2edf51e6df67d8cf70c68e188ff8d7918286adf6795527a4", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-9021", "colour": "#28C0DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343096, "uuid": "75ed708c-86d5-4879-9259-c1dc86819bac", "value": "T1AB07336FE49D805C973879AB4CD20D9E14AA6A27CECAD1FFF0C16CD5DC6B3E44920846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343096, "uuid": "06fc0091-ac04-4025-aa98-8d9d984308b2", "value": "393216:0wT++H5+MH105TX2tgae6osi4MbUR11DTjyJ75Vyf:1++ZrH105LTL/3Ko5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343096, "uuid": "d9f684a0-aaee-4c2f-9b05-48fa28f020b4", "value": 16939267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343096, "uuid": "e9b43c17-5128-40ba-b68a-0124ed505e1d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343096, "uuid": "1511aba6-53ba-4d62-b189-1b1799268f5f", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cef652-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330055, "uuid": "a6bf2bfc-5c1e-415a-8022-938c5d7eece9", "comment": "Malware payload", "value": "68dcf39cfbd689d99c471c140300f110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330055, "uuid": "0878906b-cd8f-435d-9af4-1e2927b05d35", "comment": "Malware payload", "value": "ad5aec8723a8ab586cc8442cb7ee4794feb633b15a96d0b1d8ae924aa3a94986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330055, "uuid": "87fd6952-3f63-4647-8d8d-11bed34150dc", "comment": "Malware payload", "value": "c8dff84e50d1c00be26dc2bfab7c13341e51ead7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330055, "uuid": "d82c7232-fd8b-4917-a6c6-8bbe245057f1", "comment": "Malware payload", "value": "0ce4b499e4a0f44f22b3d6fd41eb50aa997b687e3f399631fbdd1d3ba8ba90e44e5fdefd5627793b7378c5bed8ec4539", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330055, "uuid": "142efba4-011d-43a5-842f-cafc26fc56ba", "value": "T19B341242FBC191B1E46703B40907DBEFCA34FA240150E5A6F395BA54B8F76C361AD7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330055, "uuid": "76baa971-3d98-4375-a906-e911c9c6ff1a", "value": "6144:0wM1mczgZ4GmRg87dvqqjpyuUjsoo8cFrPBESWGQAxyJUatxrNCxW:0wM1mcWgRg8Iqjpujsoo8qPBJAXPtxrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330055, "uuid": "003a8022-36b1-403a-9f66-392c078890db", "value": 246860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330055, "uuid": "6cf4cb46-4d3e-4a6d-b1e9-5bc86ea37feb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330055, "uuid": "da83b80e-835f-4388-854e-44723dcd70c9", "value": "3yahbbprg4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b203cd-3049-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775322827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322827, "uuid": "4da6aece-9cf0-4d36-bcfd-c925dd4effbb", "comment": "Malware payload", "value": "63f115a21a59470cfab2ae85c031f8d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322827, "uuid": "d6f03dfa-3330-4b04-af1d-121d38093c5c", "comment": "Malware payload", "value": "adf6ccf1703b78dec7662403b966f59f4d661232094d685b1a9c5d427f7afa85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322827, "uuid": "6086d87e-b412-4368-ac3a-16b3a2341f6c", "comment": "Malware payload", "value": "61d7466b8f5134f3848c7c1e881af21364ef11ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322827, "uuid": "4c9ebb89-3162-4469-9a04-a8f70fbd0dfe", "comment": "Malware payload", "value": "86e04748b3bfcf46e42cdc2ccd914ecd4f2412669b629626503485fedb1704151dd3fef05452816f85d07b7491f7b9aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322827, "uuid": "762fa778-838b-4c93-b509-2996a7928f0e", "value": "T19A36FA15AD826B66C2DC137845EF665722502E499B91072323A4FBF83E7333DAF5788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322827, "uuid": "de6d12d4-9a6a-435e-ad72-eb57c56f8381", "value": "49152:VN4FWaDsZhJ2pRhoIKDnL9l/EZl5tAAXgpDAfj11:VgDsZqpjoIKVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322827, "uuid": "d85ef31b-c843-4df8-a933-427fe4971961", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322827, "uuid": "6f8c53c7-c7f9-4296-8bc6-0278d1914f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322827, "uuid": "3ce30870-d90a-4adf-81de-c4fb39adff7a", "value": "linux_mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442e1909-3073-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775340704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340704, "uuid": "fdf2e1ad-3b33-4c75-8b42-ac53f22f8947", "comment": "Malware payload (Mirai)", "value": "55d37a9b876419cc5a5d2e96b47fce93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340704, "uuid": "10fde913-99cd-49ee-8a87-f8585af9a49b", "comment": "Malware payload (Mirai)", "value": "af4029c076c70e16d60cc07d811487c62168190f4a0934e8f098be2965812a9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340704, "uuid": "2eba6ca2-7eb9-4e06-89ea-eb2ea7db0790", "comment": "Malware payload (Mirai)", "value": "304d478f8f211b0a7b271f8b0a7ea6a540dbaf24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340704, "uuid": "c5650502-7a80-4c0d-9d23-f301416742c7", "comment": "Malware payload (Mirai)", "value": "e7c45205b030cf013a3b21358bce32d7a87b14db2551989196852b5ce1911e6424a8f59d0b400fe5268fa4a5d1278d54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340704, "uuid": "d6056eac-490b-42ea-9478-938aee0b6ff4", "value": "T1C0E34A46FA408E03C4D61775BB9F42493322A765E3DB73069D28BFB43F86A9E0E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340704, "uuid": "c210bb8b-f88c-4553-9d40-c745d2f6aa7c", "value": "3072:nUf9P6ZKqC6IV7ZoVKX3FSL+WSCc3dFe297QM/9NUh1mqwPYWVv:nA9P6thO76VKX3FSyWSHg29MM/9Wmqwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775340704, "uuid": "e2db551c-77e0-4b4c-b6c5-86ce546e0cdf", "value": 153822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775340704, "uuid": "778243c1-9742-4bf6-ab32-ef45da6f8fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340704, "uuid": "11e1ad65-bdd0-45fb-ab4d-3bc7b954f0f7", "value": "mao.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3552dcf9-3005-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775293435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293435, "uuid": "07eb5bcb-e051-481e-bbff-17ee6b53f72c", "comment": "Malware payload", "value": "90e5f4848b8f8b5776d4ed7c0b8b0334", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293435, "uuid": "5378757f-b22f-41ea-8073-7db437bdb3dc", "comment": "Malware payload", "value": "b10309e698fa671081f8e9858df639784416d6253fece6d19c2c4eb59bb2f3be", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293435, "uuid": "da71bf67-9f2c-4676-8b73-b32ed313e206", "comment": "Malware payload", "value": "69af78da5323e672f523f71bb761cca8901262f5", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775293435, "uuid": "ff58cdc5-fb79-41c2-b875-cf4e44679b3a", "comment": "Malware payload", "value": "5d2e6d827b9bfceff70d76ee1e6ff71e04432bd80e36001c5e216b18f421d165a3e212f4f43e01d32df05629cfe42cef", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293435, "uuid": "8f3aeaa4-edad-4c5e-8a32-c01fa0c5c42f", "value": "T1C24423F3DA83E210D57CEB6E1BEFC0BB343367944B6D7812AE8C95C969D441982685CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293435, "uuid": "5909669a-2237-4ed2-a4ba-28aee16b5616", "value": "6144:nwpPKu0siTF//5GnbIyLiyHGY71eNEu87xsiZnyJRF:OCPsqRBybItYJemnFFsRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775293435, "uuid": "4730fe70-0bee-4acc-aed1-b746b2402a2a", "value": 270576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775293435, "uuid": "062bcc33-5ac5-4a26-9c41-2d03293e6008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775293435, "uuid": "3e5f1d2b-36b9-4a2d-a3d0-e5ca4a537219", "value": "b10309e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b102fe-3047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775321755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321755, "uuid": "281c0e4e-775f-4df9-b077-3bae87e9b832", "comment": "Malware payload", "value": "1191afc2a50dc0219cbcefa4f21b6b25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321755, "uuid": "12b65136-05b1-4dae-ac3f-dde6aee1862d", "comment": "Malware payload", "value": "b2ab21ed0fddcdc854891499af9112a9319b8913be51f7d8556508b74c0268d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321755, "uuid": "1c6907dd-1605-4277-9f3b-ce11891c03aa", "comment": "Malware payload", "value": "fae33798caaf9e9bdf54fdebee5f113955223b24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775321755, "uuid": "107b800d-5661-4756-9cfb-734c3e11b206", "comment": "Malware payload", "value": "26ebecea91e968a4dfa8cea1b805bf1207c4f7b6bc96a6186a6b9eab3df9233e02f3192d87ce6fb24e0ecac0433dccbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321755, "uuid": "1802a6c1-3885-44cc-9f21-f7601a33325f", "value": "T17C16F850FECB10F6D9072D7054ABA22F17315D094B28DBC7EA64BF5AEA376921D3220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321755, "uuid": "9f3b6589-1136-4206-b5a6-208ab87162cf", "value": "49152:EITwZUDsRNoUcX6FhNK/VswbNWkXXTu0SZ60gk8KUfPPPwPPP3PPPlM5D11:jTChR2XohNo3uq2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775321755, "uuid": "f994e9d1-6361-4cf8-bcb2-62f39dcd0ae8", "value": 4321280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775321755, "uuid": "718e2a6d-650d-42a4-9162-e77c0daa886b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775321755, "uuid": "58063d3a-defb-48aa-b66f-f16297ebeab6", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4790811f-2fda-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274997, "uuid": "bd3069e6-60f0-4ada-a92b-5760cb59c4f8", "comment": "Malware payload (Mirai)", "value": "6623c645c7e044ba2982f28234ed36d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274997, "uuid": "6c6c325f-d992-4a1f-a50b-94fabafdef2e", "comment": "Malware payload (Mirai)", "value": "b2ac61a5ccc6dafff19c259de47fe5a60219bd6846a439a7e16f5ab660b2fb0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274997, "uuid": "8169eb24-d1a8-40f1-a46b-453de2a1b3f3", "comment": "Malware payload (Mirai)", "value": "1fa3b3e1e56c9e989f343025ff097256cae74fba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274997, "uuid": "968963ec-4b13-4ed4-94fe-8b694ed1d71f", "comment": "Malware payload (Mirai)", "value": "9d3a73891db4fb05a211f57245cc18d54a94d3438c40d28c419131b79efab58d066c7a91924600f07ca2e5943508d51b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274997, "uuid": "1e3b9d25-f387-4194-b975-f4e232af1126", "value": "T179E2E199E2C47955C6CD183D824002B196A930D2F32EAB5CE3358CD9E17FDAEA58F47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274997, "uuid": "6983fe1e-7473-4c07-b22e-76c86a03ee60", "value": "384:7m45+s7E+SpD30asNltLl+uK3HrolClj+UBTG3pgf+C0WgDIjo03onzHIsRWGVCY:/7k3BsNrl+dj+yTaTWUIH3oLWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274997, "uuid": "40071cd4-4479-4ba6-ba42-69022a8d2467", "value": 32872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274997, "uuid": "cd1ceaf5-489d-4105-abc4-c1fe37a81ef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274997, "uuid": "63838497-69d9-409d-b727-99c87718cb0f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754f3db7-307c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775344652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344652, "uuid": "75e59611-a5c5-421c-8a76-3bbdd51ed2cc", "comment": "Malware payload", "value": "231d0e95c31b453b9185101c673ba369", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344652, "uuid": "225d8092-0591-41e8-ac29-bf4c15ff1890", "comment": "Malware payload", "value": "b47c30daf96cc8b9b60854218b9b38e5993fda9bdb3b937a6a6ff69ee46f33e6", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344652, "uuid": "418c97ba-4ceb-4cd2-8a65-450367c514e8", "comment": "Malware payload", "value": "43ed4efbbf1b1b5a8c3d74519c557fd25e609140", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344652, "uuid": "424a09ef-788f-4afb-ab51-a0197191b16f", "comment": "Malware payload", "value": "6054bca38f38f723408154546a6ec29245875381d4c46e129b51bd7dc16c5e8bc9f61f832d0743de4aa3f82eb97bdfc9", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344652, "uuid": "3b9c53df-6d20-4e32-b5df-6d0ade8831e4", "value": "T128E38AB54B8A0BEE17CB291C916F1C058FE06AB7134CD599FB8ED5E16F88640D0CDAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344652, "uuid": "747d5816-b075-4216-9ed8-1dedd4899493", "value": "768:v54jGPqt73njbIFOtqQJnGDP67w5V3jQgyDhtsEWaVdv86jimpbdfK4wMwVCJati:c+SblvX+oqK56yXGBDQei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775344652, "uuid": "8376253e-79c1-4297-9b57-8b21cab7bbbb", "value": 155819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775344652, "uuid": "b275f324-b3fa-44b0-b680-5e1a810acc54", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344652, "uuid": "f2465c41-5206-4699-b69f-52641f26346c", "value": "Home_Video_Stable_309.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf8f52e-3018-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775301741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301741, "uuid": "288912ff-bd07-4833-a32d-91e5c9ba1c02", "comment": "Malware payload", "value": "bda99c4b67bbc35a3022dd317e9d8afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installcore", "colour": "#3C7F09", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301741, "uuid": "350687bf-a249-4326-bd77-4ae1591ffc82", "comment": "Malware payload", "value": "b4ee0f2a11ad40042208e1463610633996cd5201772d63298a782e90942319e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installcore", "colour": "#3C7F09", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301741, "uuid": "fecbfea0-5578-4711-b5c5-74936777d943", "comment": "Malware payload", "value": "6a540a28e09cd57a680352a6adec97c1c859b495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installcore", "colour": "#3C7F09", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775301741, "uuid": "ee842bc6-b32d-4ac2-a7ae-644ed839c332", "comment": "Malware payload", "value": "c0df905525d75545687ee7d64c92e3e825f2c42b1ce5e460282539dcbd339bd9ee90e61f579d69f0e9ec8d784a898da9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installcore", "colour": "#3C7F09", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301741, "uuid": "5b1628d3-0d8e-4084-a6ab-2cd063fc719e", "value": "T19A073347C4C899E9C171AD3D760143BBB1E23E109A2CB91D37A538D29F3907CA4DBE66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301741, "uuid": "66ada326-54de-473b-bdf7-5c23f7c6b6fb", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301741, "uuid": "2c3302cb-7453-4a54-8526-791c38f40678", "value": "393216:0n0mrlc7LVVZpxsCCfxKtlkyU7MqjDxSaqIX5/ry7hy8Q:00mruvVVfx8xKtKyUwaDxSaqIX52lyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775301741, "uuid": "17345735-1c16-4942-9cbd-92aee5b55027", "value": 18456546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775301741, "uuid": "a179b5bd-1b9f-4e0b-9c60-12655791fef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775301741, "uuid": "ae10e117-ec92-403b-a4ef-dcc8c5e0cc71", "value": "Activation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed141e4-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330038, "uuid": "09b0cdb8-c4a5-4bdc-8794-b2b4f9450d06", "comment": "Malware payload", "value": "3c3a94b8baeebe520dc3d2f7dcc806b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330038, "uuid": "e81ea330-91a8-4f53-9ef8-f695b72a4f16", "comment": "Malware payload", "value": "b5edb9fc654b260661c83360090194e1951a2d7932fc3c9d8354c3687507343b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330038, "uuid": "9480c101-7240-4c24-aad2-6e59f25b7be3", "comment": "Malware payload", "value": "c698d5becad82b93add314bb998be90a1afe49e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330038, "uuid": "a1c67623-36f3-44ed-b540-f3117eb2ef9b", "comment": "Malware payload", "value": "f8726f3b81324cc6df87fab40e84e0511dc2c92ff5df40497ba24bab382739dc350b7ebe158bb3f9377b876688f21510", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330038, "uuid": "8384088d-b95c-44ef-a206-8cc7d785d864", "value": "T10C440225F090EBA3C6D16B7BF90E565973030770E3DD3301DE2A8A3563E2A568F36652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330038, "uuid": "03982c3a-e575-470f-9041-b64afa1ced4b", "value": "6144:SiqQbbQ2sG+RtTJtCOCWROchiFuo9M/6Sd+7H0:hqSc2sG+RQVWSqST7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330038, "uuid": "f8ffb63d-8c45-4136-b28b-52feee3c4e1e", "value": 253697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330038, "uuid": "e936674b-3c4b-4124-a9b1-22088d36464b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330038, "uuid": "fd5d4032-a948-45a3-8166-0443ef689106", "value": "547e510g2m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a601e17-3079-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775343238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343238, "uuid": "17ce3088-4a0f-470f-8383-6e36c1f1441b", "comment": "Malware payload", "value": "d95a330f96fbcb45c9c9c2dba7c4b785", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343238, "uuid": "241cc791-8f8e-44bd-bcb2-0e6e380a9365", "comment": "Malware payload", "value": "b63fd6ecdd499ce99543a879f06817f602675b05eca7fc15a47908941e1877c6", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343238, "uuid": "ee65d1bc-6846-44a9-8d78-358d1d81c2ef", "comment": "Malware payload", "value": "b623a9409b2c442785530269143527e1daf3b6e3", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343238, "uuid": "3fd492a8-efd3-4cbc-a876-85c94f9c9d36", "comment": "Malware payload", "value": "124b7350d41fa989e1ea8088f2513c84f4b63fe946f8ed68ad2317b286d7bf4b361ddf09f7a026d0b0ba1cf1e49c8f92", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343238, "uuid": "194024ec-b10b-4e09-808c-e32d6ff9ce3b", "value": "T174873355D182C085ED26187D88177C8BFDA331927199223CB6DA231CFA4A3DB737B762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343238, "uuid": "afc769c1-60db-4383-98ff-53b16843c99f", "value": "786432:yb4+UMf2EY/a035ANF03GHWHd1Rju5Yb0qIuaal0sBe/sOkpYy1fxNVb:yb4m2EY/a035ANFkmYRju/qIu0s4kOk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343238, "uuid": "de30c3f4-06c1-434c-aa9e-b2ad834ac004", "value": 38989042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343238, "uuid": "ad20486b-1fc3-4a15-a26f-d22b2e0de99b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343238, "uuid": "b3a621df-c963-40b9-b942-a2afc0f8c62a", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef603f77-2ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287734, "uuid": "a8859ebc-2cf3-44a6-9117-a7ee766033bb", "comment": "Malware payload (Mirai)", "value": "022d2bb5e28c45a4a407c96cbf56daef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287734, "uuid": "b795d7ee-aac2-49e5-858a-cc66ff4b3822", "comment": "Malware payload (Mirai)", "value": "b7932979225b9b488aa7006b36c47c519814ad740d49db59aa59a7c69d2c89bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287734, "uuid": "e45b76a0-3b1b-4bae-86ac-672e1d5309d4", "comment": "Malware payload (Mirai)", "value": "8e2abc89348628f4361d2156c74602c4eb179a16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287734, "uuid": "52b3314f-64b7-4e2d-83dd-43b96cd7e3b5", "comment": "Malware payload (Mirai)", "value": "6d6ab392f11c5671fe83ff30ae8c1c2dd43d13afc986d5398226839772db5aac80938b013d01a4e8865f688fcef10005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287734, "uuid": "80f6d5ed-fc9d-4ff3-af72-16b6195e0df2", "value": "T1A6336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287734, "uuid": "8908011d-5631-47de-ba23-ebedfd4b42b5", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287734, "uuid": "df81d3af-d07e-49fd-ac43-cd32ba84c5d5", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287734, "uuid": "0cf0e053-e67e-4085-a8d6-c3abeb1a519f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287734, "uuid": "3293de3e-65b1-4e80-ad35-dfdb8f216877", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a18af6-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330042, "uuid": "ea1a9200-4e3a-4973-a5ef-37cf049e0947", "comment": "Malware payload", "value": "0143eb760a1119e56b6844e20a1bb106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330042, "uuid": "c1f6a4ab-64e2-4ef5-bc53-fe41f3c1a223", "comment": "Malware payload", "value": "bbf512e2470851f6cb53f8874846a9fcc58b741a1e0662b2fa1b8890004e04ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330042, "uuid": "d959f10c-aa56-4f53-a027-d49c48aa57b7", "comment": "Malware payload", "value": "e48ac53edc9ae288879cc41079ead77d96a3deb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330042, "uuid": "9ba009eb-7728-42c9-9e1c-fa7694e6d7a6", "comment": "Malware payload", "value": "d3051289317158bae6fc59cb2c276b7c79de318da0c28b1bd318a73ac79b2857124fd2454a9fa38061c47b604798f7cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330042, "uuid": "35a2bdbf-0230-4fff-8c86-11a55b680864", "value": "T1B9340141FAA1EFA2D3C2917AFD8E405833231775E2AA7345DC34AA3073C66665F3B191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330042, "uuid": "1a2b8b11-b2f7-4f8f-8028-5a160f5b56d0", "value": "6144:6derbsQ6WW5nUuryzcDDyK/VPNhCoFeXktWWpur5tLJaIyuqngP/:keHzNWFtrySyUNhVsklY5toIyuqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330042, "uuid": "151442bb-7aca-4f4a-96e1-b5b4c0af5127", "value": 250505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330042, "uuid": "a53948ee-0747-4023-b84b-9ab73b3e35a0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330042, "uuid": "18eab29d-46cc-42fc-9537-988a5d1e0a19", "value": "rigdtn0fpm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf9b2b1-3078-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775343160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343160, "uuid": "e5856c29-5b9c-40df-8eb5-deef751f0f08", "comment": "Malware payload", "value": "12caa5508e2fd2da4bfb32a86c7b2be5", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343160, "uuid": "12548efc-b4b8-4af9-a0ca-487b1f6a72b5", "comment": "Malware payload", "value": "bc4a31ab9b4467ee615cf7f91be716a1003cddf234a8ad43c2f6813ca2b5f6ed", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343160, "uuid": "030ddb8b-616d-4732-bec5-b298fffd68e8", "comment": "Malware payload", "value": "4a8f012c86a1f8b1a152b9960432aeb78def7e25", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343160, "uuid": "494b1ac2-e723-4bed-9b62-b7fe73ef06d6", "comment": "Malware payload", "value": "1934e404abd1cb87fcee0d259aa88908572672157a237af6108e5ae268fa0b2af42eb8ece99ad2c1d067586afa337c4f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343160, "uuid": "3a2d1b3e-8de9-421a-ab0d-7fce7b652732", "value": "T1925733A3E6DC0ABDEB9758BF1CF1F9462BAF4502369608779C4DC6D8087339A05D8931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343160, "uuid": "6301a530-53a1-45b2-9d07-c2c6050de76e", "value": "786432:+bNTd5X8ZBIpNx2h0pH7JdqzwJVeTW7grW:kR5X8cpNx2h0pH7JdqEJYTW0rW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343160, "uuid": "a4d598ac-ea5a-4e58-bb85-e49578e03151", "value": 28270089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343160, "uuid": "ca664dc1-f619-4d88-9629-5b17d590830e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343160, "uuid": "6b09bc33-51e4-4a8d-8e0a-3e85b22bc742", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741bf03b-305a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775330047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330047, "uuid": "15fab5a3-461b-43af-8070-cd0f3c635410", "comment": "Malware payload", "value": "09423ac616ce71323ab19b0d5a5bd262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330047, "uuid": "6868fec9-b6de-4f08-9f3c-187ae9bd9b7f", "comment": "Malware payload", "value": "bd4445aa5dd492a8c177bceff7a4ef8a9b333fb95a8d7bdf5e8fb3161259da98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330047, "uuid": "4fd84ad2-d534-4cb0-9ceb-cd0caeb4ae5c", "comment": "Malware payload", "value": "09d9c40dbfdfd0d00b75b40eba7086ea83951d13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775330047, "uuid": "6d8a1507-3220-4e07-9bbd-0fdc7ff79480", "comment": "Malware payload", "value": "60d32da9d7c857c3be22db70b16daba8ed81df522570da696d83f55e7a6add2dfc85bde041fc9914d56153b412f2892e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330047, "uuid": "d4cf0981-9ec5-49ac-94af-8de1d19557f1", "value": "T1E74402D8F0918B72D9E0217FFB4F695D7713072DE2D933015E195A2937E3A6B0E22682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330047, "uuid": "5ca0302b-17cc-41a8-8ccd-ea06c0c939ba", "value": "6144:2JHQbbQowPuo8moGcyht/OREaT5QbYo8/e/NxpJmi8j:CHSclPudixGRubYo8m/JU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775330047, "uuid": "3670d1ee-3697-4d9d-8cb2-af891c45c4ad", "value": 253653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775330047, "uuid": "0503e52c-80be-4ccd-ac89-ce923212d563", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775330047, "uuid": "9eb5d120-6187-4b19-8a66-04502d70a452", "value": "rduiqsxg66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab3701c-3043-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775320019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775320019, "uuid": "27e36f42-3312-4c5c-b68c-0aaee75807ca", "comment": "Malware payload", "value": "e480a820782bcaaa67340ff5285147a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775320019, "uuid": "2e05436b-0ad4-4f73-9287-a976719164a3", "comment": "Malware payload", "value": "bfd8383d7a4e25a23a5a598aef98a09d3f92ed6535a4fe7885f3749a6a8751e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775320019, "uuid": "bfbfb800-8dff-47f2-bbe8-69bd809972f6", "comment": "Malware payload", "value": "9f6e54d838de6b8401d15dc04e1bebc0b191ce47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775320019, "uuid": "c477d46d-99d3-4a2e-8b91-0c34c23d325e", "comment": "Malware payload", "value": "7e841abf0d7834818666484c1b92ee0105b77944283d3eb09935245f7ca3982b3bd3d7222cc74a85053be4c76dc21196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775320019, "uuid": "7be83ec7-0e4a-4d95-bf2c-e295a4d97728", "value": "T157262A136E18E71EC66911345CB2CEA8673A1C8A85D7A917B345F309B9F20BC496FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775320019, "uuid": "b02d3bcb-0762-41da-92a0-11291a1ccbb0", "value": "49152:7gSY8hicBZ1reTK3J33N8a0NXTG3J3vB8uQ9uVWxQaF32yQMzFXR7ZJ2/bTrjIIr:cSvaUbQrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775320019, "uuid": "3127fe2d-c58c-425e-bcfd-54b258ef99ce", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775320019, "uuid": "4c8c442b-87a2-48e8-989d-0002b965bcd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775320019, "uuid": "48b4489e-01ef-4aff-8633-37d833c870ac", "value": "linux_mips_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804a1f14-3048-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775322337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322337, "uuid": "06efdc2a-c86f-4512-aa8c-d2756ea68713", "comment": "Malware payload", "value": "73f0f1f6807ff8d9bff74f54d2eeb8bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322337, "uuid": "caf168d7-2517-4a07-a9b2-646229931966", "comment": "Malware payload", "value": "c00a5021dfb1e6347acde766a7da7fab455e1d43fa3e472be4ba9ca94343f32f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322337, "uuid": "4dca5904-d0db-4ab7-99e3-999bda4edcd7", "comment": "Malware payload", "value": "f91d6d4d44d299b6459441fb35a338f53285be3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322337, "uuid": "3c6d6c43-bbc2-4f29-8570-e1c0161a1fd2", "comment": "Malware payload", "value": "2fc9d08ce7c912a16475edff8c51d0a0078d07c62da4054d46d224df3d2bb470607d8a420dddd6dc7bf42828edfa4eed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322337, "uuid": "5fec25da-cc14-491b-b773-784cae73d32a", "value": "T18A167D98FC2DB462E9D87DB83F6502947135FD899F40C3276618FB9DA9F23248F21660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322337, "uuid": "631ea13d-9ae1-4e12-8a4f-185dfb594b59", "value": "49152:Rt5ff5Vspxs8pD4iMUp+5gY5EKOMzDGKYz1V:Zff5VaxsbiMUg57ETV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322337, "uuid": "ca35553d-8d3f-41b6-b406-829b4a83aa09", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322337, "uuid": "3d1e12b7-e45a-4b10-ab4e-5f1c76fdf097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322337, "uuid": "b81f1cc4-d17e-4d90-a8f8-c0401b71a2cd", "value": "linux_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283f7712-2fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775265496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775265496, "uuid": "bf32abda-83d0-472f-8ba7-9964f3e571d8", "comment": "Malware payload (LummaStealer)", "value": "26d986ea3444451dce9cc9dcf26beb62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775265496, "uuid": "242e2d6f-0d28-4965-91a1-128a670e24c2", "comment": "Malware payload (LummaStealer)", "value": "c03ca9e42802851951cac696aa7ac0ae80fa07e4b188c2e26ca73845f6542200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775265496, "uuid": "3d3d2b6d-9857-43e2-a48f-31cff067a1e7", "comment": "Malware payload (LummaStealer)", "value": "836346f1244b21227282199dfee2bf3a9c54d58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775265496, "uuid": "8f85cbd1-42c4-4614-8c29-351bcee61a9a", "comment": "Malware payload (LummaStealer)", "value": "01aa7868b3673776a820786ec27960f0735cd62477a29674c4d808668a5b5472b374b9b4651cdc3d26eccf56b1be3d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775265496, "uuid": "371d114e-ed4a-40d5-9761-9dfab43615d5", "value": "T13F356A13FB9185E5D66A05325B648295973EF531AA0B5792BA8C131CCF233878F26F3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775265496, "uuid": "7622c13c-70ab-4e3b-9ba7-04cc7c2ffe5d", "value": "94cd17a90636cb267d691bb44bc51094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775265496, "uuid": "0adf0264-c9c8-4173-ae09-73edc9730b03", "value": "12288:EzSrRWyZSVt/sZS5EOgq4hlJMAgh0/L1iA15mer5+nIKer5+nso:EzmZwtUZS5/gplJCPA7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775265496, "uuid": "9fb7c20b-8267-43ea-a908-c7087ba9e34d", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775265496, "uuid": "4fe85645-5836-4281-8bcd-1de549b22b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775265496, "uuid": "9f05e11b-8313-4283-961c-19db1083d482", "value": "c03ca9e42802851951cac696aa7ac0ae80fa07e4b188c2e26ca73845f6542200.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c5a4e8-305d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775331253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331253, "uuid": "094a0130-f7d0-4690-9886-053f959b892b", "comment": "Malware payload", "value": "78e2aa7a0149f0e4b54cf5c0b7d3ccc2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331253, "uuid": "338e6afd-288f-439c-b38e-3d7dfdeb85ff", "comment": "Malware payload", "value": "c1183c6868bf4e006ba412a538a3a07dadbaeded2be6f148765decf69dc284ec", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331253, "uuid": "2ee1bc58-3e7f-41f9-a52d-f7721dcacf2a", "comment": "Malware payload", "value": "ed0df99a61972d753dd73e87748f24607e58320d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775331253, "uuid": "267997d5-7ddb-4fd1-b3d1-9aceed69fba1", "comment": "Malware payload", "value": "2383159ba0766f29c2607ffa877da8d696f08b184a261336cbda97ba4d4143af3cc5369e12acffc532ec18ddb6b085e6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331253, "uuid": "48304f37-2871-4e29-85b6-217e2bbe1456", "value": "T19DC312DAA9C4FCA3CABD5C79C8304138FF913224E1D1FB4A99255231C5A34758E62D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331253, "uuid": "c592c321-f657-47b9-9fbb-84ec1e33110d", "value": "1536:X9v05Se+UwBx84E4uAXQlcWrZvS00eV688DANSct9eISuGyPJdiislf5hh+8cc3g:NvQjwBMAghNZV68C69/tlP2isxYB1sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775331253, "uuid": "704578e7-0f59-4623-bd19-a4d8caada35e", "value": 126842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775331253, "uuid": "35683884-05a4-44bd-9061-5b33d55596d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775331253, "uuid": "4e829819-f613-4cd0-9b64-5209451edc27", "value": "MadHineks 2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb6f925-3052-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1775326846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775326846, "uuid": "c8d931c1-1fd6-4741-ab45-3d790a679b2a", "comment": "Malware payload (EternalRocks)", "value": "abe99d1442050f71efc2eca60d7f2566", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775326846, "uuid": "a98f46c3-6e2c-4c3a-9b7c-423c6fba74bf", "comment": "Malware payload (EternalRocks)", "value": "c12c26d5611a06a9ba3a146fa96adadef4e520f28a8e3793837bf9e82ae0f4b9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775326846, "uuid": "2964c500-02ae-4be0-939b-501ffef144e2", "comment": "Malware payload (EternalRocks)", "value": "48c5b9d78be2b25e3abb0d930ce133ba4bbacc3f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775326846, "uuid": "dedc9431-9c7e-40bd-b825-69f79ae0d755", "comment": "Malware payload (EternalRocks)", "value": "fb7dcd6b700cbeb40b2e975bb9e2e98b3f144f48cccdee5c0c7428b75785e36d7427b341c9cbc2a02c61ccf4b20bad0c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775326846, "uuid": "37c1650f-77ca-4257-ab1d-799c20d61f6d", "value": "T1409523E161631F224B509127FDFF0F161B4D8983582C95A263C3BCAF536AF208D799E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775326846, "uuid": "cdfd7a63-ea00-43ac-a64b-2d382041876a", "value": "24576:7a/sfjfoPnkiEapPHlKPcVcnn1FL+tkAxourJFNri3jUHlS2JAq+pTyetuGGscbd:OfcnnQxourIS5qorTnnBuWxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775326846, "uuid": "440d0c5f-8cf8-42cd-9990-8b53b9447657", "value": 1976323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775326846, "uuid": "0523faf1-e3d1-4e6e-8624-1b01ae5bbbef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775326846, "uuid": "09ff6089-edec-4f50-bb6a-d42ebc97b02f", "value": "svchost_7e95.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627b20f7-3072-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775340326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340326, "uuid": "60478ca1-b338-4f6d-b607-601ed4813725", "comment": "Malware payload (ValleyRAT)", "value": "cc218e25ac3a4a985ef69966094ce4bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340326, "uuid": "8b3d4304-1028-4a2f-9289-b85a0699e658", "comment": "Malware payload (ValleyRAT)", "value": "c4f096b50ac4b00583cba6f798cd667f53d0e8c4298b123214528b7ec13a4a99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340326, "uuid": "34eb291d-4eba-4c21-8803-d6a6362f5187", "comment": "Malware payload (ValleyRAT)", "value": "594968a081e75af621bbf9a1dade873280b1aa77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340326, "uuid": "621a449d-64b9-4b53-b8c2-921e63eae326", "comment": "Malware payload (ValleyRAT)", "value": "63ef15a9c1475b2ae70bfcb3ee59c7873a086322522f26d040278594de07fd8474cf8f82f51169578e569b6d3bed0475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340326, "uuid": "0ae1f5eb-3abe-42dd-949a-76d99e63b507", "value": "T138549E99A2740CEDF4E762B084582907EEF7F69767E25A0F03A6C2613F332505D2E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340326, "uuid": "7684b61d-2d53-4818-9de4-a300c726ab26", "value": "88043b01b223f7d83fe853aa5b66ad2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340326, "uuid": "96ad8efa-6976-4824-a318-353c70413e79", "value": "6144:OaiuXZEsLOUJsBPvbUkhP0MxpSANyK+JRIAgrZ/AtFW:x3pHLpJoPvrhP5quyK+JyAgrZ/Ats", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775340326, "uuid": "614523af-a3d9-4fb2-8a02-628c91735bba", "value": 302328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775340326, "uuid": "2b31f410-20b2-49cf-b7bd-d7d827c7c980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340326, "uuid": "3df5e41f-bb0b-4df2-9836-45cba4405da3", "value": "c4f096b50ac4b00583cba6f798cd667f53d0e8c4298b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978ce6da-301d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775303907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303907, "uuid": "2ed8d3f4-4d52-4b56-bc23-b5ddfbb84ab3", "comment": "Malware payload", "value": "fdc53430902e607541a49bbcd79bfeba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303907, "uuid": "2ba6e52f-99db-43d7-a9cf-bb244e735953", "comment": "Malware payload", "value": "c5d959e0fa47a9321072cf5a3c36b2bd8110809ae973ae0cad0b6e510bc4cddd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303907, "uuid": "be230b67-7093-439d-a059-430ff7678f38", "comment": "Malware payload", "value": "3df94df81cb7b4489090284de4f5a44115676176", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775303907, "uuid": "d8a766e9-95e0-4236-bd71-22f0c62d2538", "comment": "Malware payload", "value": "d77206fc6cf81e186420cd7157c76172570c4c8371b151e80a17ff7293d376e65d912e4dcfbb78d54824b0da93017d20", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303907, "uuid": "2e07d4bd-1088-4c6a-a826-1d367865c677", "value": "T14811AB6A5681E42477248F69E0A9817134CE3D43C4990BA47CEF5A397BFDD98A240E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303907, "uuid": "efa0bacb-3b8b-4f64-bf81-5ba4cb820832", "value": "12:lHZLTPFKcqL8sPgUgqKEM4yCLSUxXKAFhBEBFDgq4ZegqOEn9Ny7o2WA7:V1C8sPgwMfCGUwgYXgkG49Ny7oP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775303907, "uuid": "18996860-2591-495c-a855-7ebab28d9687", "value": 857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775303907, "uuid": "b877d08f-170e-4c41-b18b-26991053bd4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775303907, "uuid": "5bd103df-c039-4280-8066-1a87a5ff54a3", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f109ec7-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274097, "uuid": "f6f1798f-651b-44b9-b951-e8605b9d02bf", "comment": "Malware payload (Mirai)", "value": "a2422a37aca2f96f5376af006693847c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274097, "uuid": "b96f82bf-f006-4acd-9f3e-161f44be7b42", "comment": "Malware payload (Mirai)", "value": "c6c5e873cc274b60aedc65d551feb67406592f85101aa7c133fa73a91368d7d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274097, "uuid": "645e11b4-f966-484c-aa74-4d4e47caf0c5", "comment": "Malware payload (Mirai)", "value": "4aa4ca24f23b64e322b0bce51a34fd715b922f87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274097, "uuid": "1640feba-c0ba-46f3-9320-05d8ac9dba84", "comment": "Malware payload (Mirai)", "value": "a254dbe2a5dde065ea5fe8ef2e71195a62420d99eb302c6f6bf1c9aed0751901495bec94c6a0befaae1e01f62519d23d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274097, "uuid": "049fd33e-0e38-43ed-9d0a-763f31d19d2c", "value": "T14693B81F6E218FBDF759863147B78A22A39833C627E1D685E25CD6005F6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274097, "uuid": "46163bc0-74c3-461f-a32b-ab41139b231d", "value": "1536:RB8aZkDrEr1NvfPxfLCz/TTen2ZbvTHA+k:XZkDwr1NPxfLCz/TBHrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274097, "uuid": "cf4be907-70cc-445e-a09f-44ee96d26965", "value": 93316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274097, "uuid": "58867393-bb16-4890-a2a0-92b56c799f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274097, "uuid": "7d0751f8-bb7f-4163-8a27-a0ae8676bd54", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4ab8ce-2fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1775263625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775263625, "uuid": "0b47f7ac-a100-4d6e-8cbb-826618453a6b", "comment": "Malware payload (DonutLoader)", "value": "e2e0e98a1c9acc35f03c1f6019e85310", "object_relation": "md5", "Tag": [ { "name": "196-18-12-167", "colour": "#2145DF", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775263625, "uuid": "3eab65c3-1308-49c0-a4b3-405d0a677b13", "comment": "Malware payload (DonutLoader)", "value": "c728ba9c4739afed161d151b4e0ab5875b77ecf2e4bbd83b8c8e010715ec940a", "object_relation": "sha256", "Tag": [ { "name": "196-18-12-167", "colour": "#2145DF", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775263625, "uuid": "b905eae2-e92f-4cb9-a6e4-5efb57959467", "comment": "Malware payload (DonutLoader)", "value": "31f17ddfac1869323bb54c4c422361fd9418f973", "object_relation": "sha1", "Tag": [ { "name": "196-18-12-167", "colour": "#2145DF", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775263625, "uuid": "980fa7c2-16b6-4e9e-bb1c-47457bd57ded", "comment": "Malware payload (DonutLoader)", "value": "8b8449a0d8f61a18e9c2aa3ac317b57c5405572d83de09d9c2003451dad809858ec22534fb7a34a70c1515dcc91487bb", "object_relation": "sha3-384", "Tag": [ { "name": "196-18-12-167", "colour": "#2145DF", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775263625, "uuid": "29c9da35-3d0f-445c-8999-f39b71b26ab0", "value": "T12B56334A42860FBEDE59843C6ED85B26F503D688077F45E46B16AA8E6C0EFD20537F70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775263625, "uuid": "8d7eb1f4-bdd4-4c88-82de-9acef401d4a1", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775263625, "uuid": "ac6f8916-bdb1-453a-bb34-12fca8f2431c", "value": "98304:dod5guJwU6+TrzGSDx0c217ara9+qttw2nTEwxIL5hi/jZRMjwt6N3:dodiuJRdvvDx0Bsq3hdYhQjfMkkN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775263625, "uuid": "9f7d2cc0-2c24-4f73-b8a1-8969deb1a5cc", "value": 6085632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775263625, "uuid": "786ae4e8-5c2c-4936-b742-48bb187a42c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775263625, "uuid": "47f1addd-0e56-40f2-a6d5-d55aadf47367", "value": "GitHubDesktopHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae0021b-3078-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775343024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343024, "uuid": "e19a0a2c-707b-4a2f-b129-3941bb1427ff", "comment": "Malware payload", "value": "81b3654315c8a75171ff819bbd5adfef", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343024, "uuid": "e219f95e-d4ef-458e-a8ed-ef47d4db2682", "comment": "Malware payload", "value": "c9ac5822596de160e487ae3a017bdf0aed2d1cef43cb4b61c920779ecf6a1464", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343024, "uuid": "b69d02d2-7ef8-4904-bb10-08322ce9ffe8", "comment": "Malware payload", "value": "95efd49a88f53302570dc01943b64d596588c094", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343024, "uuid": "c8d59113-5f79-4fc9-a59c-3fa88a50cfbb", "comment": "Malware payload", "value": "ffce79c935c6caea1883987fd2eaac237246d26c6fa9488b1020ef0798176caff936da29f08e261887fc39a1d89f35b7", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343024, "uuid": "8c23af21-00e8-47e5-b446-777718cf7cee", "value": "T1F51733D6FB02421ACA5B5B766A71C26C3F376F82E40C854C31AF64BDEA7F276E940114", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343024, "uuid": "d985b785-e521-4d37-aebe-aad3ed0185e0", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343024, "uuid": "477be984-5996-4134-8e48-c58813c81a9e", "value": "393216:0pYV76aS61tWwrfDkKO4A3Il2a3q5Q0Y98C7Cib4:02/lOiUa3AlY980CE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343024, "uuid": "7c5a52e7-f09b-4000-8028-e2a3dca0ca77", "value": 19561472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343024, "uuid": "1f7b6b42-18f3-43ac-a47d-eb9e696d929d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343024, "uuid": "d151aee3-cada-43aa-a3f4-34b6fb972657", "value": "Installer_v6410_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d592f290-3039-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775316037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316037, "uuid": "60c73e1e-e3b3-4b28-9371-21db9c38f481", "comment": "Malware payload", "value": "ca11e3ce3ab40f1354d1046aa425056a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316037, "uuid": "e3138bf1-2b30-4eaa-a58b-0e8a44bef90c", "comment": "Malware payload", "value": "ccb048361a5cdf60c7c93ebf1fd07717137780279386a46d51b6072c34c365cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316037, "uuid": "1bce99c7-70e4-44ca-adb4-0226eb4212cb", "comment": "Malware payload", "value": "ca52795afe8e210e9bb8ed7d8feec61306b31390", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775316037, "uuid": "cd405d5c-8d7f-4046-8e8c-6515755b596b", "comment": "Malware payload", "value": "6a52f20c1664887b0cd374e6093941217d6a8fb93eae123fbd93c1e773035a10b0c28c5aadaa5d14d40fa0ccfd8ab006", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316037, "uuid": "23007ef8-c91b-47df-84f4-9ec4d93ed3e1", "value": "T10EB2F299DFF68259F0805D4CCE8B4C3A26B56A8AD8BCE17064C73E56373C7EC4342518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316037, "uuid": "391b4a0f-169d-4064-8c1d-0776b69c05f9", "value": "384:A3IsCS+pqqlmlmRyuDFm4mvsiN5SeXn+hUU1ns5tE/6OPu5oTnmr+w33nfxk1:+Cnpplly55Sun+zsTECgOcg+wZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775316037, "uuid": "f52a3b29-9f83-439a-aefd-8fd72c62b69e", "value": 23724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775316037, "uuid": "53e7fd24-2ca0-4d97-bdfc-4813491efba7", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775316037, "uuid": "3cabdc82-a419-4a26-a14e-dc7a46b9ac0c", "value": "clawrtc-1.5.0.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40619962-3024-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775306768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775306768, "uuid": "8bf8eb8e-888c-4e2c-9c84-a56ffe75f403", "comment": "Malware payload", "value": "d8fc4ec486ae9f276f2a699c844212b0", "object_relation": "md5", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775306768, "uuid": "06a81bd2-7477-47f2-a76e-51a85572b634", "comment": "Malware payload", "value": "ccc65c122f832c8a20c447c04452cbb8285da642e944d4b0cca96f739dcbe50f", "object_relation": "sha256", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775306768, "uuid": "58c6ff7b-352c-4206-9299-1212d3f00f7f", "comment": "Malware payload", "value": "1b56dfc3f916d540984eb049efa86821ad99193c", "object_relation": "sha1", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775306768, "uuid": "25f703d7-fe59-4070-90cc-9412d7549a6c", "comment": "Malware payload", "value": "ca758a2bddeee3b8d2df06b27e8874e1b14f61806701e30b2c224cccda070d844e83d4630159f299efe0d696ea90e988", "object_relation": "sha3-384", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775306768, "uuid": "1c23f622-60b9-436f-8970-e1bfee6e03d2", "value": "T1888533EE1A809569D77313BDD0106927F431B8DC880508A8BA9B7375FCB9AC7D167F88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775306768, "uuid": "6f785966-e347-4cea-9e05-bb17cf01a9a2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775306768, "uuid": "f0ba1f8e-a2b9-4bdd-9c0a-867d1f5880e7", "value": "24576:Dsyb7QQ6ehATZ0+KMRjFLGfBzVQc+3ILcs9L2jWmG+klRXQfEaJqh+XB1iwNpiJo:Iy4j5yfB9+3ScCL2h6/0PLiwNpMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775306768, "uuid": "d1f504f1-d722-4a9c-bad6-a5bdfd3778d0", "value": 1760256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775306768, "uuid": "50ef977a-3654-4fd0-a4b7-51d6d02343ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775306768, "uuid": "826199de-a997-446a-a859-acac0622a621", "value": "ccc65c122f832c8a20c447c04452cbb8285da642e944d4b0cca96f739dcbe50f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba59a52b-3016-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775300959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775300959, "uuid": "8b290bcb-16b2-4dbe-8f05-a1bdd2054822", "comment": "Malware payload", "value": "8d65e3fa825142e2ff3a2169b20bd219", "object_relation": "md5", "Tag": [ { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "postinstall", "colour": "#43C15A", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775300959, "uuid": "2563d6eb-dadf-49f5-ac8a-256f81b52e28", "comment": "Malware payload", "value": "ccf0752db733147ea5ed9e1d2ab0b1f66df29f79feaf97044735a51eb2e1097e", "object_relation": "sha256", "Tag": [ { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "postinstall", "colour": "#43C15A", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775300959, "uuid": "bb5299ee-9065-4bc2-837a-6295aae95ef8", "comment": "Malware payload", "value": "1c17ab4158207462dfdcfbdad0e58fcfb7460293", "object_relation": "sha1", "Tag": [ { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "postinstall", "colour": "#43C15A", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775300959, "uuid": "b3b4b7b5-f39e-4956-8536-3065b10bf55f", "comment": "Malware payload", "value": "8d89711899162ef650454b51eb7d2f50ac69bef9b4603b0dabd728d9ca57b8334129d1b99f68e906f53132dce860a55e", "object_relation": "sha3-384", "Tag": [ { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "postinstall", "colour": "#43C15A", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775300959, "uuid": "b4414977-645d-47f9-a478-7555abe33174", "value": "T1B1A17EE96DF375B5C9410DFE48F4516181A711613E70501B9CD8EC806A44AC35EE3BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775300959, "uuid": "31f7270d-e269-49a0-b636-e1369e96d9c0", "value": "96:E3xztCH+Ovdxs0akhok36N5Xps9rCKbBWWuhCx13iNzTM6VzcWkk:mtCeYxs0ag6Nh1hhO3iNX11ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775300959, "uuid": "4df36932-4484-4f15-ba68-e5d85a412744", "value": 4835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775300959, "uuid": "f6f9f918-9f22-4d29-bd8b-7e07e1b277ee", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775300959, "uuid": "da86c686-6378-4915-ba79-8a99468ae33c", "value": "npm_strapi_nordica_tools_3.6.10.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1f2404-3035-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775314169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775314169, "uuid": "84f0db38-173a-4459-a2f0-26edf14f7ab5", "comment": "Malware payload", "value": "d78f18137bd0164c48206943e8135028", "object_relation": "md5", "Tag": [ { "name": "DOTRUNPEX", "colour": "#E08AB5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775314169, "uuid": "5d0759ca-9af7-429a-ba69-f514d93bf5dc", "comment": "Malware payload", "value": "ce00b96383402bb3581448e5d9069c996efcbd78668253e33f8c25854ab87914", "object_relation": "sha256", "Tag": [ { "name": "DOTRUNPEX", "colour": "#E08AB5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775314169, "uuid": "c0960031-480f-4c78-9090-bb4e4dd336fe", "comment": "Malware payload", "value": "23af26c954212f4cd95d86a0ef4581f3162d8754", "object_relation": "sha1", "Tag": [ { "name": "DOTRUNPEX", "colour": "#E08AB5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775314169, "uuid": "96e2fda9-59cb-45dc-9473-aed05c713c45", "comment": "Malware payload", "value": "a2a8ce7df314f66c2edd3643c43763b086a004a9c6c7d0f32c42b7f1928a322e5ad28d2a6b7ea0b919134f0aa2a21556", "object_relation": "sha3-384", "Tag": [ { "name": "DOTRUNPEX", "colour": "#E08AB5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775314169, "uuid": "a02d174b-9d19-42c5-8279-9fee96b33538", "value": "T11B94F1BD869D6DA3E0392E3D95C13ACC27BBA6E40215D3DF2D8660D51FD72938104AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775314169, "uuid": "603db758-203a-417b-9a8c-bdfe17a0ce6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775314169, "uuid": "286fde92-2f37-4c33-826b-a819236c686e", "value": "12288:xH5z6x50WwHLFveSsdq48yqoePCNaG+ryR:mxWNvG38BCNl+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775314169, "uuid": "b20a135a-a77a-46d6-92fc-fad0985bbc11", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775314169, "uuid": "2a03cffc-44c2-4e3e-9f8e-50d43d8f1199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775314169, "uuid": "1310c1d6-f56b-47db-a313-a50641fe0e30", "value": "7BY8G5W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c4b9c4-2fef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775284154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775284154, "uuid": "c8bfb0b5-ff27-4824-812c-4779dd96e38c", "comment": "Malware payload (Mirai)", "value": "670475308207bf73d5c79e69f7de6d5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775284154, "uuid": "38375727-b5a8-4203-8b46-163522eed5dc", "comment": "Malware payload (Mirai)", "value": "d1aed493fc5462c98bc7d958ef34e59e38aad5e3b138a59b62f7b47ada7eeec9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775284154, "uuid": "5b449b01-0dbf-45f3-942d-fb98bfbb2318", "comment": "Malware payload (Mirai)", "value": "a728d5f0c29b44af69c3168a713ee93420a13d21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775284154, "uuid": "f97aff6b-a112-4ed9-a403-541c6fd201f7", "comment": "Malware payload (Mirai)", "value": "4fe7fad88be2a262a588930c4a4d4358ce92892c0ae86c5bebc8dd460a31c805e3f9cfe26d3ee4035c2c9a80bead06ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775284154, "uuid": "e33b587e-ca28-402d-bc73-b561d4b1119f", "value": "T15F431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775284154, "uuid": "85d2e8db-8e25-4515-b256-0969c823f185", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775284154, "uuid": "376c091e-cc4e-4d66-aebb-f6d5e716f097", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775284154, "uuid": "44544b57-5f98-48cd-b837-1bd1450adfeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775284154, "uuid": "ae1f3cb5-5882-4ed9-9ecd-a9c6b941ec80", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1e429c-2fde-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775276966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276966, "uuid": "39b59c0b-5851-4d61-86dc-2300009c7dfe", "comment": "Malware payload (Mirai)", "value": "2246a5b13d268e0be3e0bd6e985ef710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276966, "uuid": "0d93cadd-f1ee-4ffd-aef9-c0bef8ffe27c", "comment": "Malware payload (Mirai)", "value": "d468b6ada8e3dcbfa91c708de4fe1ca3e41bbe18b2f5af2054a2e0a5686fdc9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276966, "uuid": "d1b232ff-f6b3-4a3f-bf7a-c60415b1b971", "comment": "Malware payload (Mirai)", "value": "422d4767fc8b688c71c1df06b27ab7b2115e37ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276966, "uuid": "3d803e7b-ea18-4107-88b0-3d79083fee94", "comment": "Malware payload (Mirai)", "value": "5c2727331e359fd2dc689e06e2d4d481c6d87e1403d15556872a548d06538865dfd575732964f259d0ae33a1a240e1d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276966, "uuid": "f048e89a-923d-4a21-a709-034be5c0f23a", "value": "T1FBE3970A7E228F7EF269877447F38E31975877D616E1C680E1ACE5401F602CE645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276966, "uuid": "24d6f661-8dec-4ff3-8ffd-6a9d8fad9b3c", "value": "3072:cwLa8TPXxIJSkWGiJqHcy40abEnJvlTcH2al:cwLNLxIJSTGwqHgz+JaWal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775276966, "uuid": "ce7076ab-4b61-4965-8347-3910cc1dda9a", "value": 153124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775276966, "uuid": "79eaf0e0-241c-4e4e-b591-fac447ba365c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276966, "uuid": "a6df2c56-52d0-47fe-a632-659b9af5aef7", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed3de0d-2fe2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775278526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278526, "uuid": "47bb9692-7b25-490a-ae19-818c1e9a6ecb", "comment": "Malware payload (Mirai)", "value": "5cbefbfc40e363bce4fefdc1b7138ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278526, "uuid": "6679d443-8f23-4529-97e0-ac552155817f", "comment": "Malware payload (Mirai)", "value": "d528d7dd3076fc173adfadfb90c1dc94e9ac032d059965e6ae98b8bf3ac67d3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278526, "uuid": "6daf7aa6-636c-42aa-be11-711422f29ac9", "comment": "Malware payload (Mirai)", "value": "04689d858394cf80b8e9efa0a185071195fbf74b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775278526, "uuid": "9a8cc29c-d779-4d89-9e55-fef99c692195", "comment": "Malware payload (Mirai)", "value": "b16933946171f9e58469fc07727ebd9d56cb81142c56b7c9c09df1b69ea2ba50f8df9d744579255cb8fd6361fd294373", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278526, "uuid": "ec6fcedf-6f40-447d-80a5-7520b502866e", "value": "T1B2732991BC819A13C5D5137AFAAE42CD372523E8E2DA3217CE215F2037C692B0D7BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278526, "uuid": "8d76cd09-224d-4a8b-aadb-9f3563446019", "value": "1536:IVDFyLxoy20+Cz7Z9UZ7AyJ2Y/hotvtHRcqDqOa1vZB:IV+42Ah+cUqNZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775278526, "uuid": "ec8b39b2-f957-46cc-a860-fccfed1486c5", "value": 75064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775278526, "uuid": "74cec7d6-6b40-40f3-9014-680074ad1743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775278526, "uuid": "b44cf290-8255-4dfb-ac78-51b4bb46c2e8", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00173731-2fbc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775261992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261992, "uuid": "1fc9a6bd-cb6b-4c23-a9bf-dfbec309c1d6", "comment": "Malware payload", "value": "e06bd170e31da5ef7ba7b94df03df4e5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261992, "uuid": "c1dc9aae-f919-446a-a030-80e3533938c1", "comment": "Malware payload", "value": "d772d8ba62db514b1240a1b0835246aa6012fbaa751d45d1acb878772f53b068", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261992, "uuid": "8117d673-bd41-42ef-b95e-6331600cb5fd", "comment": "Malware payload", "value": "a5cf48b1221ea55138e0825ec330be33ebc4c9d9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261992, "uuid": "e588c768-6722-4587-b93f-57348eaa25d0", "comment": "Malware payload", "value": "7b6346643912b1a4086573c41dcd6eb8b9c927d62ca1889fccbcff5c98528fabcd0d42f175ae91033bc3092173c288ea", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261992, "uuid": "fd463a54-0287-40d5-acdc-28ea693d0581", "value": "T11492412AE9C31C6383C39E93D2E7C61CBFB984EC80175DC5F9A9C2921861D2A1759F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261992, "uuid": "453161e7-b209-4197-b0fa-7b00155ee5ae", "value": "192:4UxVafnDsrmFc0tXJBjTtLPybV1SRje129DA:hVafnmmFc0tPjTtLPybVERje129DA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775261992, "uuid": "eb462b7e-a563-460c-ab13-1c66ee741e5a", "value": 19808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775261992, "uuid": "f801349a-5304-4273-9c62-e030218713aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261992, "uuid": "16384187-c3ca-414c-a0dd-84816474f0eb", "value": "foundation.modernService.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f48663d-2fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274554, "uuid": "77876704-6185-4656-bc85-a762f6c2f355", "comment": "Malware payload (Mirai)", "value": "7c9bec4effebff06edf6f8e7865b0aea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274554, "uuid": "4e23246c-a191-44fe-93ef-1597072967b2", "comment": "Malware payload (Mirai)", "value": "d7a5f579612f0646f0c644866e84809cd583a6efdc74459960c712daefb91f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274554, "uuid": "154c645d-c7a6-4d07-a5f6-aef3ce68463a", "comment": "Malware payload (Mirai)", "value": "674c61a0d64225d9bd32c383c349ece701e92a1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274554, "uuid": "da5143d3-d5be-49c4-a1df-43fd43254ca1", "comment": "Malware payload (Mirai)", "value": "7f0176dc26a6981b42f9496065bd96507d3364d5e42e730cee15954d41550679e40112b0397720c5be0413abc0bd0201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274554, "uuid": "893e07df-f897-4247-8322-a463bd55672d", "value": "T12CD2E1B4628C601FEA239139417EC4542CABE4218EDBB24CFC5D4FD66A171D4172DFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274554, "uuid": "8527c703-d920-40f8-9873-63780e5a33c0", "value": "384:MAXg6VOb+ojda9DDMeYXRHJeGvLL0IRYU0DZ8/cGcQ0PSAiQeytU8L4CndNWh8cA:O4OyndN0J8eLL02CZ8jPFRyjn3WhrQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274554, "uuid": "02012c06-2df8-48b2-a197-b3c2fd07eaf3", "value": 29052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274554, "uuid": "9f8f3a83-4222-4047-823b-ebbb68598bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274554, "uuid": "64056e9a-b288-4a62-a140-f58f7c663863", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12953de7-2fd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775273620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273620, "uuid": "a0f5a922-a4e7-41cf-892d-36acfc61252d", "comment": "Malware payload (Mirai)", "value": "23cfbc2aca472fa8ccc0f446d7027d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273620, "uuid": "5562c46a-5016-465b-9c27-86ba47368939", "comment": "Malware payload (Mirai)", "value": "d7c1c3f0444dc8ed662e3f68b0396b05762a34bb4eddb25b540f5eb3771b2274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273620, "uuid": "69d4d3c5-4c5f-41a2-a43c-9170d0655b75", "comment": "Malware payload (Mirai)", "value": "ced6c8d4e66b23d86e32ac6e57a62b9b56bf1fa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273620, "uuid": "92039670-a033-4ecf-9dbb-f43ad0c2ac5a", "comment": "Malware payload (Mirai)", "value": "9dc543095db77a999300fc5f261d05a5aeba48b6035e1350a2628e669aeab7c239bffe8d8d07d0a9fd31b76142891d48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273620, "uuid": "d39eee2a-fd59-4ae4-a276-94c1f30a9947", "value": "T1B882D05029A1F232C2F05C37EDB4CA47B245597CA5FA701712198EE4F8C9A81D5FC39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273620, "uuid": "49318c0f-66b0-40f4-bf82-51829514e6eb", "value": "384:DpCfeL6b/6gfU0SdcC6CvID18mEQ+VsiD7EtAsvR/8mGgYPVhymdGUop5hupnc:DE7jftmFmWmEYi3uRUfgYts3UozM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775273620, "uuid": "0bc8fb3f-3d60-4dba-9870-18f98ad8c6a0", "value": 18904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775273620, "uuid": "c80f6750-4187-4959-96f4-76afa7b36121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273620, "uuid": "254b943a-ec49-4859-b73c-3d57676b73fa", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0d8db2-3040-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775318845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318845, "uuid": "71e2b738-c9aa-4a94-8ebb-a687f6564205", "comment": "Malware payload", "value": "7e1845ee5a2569d8a253fe9aea784ce5", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318845, "uuid": "982dccbc-a650-49a3-a4af-2ffbd1781117", "comment": "Malware payload", "value": "d884d04d69dc1081819bba9d713322879e191c341af85bd69e80aa1c12040de7", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318845, "uuid": "01a09c06-0ee0-4860-80c8-831282ed047b", "comment": "Malware payload", "value": "163f0bde8be393ac1e9aea9a3db67ba3bddb75f6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318845, "uuid": "9b8f8384-01b0-4ae6-9409-278d8e434594", "comment": "Malware payload", "value": "f1ddfcdf0d62c8d37d6549e2ddb762070497efe18263fca29542c78d1d3d78c3439456357901fe534447640d010cb8b9", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318845, "uuid": "72a3919e-67f1-4761-a794-2f382cf25c8b", "value": "T10C24D04773A630F8E1368678C9644A05D776B87147648FEF17A0025A2F27BE19E3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318845, "uuid": "4b850900-a8d1-4bd4-a9b7-d59210619c3f", "value": "533ee71850f87b1e8ea5c7eafad97a7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318845, "uuid": "b9870842-f70e-4882-a862-4315a3909053", "value": "3072:thpeoEF2sCqUp8uGWqVQaOT6BlSER5XgT+i2OP9z0C/ic8vRLvQDXDhjIwUzCwOm:t3BK2aWq2lWR5XgUWz0FtMDhjrUz5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775318845, "uuid": "b5e4cdd2-a6c9-4198-b2e3-03fde2acd412", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775318845, "uuid": "b5fce7b6-ec7a-4995-a2e8-94398de7e4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318845, "uuid": "e60780f7-00fd-4b94-8752-69bacd5276c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45151ad-3071-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775340033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340033, "uuid": "853686e2-b32d-4be4-acfe-65e3825f963a", "comment": "Malware payload (Mirai)", "value": "896db6b3e514c47b9a1181a2477ea8af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340033, "uuid": "26883429-1e82-4ea7-b3a0-8844715b1de9", "comment": "Malware payload (Mirai)", "value": "d915456f8cbae999581539ac28856d78e79bc65fa818eddf1912de17cdab6d98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340033, "uuid": "ebddc60f-6486-4796-bd57-bdeedc94b1f2", "comment": "Malware payload (Mirai)", "value": "f00cd8b16e466c9df8843d576cfba306ee3fe2d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775340033, "uuid": "4acbae63-98d8-4969-b3a7-bb0c9fff0504", "comment": "Malware payload (Mirai)", "value": "453036e68a3e167f26ab4bac38ba629178889226012c53e070c567230456c779bf2a3f0f19c16fb21a848d28558c9718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340033, "uuid": "50c6d4c8-6cdd-412e-888f-e3f2227d0564", "value": "T13D24065ABD82AF10D5D526BEFB0E428933571B78E3FA7102DE205F2127CA91B0F76542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340033, "uuid": "8e7fee30-0e58-406c-b699-93a9bc2002f5", "value": "6144:X/PRsCkXIc3BVfLTWwva4YAs90AgjVI+s:X/PRs14c33nWwvanAs90AgZIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775340033, "uuid": "46374192-0099-471e-93b8-ff5ba145a4b3", "value": 211364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775340033, "uuid": "d2a8426d-36d9-4e39-aeb2-70aaa78ce559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775340033, "uuid": "6179c89d-c5e6-402f-8ef8-6914daf86038", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fbe4e3-303f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775318322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318322, "uuid": "1ac1bbaf-d597-4bf4-baa0-836f3108978c", "comment": "Malware payload", "value": "f27f10dfddfc6219c5e339a3aa6fae45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318322, "uuid": "84afc555-fe47-4997-aa8d-e4b60e4953fe", "comment": "Malware payload", "value": "d96666f9787eee49dc1b9e8685e6985105b8366eea975767846ca3e2b4c7888e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318322, "uuid": "d003e0a9-8588-4c56-a192-51382e5ca8b5", "comment": "Malware payload", "value": "5c1fde13b8158ccb7a69c88f2986508f6629843e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318322, "uuid": "a3e9b880-149e-41ba-8765-e94935d87061", "comment": "Malware payload", "value": "be0be3531fce2367614e4f297e6510a5ff780061523c56aff452e6222bcee77cfb6186a3844b029ff98355dc293c91cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318322, "uuid": "a08767ba-0e40-4370-9c65-bf42600abb87", "value": "T1A7E533FF804A26BAAD0C769967BEF6C50751FCB22EC314118E9BC6CDC6B44F96601493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318322, "uuid": "a0082a0d-65ac-46f8-ac1f-543d0fe64a94", "value": "98304:xMrc1fEjPY5OmncvZSeNXLJhYZcdLr7he:aSETDMchS6bro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775318322, "uuid": "7ebae488-aa44-4214-a9ac-1b56db1b6a38", "value": 3320656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775318322, "uuid": "fc8c1c1d-b3ed-4986-aa2e-a0a009f637ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318322, "uuid": "fa91dd11-39ce-47b6-aa86-10667c42000d", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb0a54f-2fe0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775277554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277554, "uuid": "d741f16f-2c68-4125-9473-a5285b414125", "comment": "Malware payload (Mirai)", "value": "b55c01b4de8d3877b8481838fb2a0538", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277554, "uuid": "3e5a5fd5-1180-4945-8375-3ca6373fe0e4", "comment": "Malware payload (Mirai)", "value": "da6a639ff3e9b4e2ab0d399caa980ea25c30d06f123284114982f852bfdb548c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277554, "uuid": "657d92d6-ebcc-4023-af71-1e74f02a232d", "comment": "Malware payload (Mirai)", "value": "1effad48d78f2a57b1434b2a4f2e6cd78cea8c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775277554, "uuid": "78da95bb-1ede-49b1-ba35-23297e4c9098", "comment": "Malware payload (Mirai)", "value": "8044844dc2d97a51f56597b73d4b724b0ac33377d420bbefd34a3c6b34c75dd10e277c8df9393b69fd74b54cb5bfd7da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277554, "uuid": "6a905a70-b5d2-4ff6-9848-367ec57785b4", "value": "T196B39DEBF28705A1C86246F007CB4BEE3E6323C15F1785E73D29657918791DB9A02F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277554, "uuid": "0a4aedad-b767-4a83-a874-7f527421b275", "value": "1536:gQ+rShQit6nrEXh4Vkzyi4CDhaCKb2gTR/LWL:gJrShQc6ngR6k2KDhabb2gTRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775277554, "uuid": "d16f73e8-d918-4ada-86f6-ca5d86f926e7", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775277554, "uuid": "27869787-d3ff-458d-b127-faec68378e7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775277554, "uuid": "537945c5-c01a-467d-b813-7bf1e250a847", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01824923-2ff8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287764, "uuid": "dd312468-829f-4e88-8817-f48a666b315b", "comment": "Malware payload (Mirai)", "value": "721a2c63fe960899b4b66d18dc8e9f07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287764, "uuid": "fb94679c-5c5a-456d-939e-d6933151a5cf", "comment": "Malware payload (Mirai)", "value": "dadefff56e6dddb606d8b39ef193315e5d344897104c9edb9ab0a095511323f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287764, "uuid": "100160e9-6bcb-48b0-bd5e-07e6855fb411", "comment": "Malware payload (Mirai)", "value": "ffe9da3ef3693bc945d3b2967c2d1becb77c24d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287764, "uuid": "c4442e31-2b32-4eb1-968d-1e5e8b803b30", "comment": "Malware payload (Mirai)", "value": "128ead813760287a8e9810fe77ecab9ff7670fce789fbb80e8917cf2a76805dd6191bdb1dec542a690a09afaf5831a40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287764, "uuid": "4a89fe1d-7892-4f36-8fe8-20d652aca1a4", "value": "T1B333F707F84285FDC556C13417BABA3AE83671EE533CB6A777E4BB222842E614D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287764, "uuid": "2bd14f17-51da-45de-aecc-50b5047f174a", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HHJYC0QkiuVn4P:yHlPZMEcTFZ2A1HHJp0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287764, "uuid": "88100854-e86a-479a-9421-66347b15b804", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287764, "uuid": "f57fb0e2-dbb6-48ce-9f53-c3d51634f98b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287764, "uuid": "73cb956a-9ff9-4c80-88f0-19c3b61c1df1", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a59c8e-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274403, "uuid": "e2915809-e2e1-44f0-bbf1-a4305ee79894", "comment": "Malware payload (Mirai)", "value": "c1770c35b98e725b0b6e3dac3eb8dd12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274403, "uuid": "0b6c6768-d3c5-4af8-aeab-905cf25e3630", "comment": "Malware payload (Mirai)", "value": "db4c947521e4ae7d434f2385f57298943818a855548f25c318617e68607c4d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274403, "uuid": "17538f8b-a6fd-4f44-b4ad-738f82970c46", "comment": "Malware payload (Mirai)", "value": "d27f050a7642720be30a24d1cc8a0f1f42fce4d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274403, "uuid": "3ba5f679-d89f-4da9-87ce-06e75dd6f0fe", "comment": "Malware payload (Mirai)", "value": "7e6ab05b8138351400e41a54021a2282f117e590cf693191fe00134c57f490aa9434402b9bdd5fd473c672da409ddd9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274403, "uuid": "6292ab64-92e3-4804-bc09-da35ae8a11ec", "value": "T114E2E14D161E28ECD05F98702B9A97D61EB30B93A647D82661CCE0630DC72B27806EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274403, "uuid": "1eb35512-9257-467c-8ca3-d822c565f561", "value": "768:MsZcR951TRA6A3CcARd7gfi39lfrTzCZQy+6IHJgGlzDpbuR1J/:nZcRZeL3CfBjNljTY+FVJud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274403, "uuid": "b74ecb33-a9f2-40f4-a274-e77f0cc147ea", "value": 31708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274403, "uuid": "6f0f9249-3baa-4cc8-8462-bc209f8f7c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274403, "uuid": "1f25199f-4c77-46f5-81e4-3969e8e086de", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ad15be-306c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775337893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775337893, "uuid": "309e18d3-cbb0-4572-90fd-7ea838887895", "comment": "Malware payload", "value": "5a484c160ffbfecacf6047ea2cbcf56c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775337893, "uuid": "cf27fd51-0643-492b-89b1-300a9599bf46", "comment": "Malware payload", "value": "dbd1594b55ec5174a4f9287f88f7c70e3727696f2e6aaaba372da395a97c75d6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775337893, "uuid": "bafe783c-cf38-4804-bbb5-8fa07fe8bcfa", "comment": "Malware payload", "value": "c91455ca279a46afb0dda7f6f544076407ddd2f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775337893, "uuid": "f631bf49-a33e-486b-97ed-5e8455b1954e", "comment": "Malware payload", "value": "5a17e456fc19f8f88a43f5873a25b5160d6e94fc05ae04a96e5bb1e8ffad86407cdd56197bfebb906561af3bf85031ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775337893, "uuid": "4bb2ca12-10f3-449d-bae5-59cd7f47e0eb", "value": "T1D75155E13C5059B4278FCA20567D6126F02301677E42246CB0BFA01D7B7A995A2BEDB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775337893, "uuid": "ecdb100e-dad6-44db-8663-c24a0bab4940", "value": "48:eNro+lnWQ7x8bD9fwV6vlId/IkKj4Q1d48Oz3Pkny4ILSwT/wh:CUkWQd89fxNCwzjrS8y3PH7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775337893, "uuid": "3219b9cc-a40f-4df3-9ab6-28f2e628ad59", "value": 2512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775337893, "uuid": "c9c32f20-ceaf-4400-b4fe-b49b203e2bf1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775337893, "uuid": "c88d7762-7993-4d33-b139-213af20fde1a", "value": "proxyv2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffc67ad-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274098, "uuid": "806c07f7-fe5b-4c08-9658-053797bac46c", "comment": "Malware payload (Mirai)", "value": "2f1798d3b2b42b8d503b1d910ab04042", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274098, "uuid": "4d7f5ef0-de39-4199-9ab2-9ffe62d8480f", "comment": "Malware payload (Mirai)", "value": "df74f5f9a1b046f4b9d180f07ad734df52df9cac41bb38aa8549a48c1d920faf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274098, "uuid": "e6bbfcaa-09bd-4a48-911f-ac519ff99a2a", "comment": "Malware payload (Mirai)", "value": "704fea867b779ddcaffd106f78a27dc1a70559ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274098, "uuid": "bdebf6db-bbf3-427e-8118-84962404bc69", "comment": "Malware payload (Mirai)", "value": "8572b424367aaf3164dfd910781673264d24ec6475008b816f5e634713680a6ef59036499698dffc6ecf7b17b2305dcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274098, "uuid": "a9dc8f90-5d86-4fa0-8313-2693b8048ac4", "value": "T1B7E32A46E6418A13C0D6177AFAEF42553323AB64D3DB73058928BFB43F8679E0E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274098, "uuid": "7840003f-2709-4832-81c1-dbc4d35ca1da", "value": "3072:ss8xsB+58axO8h9Lbgn2/+Tkpl2MsQLKxi0M/9Af:ss8xz8axO8h9LbW2ckL2DQLSRM/9Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274098, "uuid": "1442c886-9950-47fe-bc28-98b2b55bec4d", "value": 153715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274098, "uuid": "3a102dec-66af-410d-b0fa-e73e29861fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274098, "uuid": "004c6acf-34bb-4bcb-923d-d69e13bf478a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2727426-2fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1775267096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775267096, "uuid": "01d15306-e36a-4324-92ab-aad42bf428e4", "comment": "Malware payload (Arechclient2)", "value": "5c0508349696f24a7b5ec8539ac8d1d2", "object_relation": "md5", "Tag": [ { "name": "178-16-54-51", "colour": "#F885BF", "exportable": true, "hide_tag": false }, { "name": "91-92-240-16", "colour": "#41634A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775267096, "uuid": "30be0fb5-e25d-4cd8-a813-576939c96d40", "comment": "Malware payload (Arechclient2)", "value": "df875f9073cb35b80c87a3717046610d58b08da2542ce619390cbea81211cd27", "object_relation": "sha256", "Tag": [ { "name": "178-16-54-51", "colour": "#F885BF", "exportable": true, "hide_tag": false }, { "name": "91-92-240-16", "colour": "#41634A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775267096, "uuid": "d04010d9-4f57-47e1-9414-a6cbe657b1aa", "comment": "Malware payload (Arechclient2)", "value": "0b3316466678061ed7b3c3d4e6f007d411499ac3", "object_relation": "sha1", "Tag": [ { "name": "178-16-54-51", "colour": "#F885BF", "exportable": true, "hide_tag": false }, { "name": "91-92-240-16", "colour": "#41634A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775267096, "uuid": "8344d2ab-b40e-4aba-b068-4f0257bd7c10", "comment": "Malware payload (Arechclient2)", "value": "2dc0dc4cedf0c3bd8379820ab5d36cf1acd07a62df2d2bb7d870d651179eeb2ac8883c24e2c19b963fe2d9a49624fa8a", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-54-51", "colour": "#F885BF", "exportable": true, "hide_tag": false }, { "name": "91-92-240-16", "colour": "#41634A", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775267096, "uuid": "3283d06a-6d63-4cb8-9557-6fd6b7afca2f", "value": "T11FB633E0F1C4AFC2C162C47063E88066FBEE1CF520E3DD7178122A5A65965F7B79E588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775267096, "uuid": "0a3b4708-dc46-4eb1-aa19-50f1b92316fa", "value": "196608:j5+uWL63x+mb2ZYYLHIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9oPZ8TdoMzy:wL63Mmb21LhOnn7FUNyhGprLz0Wh8hOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775267096, "uuid": "b5f393cc-0436-4ed3-af23-c838bae3ce2f", "value": 10613215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775267096, "uuid": "3ef64edc-1c89-429d-a7de-0a347479101a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775267096, "uuid": "6b892f59-0db5-42e5-91f8-1819d5e8dc2e", "value": "puk3ta8cyv1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d32d95-304a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775323103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775323103, "uuid": "b7d9e7a4-0464-47f1-9145-0c65330b5814", "comment": "Malware payload (RustyStealer)", "value": "ccdc4a9f41056bdf8d6ab0fb3b374fd4", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775323103, "uuid": "7b510aa0-546f-4f0d-9a69-13f987cf55e8", "comment": "Malware payload (RustyStealer)", "value": "dfef2a4891f8b740e75b04a676fe4cb1657e3ab8ded9cb5f50be804068205c97", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775323103, "uuid": "71e4220d-6178-4208-9bd7-6bdd293e3b5e", "comment": "Malware payload (RustyStealer)", "value": "36b1dc13c134770d0233aee883dd46d0768a703a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775323103, "uuid": "b84d1722-dec1-42b6-8e69-2bd1b6dac0fc", "comment": "Malware payload (RustyStealer)", "value": "9f21b3705f40bed664e4a1411502dedea88159f04d7999f1811010e344ee745b6270b6c081a4a0b96ff875c67fa23c6b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775323103, "uuid": "eb65348a-60f6-461b-91e5-1965afb5ebd2", "value": "T1BE86E1C76FB50DB4D551137499E6698132B2AF2C8BB033C33D89DD204A697DE68FA702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775323103, "uuid": "327d2345-5127-4e3d-8bc8-12605f9dea9d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775323103, "uuid": "2e9d3f59-b4ec-4cd7-acea-1b74cce585c1", "value": "98304:cKlgv7YPBEvENoleUcxAVNeEQkHt0dLSq2SlVPn3RpZbRNA3l:cIgDYPBEvENo0YnF2LxBrn39El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775323103, "uuid": "45d02ee0-ba49-4dac-a1f0-763c8364094e", "value": 8214160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775323103, "uuid": "e7d521a5-eb93-42a0-bd13-fc1903ef5db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775323103, "uuid": "fea3611a-a08a-48d9-9c12-b748af7e37b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b400622-2fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274627, "uuid": "5187ff0b-460d-4dc7-9923-bca4f04147b2", "comment": "Malware payload (Mirai)", "value": "4f2a9f0d0aa0d6e2e3b90b9f90be20f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274627, "uuid": "ce46f55c-5711-4b5f-8036-93e82c9b8fa9", "comment": "Malware payload (Mirai)", "value": "e20865c289b47f2dac573e39bf9e81a654fdf0d1efcb11d8561a7b5d7e9508b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274627, "uuid": "97ee8777-bb8e-4f13-8511-4753f15e26f6", "comment": "Malware payload (Mirai)", "value": "606eea54b2b00902f5b29c76b9ad699b4b9d2b1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274627, "uuid": "09726dd2-6eea-4420-8f65-bef4d35a998c", "comment": "Malware payload (Mirai)", "value": "63b4b9d78296f90085d1dfb3ad970e40d2bc927fd12b819b82fd5e801a0d6255d304910df640c34e67f4015ac204bf88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274627, "uuid": "f7287e40-06b4-4380-aaff-b63cced83b31", "value": "T180535BC5F583E8F5DC4B05746036FB3B9B32F1BA2228DB43C7F99522AC51642E906A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274627, "uuid": "991141e8-02aa-46bc-b4aa-e644030e3bba", "value": "1536:0+gpkTpeIGaf6e3EYCILVsSCpPYQVZxkB4uZSfz:0TuTpeIGaf6e3XCoVstP7Zy6uqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274627, "uuid": "c26c0f6d-37a9-41d0-bb27-fd0958033d8e", "value": 62544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274627, "uuid": "a932a556-bbc0-488f-8155-c01ad7212c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274627, "uuid": "e4afcc0e-32a6-4779-931c-d758301e550f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf64e7c9-2fdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775276084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276084, "uuid": "ddc3ce3b-5edd-4527-bc4e-16676287ba72", "comment": "Malware payload (Mirai)", "value": "e57f55448d390c71d20db670833f9bad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276084, "uuid": "e2e1adb5-13b9-453e-8e09-c6c00da4fef0", "comment": "Malware payload (Mirai)", "value": "e6c14ec9ca8ab88a998aae1e9a5f064ff8f14b34770330ce0158bbeef617dc24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276084, "uuid": "135f70ef-9d8a-4afd-b228-114d997d878a", "comment": "Malware payload (Mirai)", "value": "c3ea1c35f11532b10dccfdb140bb9d3d5ede6111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775276084, "uuid": "65fbd26c-f3b1-4a77-8831-a76ea2a8c372", "comment": "Malware payload (Mirai)", "value": "55c6bece24a216e0d3339689469b1a0d5e5012efbe6ad61836a511beb5ffaebf6801eff428d34de056222a96d965c76d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276084, "uuid": "255391ef-616a-4294-8898-3890c67f6380", "value": "T14FD2D066D2524D46CF7E9EF03AADC68837FE0E1E73528CE7214C5F1211690BB6087AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276084, "uuid": "f63c0a90-3444-4a80-a13f-64f76886cdbd", "value": "768:BOWSdvDPo7cjtMyRNW5SMzHjFLjVfhPXb5bswZ8++4Xi4uVcqgw09Q:BRSlDwsPNWFHpLFhPXb5nZ8+RXi4u+qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775276084, "uuid": "c503d492-95c0-414f-b2a1-987f298acac8", "value": 29244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775276084, "uuid": "29737456-96a7-4107-980d-20ed79a00173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775276084, "uuid": "0b99287c-fcec-4e41-b1af-5b525390c1e7", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fae7c6-300a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775295635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775295635, "uuid": "2d824ff9-cb4d-4848-899e-1d627375a52d", "comment": "Malware payload (ValleyRAT)", "value": "516d4572cbf63a86b0c947bbffd7e1f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775295635, "uuid": "298a9bfc-aa8d-45df-85b2-bde8e0ef17bf", "comment": "Malware payload (ValleyRAT)", "value": "e8306f6dac24a8b315a9259715e3df68ed05ab6803ceaf9ffac9bbac3b8823e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775295635, "uuid": "24512685-1bf9-4650-8e91-bce647b050ea", "comment": "Malware payload (ValleyRAT)", "value": "865017a59c403d07cd860da274c3098c6775ca04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775295635, "uuid": "057a6bd1-7cc5-4f2b-b4f0-3cf3c61da19b", "comment": "Malware payload (ValleyRAT)", "value": "57bb9684a90d6ecba4fba45bc11d816e677f8db76d4b6732205c875dbdd349e973f2add0365c25e6d97ea2139c683844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775295635, "uuid": "66a4bfe7-58c2-46ea-bc53-254a04c460a8", "value": "T1120833A4306AC925D4B6A476BD82E7887DEC48C4C10EDF3AD757FD3C09502E2B17B91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775295635, "uuid": "64fa9a43-3e6e-4aa5-b699-d5f7ee0f0543", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775295635, "uuid": "17fc3ed5-bca4-4b38-be97-d91a93e81eca", "value": "1572864:nf6z+xEJOzsL3KrcJN4mo/KBV9ggLwiUQxdvtPWVOCmW3HjRqYr:nfKSwOC3ecYmoCWdiUQxdF8X3ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775295635, "uuid": "920cea0e-468e-469c-b9d3-56cdfa0f9c69", "value": 78526776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775295635, "uuid": "67a653c7-25c4-40f8-a2de-94a189f4ec8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775295635, "uuid": "5182671f-de14-4548-b077-884d0c985604", "value": "516D4572CBF63A86B0C947BBFFD7E1F7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a29bde-307c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775344758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344758, "uuid": "5398d138-9f64-4747-8905-914a6c783cbd", "comment": "Malware payload (NetSupport)", "value": "45489a7a7ad075facd6f650b4f941d9a", "object_relation": "md5", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344758, "uuid": "98d2b772-cb80-448d-92d7-ad6889a592f7", "comment": "Malware payload (NetSupport)", "value": "e90d851c4c866b03150591acec7e987782639c37e4394b1b7ce3d9808a6d592c", "object_relation": "sha256", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344758, "uuid": "0e26b9ab-8b1a-4f75-a377-e8425d439704", "comment": "Malware payload (NetSupport)", "value": "b51f22368db9de00438ebec692607188b2ffbc84", "object_relation": "sha1", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775344758, "uuid": "2cbcc597-2e5f-4646-914c-ec99136527b1", "comment": "Malware payload (NetSupport)", "value": "22f3f893b48e300519d3eae357f1b5f64bdebca3e745f8f74e5f15b2a03279aadea409adba5b68f3809c735922227df6", "object_relation": "sha3-384", "Tag": [ { "name": "194-113-235-125", "colour": "#F093B1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344758, "uuid": "2bf10db8-19a7-4494-b4cf-9780eaddd447", "value": "T175B5332A3A9EE07DD432FA362DCD5ED1B9262A4684A0E06374230D167145F1EF4FE7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344758, "uuid": "f7af3f05-c5f8-4033-a11a-b19bc3cb6374", "value": "49152:LOsbDXXpZMu4I26QanUoxOSAlEb0OZiA7aH9SltPZYnir6iOa:NDbG6FnU2h+EbzIeadSljrGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775344758, "uuid": "cac131b3-2ff9-4c79-9a92-e0fe65646cc5", "value": 2360431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775344758, "uuid": "172a197b-a3ee-499f-bbf2-f89f4413a14d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775344758, "uuid": "3986a0da-00a1-4504-8dce-4d0d5a577c9c", "value": "pcicapi.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca27fbdb-2ff5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775286813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286813, "uuid": "14bcfeda-b944-41e0-acb0-ef259b9a7ccd", "comment": "Malware payload (Mirai)", "value": "08657c2ee93a22a79e333f526f47a866", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286813, "uuid": "935e489b-f77c-44e5-8001-e2596c55c8d0", "comment": "Malware payload (Mirai)", "value": "ea32273190b8a76f0409b3184f2b0ad3f6c6bd4ca61096cafbe2549033268441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286813, "uuid": "f5e3136f-bd36-4cfc-a702-dd70cb694c14", "comment": "Malware payload (Mirai)", "value": "3b648b7a770e6bcabd9b9650bf41a32e8ab3029a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775286813, "uuid": "a307b218-552a-4e68-b1f6-4395c179b278", "comment": "Malware payload (Mirai)", "value": "07cf0ac1d6b69479e30b6c2ea74882cb2a055536e2af4a5de478f7c3061084433510b2462768fcdc9e65490dd3062d9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286813, "uuid": "ad2abb07-8400-40d6-a671-807579dfce2a", "value": "T122C35B42FA818F13C0D61779B6EF42493322A79593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286813, "uuid": "69053e06-1306-4087-b7ac-8742228d46eb", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHourScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIurSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775286813, "uuid": "e7d0b113-8c9c-4af3-b180-f1c0f191525b", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775286813, "uuid": "da077ef9-9dfc-4da6-829c-81f4e577ee13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775286813, "uuid": "08322d42-2b94-4983-910c-d2e27208b59b", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537f6844-2fcc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775269004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269004, "uuid": "a392cf30-0885-490d-8c40-dfef4f1088f3", "comment": "Malware payload (Mirai)", "value": "e04ecb73295252a59d755801397529a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269004, "uuid": "12d1020f-baf0-4750-9b5a-9af440e99eee", "comment": "Malware payload (Mirai)", "value": "eb79ac34486277038a2f6529e68a8415d75a2f23c21c5873474fea9a911f3e34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269004, "uuid": "11570530-2ec3-44f7-acda-393b388e835c", "comment": "Malware payload (Mirai)", "value": "f868096dc6151b4c9c2e075b1e8358fc78c0114f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775269004, "uuid": "3520fab0-dbd2-448a-a3b1-d06af9236dc4", "comment": "Malware payload (Mirai)", "value": "66398434d5fcb5e50857d4c27368e6233bc9f4ae9288ffe1f2c5a772eb5043e5c1667d01d4cac9308e3a7c8ff49a97e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269004, "uuid": "37ab1be6-e7a4-4d90-9067-b9ea665bc120", "value": "T1A6A35CC4F783C4F6FD1215B51027A3339733D43A902ADA83D7A9EA76AD22651DA1A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269004, "uuid": "489d667e-bb06-4ac9-93c7-d26daaf74757", "value": "1536:WqZqgYzpo+cZlxRlG0v/vJfZLfJtemF59/SmxEfhP:WqZBYzr6rlbfJfJfe26b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775269004, "uuid": "c42a07ce-0eaf-4175-b51f-0354ab7e8e19", "value": 100300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775269004, "uuid": "011207a6-1c2a-40b2-b5ae-918df964b40c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775269004, "uuid": "dcbcdc29-1577-414b-9285-56453b6eaa69", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9446f4ef-3056-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775328383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775328383, "uuid": "97e6de4c-e97e-4562-8ac0-53086583f50c", "comment": "Malware payload", "value": "1ebc93dec726f8e3642e570d9980dd7b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775328383, "uuid": "eeef23b3-f15c-4301-a212-6fe014651abc", "comment": "Malware payload", "value": "ec517c9ec8f6a6845ffe8ca9825bc31b2fe5719b2df0301fd016236f0048d01e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775328383, "uuid": "1d0c1c24-af93-413e-94fa-af4f8150f4ce", "comment": "Malware payload", "value": "40f628202dbb5ac4a7ff269f852ef57711a9c770", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775328383, "uuid": "1976cd90-b525-46c0-8927-f8b75b700172", "comment": "Malware payload", "value": "18c355d610d0b8892192062c0248a41e661a377733fd855e61cbdb1a6ac07b111a72f70bf3ee39e80344c8f471d36b44", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775328383, "uuid": "892176f4-5cae-4afc-8d3d-5cfccbe76e58", "value": "T14CF733966C6DED49C02AD07362D5C89E014340F3F198FD4FB6405A2BEFAD9894BEB706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775328383, "uuid": "ae11ba66-d789-4275-841f-b26d037e4185", "value": "1572864:1yT4GvkBrrxWEbI03O8UokAdR7+EAPdV0BhJGSA78Z4flsLZZB6:MAz8GO8uEAPjMnGSA/+ZZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775328383, "uuid": "cb50dd9b-bd5c-4653-a26f-748a7b0136a6", "value": 71179794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775328383, "uuid": "c27af77b-d793-4f10-9c7b-5028eeffd39b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775328383, "uuid": "cf563f6a-16bb-4889-8fef-bd157ffa9d82", "value": "yezura-beta.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efde62d-2fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775274204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274204, "uuid": "3cc3296d-b9e4-4066-add9-4a9d52093d96", "comment": "Malware payload (Mirai)", "value": "0c52f9542eb2c1a34da87b62d7ea3f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274204, "uuid": "f36021e7-0664-474a-8093-a0ff1e098fbe", "comment": "Malware payload (Mirai)", "value": "ec87ee0e2674b21312dae1fb545b9c408729a63af9b336c6f3cc0be602b0af3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274204, "uuid": "651fe1b2-1d33-4e6f-a14c-a0cdd9b9a253", "comment": "Malware payload (Mirai)", "value": "ca68e4cafb189f6654d9334bfc8f69f250c2af80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775274204, "uuid": "2a12e2ec-24d0-431c-bf8f-1db814229f3c", "comment": "Malware payload (Mirai)", "value": "36a6a4076d201d0d8a51bdb027fbf9e1a390f3586c4e082bf97ea273762aa1aac9a62979c9ba72fcd8a7a7015d443768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274204, "uuid": "827ce0ff-b63b-4cd6-9dcc-ed80d7a1b7a0", "value": "T10B830956B8814B16C5C502BEFA2D118E332227FDE3DEB2229D209F2477C692B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274204, "uuid": "da8483e4-34f7-4c18-97c3-7b6b4b1f03ab", "value": "1536:IonhdSH8FCs5n0+Mkgq/B1z9UVnB8bEYaVKH3+ppzMTiQ8a56CpXf5MY4c:3rFv5DM1KXmfYa28a56CpXf2pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775274204, "uuid": "cf0028b5-7b02-4db0-a468-90ea0b22b118", "value": 83452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775274204, "uuid": "95398fd2-ec67-44c1-8a2b-2ed8f7234e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775274204, "uuid": "c0e8d413-1f49-4d00-9388-fa6314a79d54", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c1832f-3049-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775322829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322829, "uuid": "e26f5776-7392-456c-a47a-1415fa088fbb", "comment": "Malware payload (Mirai)", "value": "a6f401c9f8b25126025e7ac4b4c54220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322829, "uuid": "6cfb1927-514c-4021-b0a5-708bd403e85a", "comment": "Malware payload (Mirai)", "value": "ece4a5965e1adec4377f4867db49fde221f7c78c1289469a89a9b0cbae54c377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322829, "uuid": "d662668a-f884-4588-b237-eedfa39e7046", "comment": "Malware payload (Mirai)", "value": "7b43767383d4f9045c21bd6c0beae7b46fe3eff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322829, "uuid": "13a128f6-9742-4591-a0fa-66b6c4b673df", "comment": "Malware payload (Mirai)", "value": "2d1d6757e1541a841613ad2bdb819dc3a5302d77134f1462b9c12b463b2c9bc926ed22c5e92fee1edf10df9015b331e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322829, "uuid": "3b051059-4745-408f-81fd-01d23954a546", "value": "T1EA5423C2DF395DB0D56743F33C5AF8989CC2890E68F5B0812EAA7DD0213965CAB57325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322829, "uuid": "f5b13d32-3f42-4556-884c-5cdc43579347", "value": "6144:Q0eg/k7i2mxqnfkQe5AkDtUSx04RjZuLZdKPrRBZkmU:N//k7i1GOQZdsRBZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322829, "uuid": "fff0a341-f1bd-4896-8563-543304e67b54", "value": 285952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322829, "uuid": "26a7be4a-585b-4323-8572-51ac9626cfe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322829, "uuid": "4854c70f-157a-41ba-b643-6f4e95f844bf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dbc7d9-2fff-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775291025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775291025, "uuid": "d267a985-65a1-488c-b4c1-ddeee2fd9774", "comment": "Malware payload (CoinMiner)", "value": "09b99361a9cecc19c491e3c238d4b5cc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775291025, "uuid": "2566d46d-247a-498a-8b3a-3cbe4b2a2387", "comment": "Malware payload (CoinMiner)", "value": "ed0c51acaa0b2c1bac7295de146a6eea9a9f13d3c06d77a26b3a6abbfea42f07", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775291025, "uuid": "6f2f71c3-ddf9-482a-aaed-eef3663576d3", "comment": "Malware payload (CoinMiner)", "value": "9374262345d0f035d2b41fb21cdf51924b96c87a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775291025, "uuid": "eae2c141-9acf-47fe-9874-09655bfc20f2", "comment": "Malware payload (CoinMiner)", "value": "fd6551f575b733fca3abc4d42b6d3eee37bc1aeabcf25434fc1d8022a070c61e68a3f1db7387cc062949242ec6d02248", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775291025, "uuid": "b72db9f8-329a-44a3-814d-303509381e54", "value": "T1B9172383E4C827E8E7B78B01D297358FFAA132755F65984D26C81C034A13DD75E4AE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775291025, "uuid": "69f19c94-2dc0-437b-bca3-9e5977e8da99", "value": "c7b7b517cf49febe9724e1b897a98881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775291025, "uuid": "dcb8432a-5c40-4170-a47e-3dc1ec4d167a", "value": "393216:nT06KSR5/fnBBy/4lGwNQ284WSzhmiVQn6SNqhRAK0ZLQlOixa6N:TP77awlbQ2zVQntshKOli6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775291025, "uuid": "a4eebe0f-e061-43ae-8c12-00867d208411", "value": 19443712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775291025, "uuid": "2a4fd369-3036-4139-9fdf-dd3f14a8059a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775291025, "uuid": "932f6c13-afd2-45a0-bdfa-adbf036f58b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7073bf-2ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287516, "uuid": "402431dd-7e58-4280-ae17-f4eb155325bd", "comment": "Malware payload (Mirai)", "value": "5d20761bfcf1a6034e1e7899953ec808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287516, "uuid": "2dd36aa2-2eca-4fdd-94aa-10ac6e006b83", "comment": "Malware payload (Mirai)", "value": "efc5bbcf49271bc9c0392ac79924984f720dd282b7fa44341d2be26c215ae964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287516, "uuid": "d7ce0aa8-2d52-48ff-844a-7bb5a85d128e", "comment": "Malware payload (Mirai)", "value": "ea53524c22e19ac00729ed87748c9b6e1da66198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287516, "uuid": "5d0783a2-382b-422c-8ab1-aebdb045478a", "comment": "Malware payload (Mirai)", "value": "377a7e61614b55a4a220003b6646e3e412b2fdeb300dd82843cc5f9ca00a62fd0e3681830510ae0185dec12012688443", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287516, "uuid": "e2604d6b-83b3-4d63-8c4c-ed10c5e31a76", "value": "T1A7156C5BB2A374BDC017C43443ABDAB2A935B43902226E7B65C4D7303E27E741B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287516, "uuid": "28d2e59f-88f8-4117-a00f-43388a9d88ca", "value": "24576:9MnLr4skk55qE8seHaitT3LmurlWIJHFhv:unX4skkTGztOqTJH7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287516, "uuid": "28d63b0b-0c89-4d83-88bd-5de5b18b2c2a", "value": 897896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287516, "uuid": "4a5a85fa-e6f8-42da-932e-0515f2d7b9d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287516, "uuid": "d7f1e651-879d-4569-8818-a4fc2d2122b5", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b9de08-303f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775318370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318370, "uuid": "bbdd9bac-e232-4d32-b14d-91af3296bd10", "comment": "Malware payload", "value": "730f869b468801c525fd26a244b8464b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318370, "uuid": "9df2ab7d-ba5e-4d75-ba42-f4ca7b1d58e9", "comment": "Malware payload", "value": "efdf5db823eaea4ed3482b497f47663ebbc3294ecf2b99b977293055905be31f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318370, "uuid": "b66d90fa-bff6-4e10-a82c-933b8d0f5ecf", "comment": "Malware payload", "value": "fed0d709fe0460d8131fe4945f6e104882c95d73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775318370, "uuid": "a29c94c4-1abe-4f7b-9fb4-fb528ac39017", "comment": "Malware payload", "value": "fdd276f4411409bf517f7a75be4d8c6f0297021f88cd030f47b1aeb8dd2cb40e43f2c4b36add99faf17ff1904be9a463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318370, "uuid": "3c513b11-ca6e-4b01-82b0-85a432587bb0", "value": "T198F77D4EBB41CDE3E1198534D8B64BE07372ECA18B614B5721D43729EF3B2D50FA6688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318370, "uuid": "fb6fea60-0d0c-48c9-bfcb-f17faa182b64", "value": "e4c91d789dbb9462c69a5d2220a2aa0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318370, "uuid": "2cc6acb7-7580-4aec-87b5-709dd87e67dd", "value": "196608:SBqtiEPFNPy9iRl0TCMfM2+3vGd0hcZRSjHF2lFC/p+HINcZBAwLYhuR9lfn+Of3:Y9iwTDdJRKHgC/p+HuPOc47L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775318370, "uuid": "de258f93-242e-4840-b91c-24abe446161e", "value": 73018140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775318370, "uuid": "cb6ba98f-35e8-4949-ba1f-4d718e6b5676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775318370, "uuid": "8f0bf92f-b386-4b7a-9dc1-4015115e4556", "value": "$RNILUEV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4ec35e-3027-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775308214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775308214, "uuid": "e60da37a-b673-4dc4-bab3-f8e7ab9e2c23", "comment": "Malware payload (AsyncRAT)", "value": "06cc24d1e0c1f80160c791c5969cc44a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775308214, "uuid": "07b8173c-eec8-47c1-9db5-ff76edf6f8a8", "comment": "Malware payload (AsyncRAT)", "value": "f10b6634e99ff37ec83b9fecbc7cee089c1c82999eff9a6dc4519071e38f8000", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775308214, "uuid": "c8c525ac-282a-449a-9f43-64df6a1fd96f", "comment": "Malware payload (AsyncRAT)", "value": "10d3b77e23089b694da5049a517b16abafa5e83d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775308214, "uuid": "ead44576-3c00-4299-809b-7993ec180001", "comment": "Malware payload (AsyncRAT)", "value": "e80770d7344cc348a4967edf866ba5251e9e4e3edd322fce810283280e72e307f913ca723c14e27218062382d1747436", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775308214, "uuid": "2178e572-f38c-4757-8b88-e96692893c96", "value": "T1CB233C043BEA812BF27E4F74A9F25245867AB6633603D60E1CC441D75B13FC696826FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775308214, "uuid": "6a1ac1a9-ded9-4a8f-bdaa-202b67d20616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775308214, "uuid": "18fa5e94-923f-43ba-9c38-1703c942c53b", "value": "768:WuYi9T3kH1jWUvTqRmo2qbWfbGKTmrJydPIhYc00bAxBtT4Ya9AKvVCyBDZpr:WuYi9T34y2bFTmrVhYqbAxB2vyKvxdpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775308214, "uuid": "26a991a4-f986-4594-862e-5a2f2d769108", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775308214, "uuid": "a3dcb53f-cd4a-4b1a-a5bf-54bdb14a303b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775308214, "uuid": "612ec6b5-1aa8-48dc-a61a-4ced189f0e3f", "value": "AsynaaaasdsadsadsadddddcClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2ea25a-3048-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775322171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322171, "uuid": "71a1cbda-4bc8-4892-a172-064393206330", "comment": "Malware payload", "value": "b245ad4594caa119bbcf548e559a8df0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322171, "uuid": "cad56dcb-3271-44f2-8c95-45a65729e413", "comment": "Malware payload", "value": "f5213422073f752fe534ac6e88b777b728dc9a85474ae577c92ec8db5692b961", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322171, "uuid": "d6997c91-2223-475a-9a85-bd359a1f890e", "comment": "Malware payload", "value": "f8f7523eed444b21db9f6c178bc9c7c96a670ed8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322171, "uuid": "15a06fde-ae02-4a75-8bc9-097bcdd9d98e", "comment": "Malware payload", "value": "aaa59e566aea0a53f94116df4f35793d2013658d3c1ca56de673dd0839559410a5f3f7ee46863f802f311f18190171fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322171, "uuid": "2197b609-202c-4f83-b32d-5f49f2c65ff0", "value": "T1D83189F520F5EDF4338F9910B3BB182164232589AE436D6D9437B41450FEE87A12DC12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322171, "uuid": "6db4d51d-0e5f-4a2f-bbc2-4fe42dc1cc81", "value": "48:IS/u8jt65E3w+wWkkh4p3I1djbR27K+I7SkQiHID:ISBt6i44x/tH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322171, "uuid": "6eb55c7f-1e99-47e0-83c8-36f59f2acf5a", "value": 1793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322171, "uuid": "96c75fa7-326b-4647-b7ff-66d07ad6f859", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322171, "uuid": "93b5f5d6-4305-4bb3-818c-f0e8777a4372", "value": "dob.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18b38e2-301a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775302636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302636, "uuid": "2d180133-5d7f-471a-9ac4-64d174b2bba7", "comment": "Malware payload (Mirai)", "value": "88b7f9969983196a93dc9963e22a8f4f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302636, "uuid": "3207c279-6742-4d7d-ba7d-5658fb2c220f", "comment": "Malware payload (Mirai)", "value": "f542250ae5dc2639d55689e747dcca42e62a6af253cc9eddf55c8c7239a9b6bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302636, "uuid": "552b5d66-98a4-4d28-a3cd-4a0cd9809fb6", "comment": "Malware payload (Mirai)", "value": "602c1f9b8ebfcbbe3b12f260b5af8a6597ab90b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302636, "uuid": "fd32769f-683a-4362-9957-1145c5da8d5b", "comment": "Malware payload (Mirai)", "value": "06fc841443999e2beec541646a481dacf004a27782338a1f278735e9d2c6c8d51ee2f139dba11b563892f184e32ba8ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302636, "uuid": "ce1c5334-f480-4501-9f3f-feb1e485dbba", "value": "T16212C95BA35659A8D89C4330429F4293FBF3F97845F23B1B3D4811341C436284DBBE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302636, "uuid": "40cae825-7d3e-4bb7-8068-79fdf9decb98", "value": "24:GxI1sosEs/AD1snix3slMQ7g+M6Ae2hSq2zwdpP+js+U:GxINsoDOiRs3gpve2gq2zw7GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302636, "uuid": "308392e1-328f-480d-a448-1e825e4437e0", "value": 9432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302636, "uuid": "319c32df-d0d9-45c6-9700-d3bbb4c61efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302636, "uuid": "f4e82cec-360d-41b2-8820-12b0f99f8a54", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6b9488-3079-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775343426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343426, "uuid": "bc3a2a92-05b1-425d-8cb4-6b245f6c8d79", "comment": "Malware payload (Smoke Loader)", "value": "c256de6273e6fa9496da0bf077ae0cec", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343426, "uuid": "4e1dc1f1-c316-4e9f-8abb-3dbbed239275", "comment": "Malware payload (Smoke Loader)", "value": "f8b3d18169d7f087da22658d5a5808d0025c02e208fd502e419daafa322a6ebd", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343426, "uuid": "ea395e90-38a7-4b6a-944f-d8d8b700f95e", "comment": "Malware payload (Smoke Loader)", "value": "46033184317382a9621991af7d77bebb455e309a", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775343426, "uuid": "3f6adc13-38d9-412d-8d83-2b922e580b12", "comment": "Malware payload (Smoke Loader)", "value": "c4f5d7be19064287e090fb2484cff1b4a4ef3a401b5cbc10793db6389e777478f066a0f23a097c76c86f7327a1f8c4a2", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343426, "uuid": "44b7be4c-4233-4c2a-a6c6-ef57f64a63a9", "value": "T17A654A4B7CE148BAD4AA933288B652927A32F8190B3273D32F50BA783F777D05975714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343426, "uuid": "d11c15ac-3966-4b41-b5d3-632f2098b56e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343426, "uuid": "4224e3fd-4ba2-4d02-af16-6ea9f28bac04", "value": "24576:0us5E/pvD2wE3BBmBvp/JPlETIrovYLaqGRWctp/uoU:0uOE/UwXBhldmVXu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775343426, "uuid": "edbce6f6-8097-47ab-8535-9e169a9cfebc", "value": 1473168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775343426, "uuid": "927f01be-eb5b-4223-a5d1-56f77d088482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775343426, "uuid": "a48248be-23ac-47b6-8fa2-291643f7eec7", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa81d08-2ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775287037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287037, "uuid": "c6e87b2d-e943-4f9e-83b4-a1d81d412de8", "comment": "Malware payload (Mirai)", "value": "6da42bf9b4e40022340708a4f2572591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287037, "uuid": "a7b91b31-6b71-4894-857e-a826ee7a187e", "comment": "Malware payload (Mirai)", "value": "f95aa768c9329fd90d82bd206e0c2544dec6865ae2efc3956c81392b1e11a39f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287037, "uuid": "c9d082cf-7c29-44a3-b4d7-0fa67a9b6c44", "comment": "Malware payload (Mirai)", "value": "cfd79507234958407313877ccb7d0506bb529ef4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775287037, "uuid": "07341958-703d-45a8-9bc6-94e8acc67a33", "comment": "Malware payload (Mirai)", "value": "c4135d9b861efd608ed6fbb655dc4d04896eddbb2cde4f6fe1df89cee3c1bddd96ed9dadc3081933f27b2a856706bebd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287037, "uuid": "31e78f7f-6af9-41a3-a296-f8915eecd022", "value": "T1BD73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287037, "uuid": "692a7363-48d8-47db-85d9-de0a0a458b65", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStk:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775287037, "uuid": "3ccb0d5c-2d97-4d43-bd46-2798b790d70a", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775287037, "uuid": "878e900f-58f7-4e9b-9c5e-66af782e4eb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775287037, "uuid": "6900d860-e5e0-4662-a4e3-91ab3ade03fe", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d716eb-3047-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775322051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322051, "uuid": "78dcbab6-a314-4327-8b72-b1c3e247f79f", "comment": "Malware payload", "value": "90f507fb15cff969564537dfcc1858e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322051, "uuid": "a443be70-2610-4ec7-8480-5277f749985d", "comment": "Malware payload", "value": "f9dd99970ad2a4ce3ed0f3c37a2cdac97260b0427dd77ae2eeafb148e1189f49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322051, "uuid": "b7b0b4bf-1ba5-4ba3-a5d0-859e369fe878", "comment": "Malware payload", "value": "8ec3bc70f54a5f267d12d56a51682b21a37f0496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775322051, "uuid": "2f1f6a9c-1328-4a31-82d8-5ad4b3eb42e6", "comment": "Malware payload", "value": "e8fd1a0ce7edb6c72641f223edf1c8b968771661f4076d3b573dd6893a3820b5b58f93b4536f496a4bac6a16da284f97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322051, "uuid": "b8062d59-fe48-4b95-a8d0-ddc12546b5b9", "value": "T1D885F757E89590F4C0EFE174C726A213BAA13499473437E36FA18AF11B26FE466BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322051, "uuid": "a5053d0e-658d-472f-b198-073cb77035c8", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzw:cqYUQuVD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775322051, "uuid": "fe973a60-a345-4603-a4ed-c841037c99ba", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775322051, "uuid": "08976be4-5db9-42fa-ae00-64209f17d69c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775322051, "uuid": "04940c27-df93-4b8c-b9f1-4b79b5dc1511", "value": "f9dd99970ad2a4ce3ed0f3c37a2cdac97260b0427dd77ae2eeafb148e1189f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf5b29c-2fbb-11f1-a769-42010a9c0008", "comment": "Malware payload (ZigClipper)", "timestamp": 1775261881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261881, "uuid": "d3fe752d-c9c1-49af-bbaf-1125f8c2a81e", "comment": "Malware payload (ZigClipper)", "value": "01b268607668f522963a3bcca15fc286", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "paf-hugo-mapp-co", "colour": "#BE6BFE", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261881, "uuid": "e9e08b3b-ebf7-4232-b8c1-b69972e8f979", "comment": "Malware payload (ZigClipper)", "value": "fb21a5516ab007bd013ba2a180c02fcac0e0270848b3c7f79a25a323d2c1e242", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "paf-hugo-mapp-co", "colour": "#BE6BFE", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261881, "uuid": "9a5d8b7a-4b4d-4599-a539-19014cd05d2d", "comment": "Malware payload (ZigClipper)", "value": "5c8e7ad95c812c9eca3a4862c4c2d6f0933390c1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "paf-hugo-mapp-co", "colour": "#BE6BFE", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775261881, "uuid": "639d835c-bf40-4258-88d2-75bc05a97303", "comment": "Malware payload (ZigClipper)", "value": "b3e15dc602cd8f037db09150ef1738de50b3afb8cf922a538c9f1dcfdfcc4416f473a8fe2583d71e2fb16a7e6de87715", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "paf-hugo-mapp-co", "colour": "#BE6BFE", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261881, "uuid": "ea1c1da4-de05-49fc-8923-ba44dcd5ca96", "value": "T143A633E0F6C06FC1E221C97143F890B5E9ED5CA670A3ED66BC131B5D21825F3A7AE449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261881, "uuid": "bb915c5e-70a7-4de4-8bba-a59568aa135d", "value": "196608:35+uWL63x+mb2ZYYL6IPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9yPZ8yAeH2b:EL63Mmb21ehOnn7FUNyhGprLz0Ah85e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775261881, "uuid": "0b623bca-fe3d-4747-8186-128fdd3e1fc6", "value": 9652189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775261881, "uuid": "413acfb7-539d-460a-be2c-c8311c5098e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775261881, "uuid": "79ed19e4-e8ac-4704-9261-7e4b15e9749f", "value": "1f86ed90-6b0e-41e4-b4b8-dee23cfba442.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a126f9-300d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775296928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296928, "uuid": "cc86ff28-cdf6-425b-b791-5bc75dad4ee2", "comment": "Malware payload", "value": "4f26a6a3375ff139ddf6b8fc93a50a53", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ICP-C2", "colour": "#D7F10D", "exportable": true, "hide_tag": false }, { "name": "npm-worm", "colour": "#DAF43C", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false }, { "name": "systemd", "colour": "#919AEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296928, "uuid": "285513bd-b8d2-4861-a797-03c8a8498932", "comment": "Malware payload", "value": "fcdda01cd9233d775b417605c53ebad71afada9f1b616c627c3e7a147a5b1c67", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ICP-C2", "colour": "#D7F10D", "exportable": true, "hide_tag": false }, { "name": "npm-worm", "colour": "#DAF43C", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false }, { "name": "systemd", "colour": "#919AEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296928, "uuid": "0aec421a-1363-4acf-b62c-58e6480c8184", "comment": "Malware payload", "value": "fe9e066bc41fc11f5994a29dce00430d7fb41869", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ICP-C2", "colour": "#D7F10D", "exportable": true, "hide_tag": false }, { "name": "npm-worm", "colour": "#DAF43C", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false }, { "name": "systemd", "colour": "#919AEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775296928, "uuid": "42870c24-53d3-422b-8d67-19771e6dd8b1", "comment": "Malware payload", "value": "e53db198976123e1edcf86a058e302b8c03c7b1304c2265555ad96941878774cf961d08c8881c8740d043df290687d63", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ICP-C2", "colour": "#D7F10D", "exportable": true, "hide_tag": false }, { "name": "npm-worm", "colour": "#DAF43C", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false }, { "name": "systemd", "colour": "#919AEE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296928, "uuid": "8df835a2-034a-477d-8c9f-0b4f047b792e", "value": "T172A1AE643D118DF83E3807A88544B4719712FAE5860CD83AF78034AF8B9C1FE22BAD61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296928, "uuid": "9b460ca6-d274-4c02-a2a2-1765671b86ce", "value": "96:EyJmlXbr69FcqAzaLOfdvepU2mQr9mjFSowHMBM3uor/UVDUEQPnjCv:Ey+uUqAkOfdG/9MdM+0/UeEQPuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775296928, "uuid": "61d6919a-f782-4d1f-bb02-ddbc695402de", "value": 4961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775296928, "uuid": "31c47846-43f2-419b-afba-caa8d0b4de3b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775296928, "uuid": "028eff86-4ad7-4b81-9fb6-6871ae165630", "value": "opengov-form-renderer-0.2.20.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c75ad9-3042-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775319799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319799, "uuid": "cbfc8f4e-89b7-439d-95ce-4c13e772d26b", "comment": "Malware payload (NetSupport)", "value": "e82b7ee68799afb5e1c0c66aace1c023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319799, "uuid": "ae66ad8d-92d2-4dc2-b667-0dbdd53c68d2", "comment": "Malware payload (NetSupport)", "value": "fce1b5b74ad27801a11d36f24c805a36ce16f7a8c280b339624f9548eed49ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319799, "uuid": "d3c551f0-6226-466d-a75c-ac2e7b316a7c", "comment": "Malware payload (NetSupport)", "value": "4b92905089b566a4b7c00ff820d1c70ddb3d5caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775319799, "uuid": "5eefbd25-f65a-40d5-98c9-f17e863bbee0", "comment": "Malware payload (NetSupport)", "value": "4010ca1052d595532ed9f2f707d0625caa3ecdf78fd8e43b00debbefc1d6bb610fb5d782d1a990acf8de50e4fb485f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319799, "uuid": "4ddd2b37-0dbc-4628-a3f2-64df6953c001", "value": "T160064C2BFCBB4CA9C499A135443361077E35B8405B6263D72AD0B3682F776F0A8B9F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319799, "uuid": "730c46bb-3c74-41ca-888f-18dca20f0266", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319799, "uuid": "87ca7eda-72e6-4deb-8939-d8c02029fa32", "value": "49152:1AaP94S7EcIMrPuiQAhS9Q3vqETIjsdc+HR:1RsRMrJyeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775319799, "uuid": "b061a97b-1277-4530-aa6d-bfd8939baadb", "value": 3944960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775319799, "uuid": "6a6d1e82-9063-40f1-beae-97817474b27a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775319799, "uuid": "2fe9b8a3-a016-40fc-b112-b752db112f08", "value": "SecuriteInfo.com.FileRepMalware.78694332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5201e4-2fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775262951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262951, "uuid": "e16f52ef-454a-4251-bc82-b10b658f98e5", "comment": "Malware payload (Smoke Loader)", "value": "ff9734ed1c80161488c710e5a7ad1f79", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262951, "uuid": "ddde1c60-069d-4c95-971e-ca9d57fcd2a5", "comment": "Malware payload (Smoke Loader)", "value": "fe39618cf95e1aed7487364f17ebc3a727a3c1f8f68722671214bc6252045f61", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262951, "uuid": "349805bf-33a2-453d-83f1-04cecf167d1f", "comment": "Malware payload (Smoke Loader)", "value": "7cec159014bf209f0c123eeb272dc7383a31ed45", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775262951, "uuid": "29584405-0da1-4cb7-8c8f-7eb9015a7a82", "comment": "Malware payload (Smoke Loader)", "value": "3f3a83a2fdfdb68e5d09bce2c1c6d3a430d11fa461390fc970a46122bafea23af1c7f76abf77f68faaabba1db110a865", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262951, "uuid": "4453b325-95ec-40b5-bb63-986f7f0dcd77", "value": "T191D40EFF6B2061C2FA176AFE96806D05C7A07F96B5BA4F9A1186F7178D389034F08C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262951, "uuid": "3423f1bb-851e-4462-9575-9a5d3794aca8", "value": "6144:V9QFqM+rnK97WdCqXJ+sYAV8AahbroyFwd1pFNixcd00tFE6sOH:fRnrK9IdKAahPeDjNiuti6sOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775262951, "uuid": "baafd665-f55d-4517-82b6-138d1df3b470", "value": 606464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775262951, "uuid": "24186010-e757-4e3e-9fa7-969efbaedf96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775262951, "uuid": "53c616d1-531a-49d9-9f43-8863970af7bb", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06e0801-3024-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775307009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775307009, "uuid": "0d37f372-5903-4b68-a719-3d5c814555ab", "comment": "Malware payload", "value": "85d37bd3f785c39f11c13c7fdfa4c99e", "object_relation": "md5", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775307009, "uuid": "fd04a002-9235-4d3c-8911-1ed1c2de1dda", "comment": "Malware payload", "value": "fea2040c75d4947723e48547d773f8f20816f45fc3c2c789e893e3700705499c", "object_relation": "sha256", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775307009, "uuid": "af0c91a7-d47a-455d-b9d5-6568d1f88ac8", "comment": "Malware payload", "value": "a0ecd4bbba77e5f1a861736d20155404b211f26d", "object_relation": "sha1", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775307009, "uuid": "48795cb8-badd-4e54-8949-53cb4741118c", "comment": "Malware payload", "value": "39098ad8805287c2d2c1dd7725ffb63ce5b0706f4e4a588a76315a2f56c215d515506e626bbf0b925d776d7f853dcc66", "object_relation": "sha3-384", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostInjector", "colour": "#B2FC07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775307009, "uuid": "049f9baf-36bc-44d2-8e29-59d3d874c0a9", "value": "T1BDB54ADD766072EFC85BD4629EA82D68FA5174BB831F4203902715EDEA4D897CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775307009, "uuid": "3c4ba742-7854-4e26-8522-72d4da02f5fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775307009, "uuid": "e8750732-3e64-4244-8dcb-5aedc40a9526", "value": "49152:TarcrHJGWTm79r7UqxQnoYgx1gPEFgrX5uyl4KK4c9yZ:TXJG/7xgqxQnhgx1gsFgrX5u2FKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775307009, "uuid": "a15d91c0-4d05-4d60-8aff-80c17c5892e1", "value": 2279936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775307009, "uuid": "64537a47-11e2-44a0-bf6c-d0f76450abe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775307009, "uuid": "2665051d-b22b-4705-be15-d80aadf774ce", "value": "fea2040c75d4947723e48547d773f8f20816f45fc3c2c789e893e3700705499c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57001f9b-2fd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775273734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273734, "uuid": "ee8e856a-2c2f-432e-a8d5-e45692e2a1c6", "comment": "Malware payload (Mirai)", "value": "182be1bdcb5d0ae9bccaae7b1bc31614", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273734, "uuid": "b4dd699a-8f7c-4129-8a49-d9853943f167", "comment": "Malware payload (Mirai)", "value": "ffacb84755f5cb3f6cab375acfa999130585935dd3cef52294620630b830d491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273734, "uuid": "73ee7805-df48-4b9e-9846-d0749e017273", "comment": "Malware payload (Mirai)", "value": "06f04e77948be7f96241464b12cef6bfd3f2e9bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775273734, "uuid": "8ab1cef9-6243-4ea7-a0ab-04a1e5e0bf23", "comment": "Malware payload (Mirai)", "value": "b78d892d03574d32a6606c7d1122ce5e442cc03ab23835ed57ae6dc95c50363adba08a47486d5fe997660a9f0f61c8f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273734, "uuid": "98459540-2868-4f5c-9acb-87103c362aa9", "value": "T1EC93F60ABF610EFBDC6BDD370AAD070125CC581612A96F3AB974C92CB54F64F1AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273734, "uuid": "e6bd70fe-336a-4bca-ae12-fa4caab3c4bb", "value": "1536:JFmDMIQWaBkZjVqE8yNwi9AQUyeHYZ+qvDdh9j:JFmDMIQ2pwiAQEYXzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775273734, "uuid": "54cda967-9ec6-4253-bb98-a4d96fc777c5", "value": 97628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775273734, "uuid": "21dfd168-b82e-4892-8119-5f077bfc6883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775273734, "uuid": "11913030-8f46-4398-b188-302c8e6edb99", "value": "dipndotsk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c912e8-301a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775302777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302777, "uuid": "33700562-b885-4194-923d-b689e2b70822", "comment": "Malware payload", "value": "7bbe877115f95c92f0f52e6a15755020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302777, "uuid": "3b0aa1ac-9c23-40c5-a3cd-f4914eabb1d2", "comment": "Malware payload", "value": "ffad344a1fccb6dfd40126b8bd8dc4deaa736839fd528ceebffa1447409a81da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302777, "uuid": "6a0b9220-e804-41ef-9625-509b410f296f", "comment": "Malware payload", "value": "179e94f4f180a708d5eaebc85fa039be16c82b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775302777, "uuid": "57887c88-0ac7-4b61-b9f5-786c000a068e", "comment": "Malware payload", "value": "f291b057dc6889c1df27d7a3fca3fc04e88045378e250bbcc99a8877fe3c5b0546d7ab90ac1deab8a1228815a6d80d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302777, "uuid": "558370d6-1de7-437e-9b8c-01c5e9b2bac6", "value": "T185652C57E35344ECC16BC17486579A72B630B85901387E7E9AD4DB312F22F60AB2FB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302777, "uuid": "f4b76d27-b903-4d14-af8b-a8b4c6835ad5", "value": "58089cc3b3e38dd73eb06b926354fa8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302777, "uuid": "1f57fba5-4382-45ea-ad9d-986b5cdbfed8", "value": "24576:3BPIT8Ve13LNnUYJ+mUJRbXCEWwYl8pm2XkKttu62d3i:uTMeJLfkHVyTwMKUKtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775302777, "uuid": "b88a65f7-dd4e-4d5a-94f5-8f58c01b7906", "value": 1455616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775302777, "uuid": "403236a7-9736-4aa5-97d0-b47f83aacab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775302777, "uuid": "62e79dfc-15af-48da-887c-f97aa46525e2", "value": "program.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }